A quick post on how to extract AutoHotKey scripts from an AutoHotKey script compiled executable.
The SOC Toolbox: Analyzing AutoHotKey compiled executables
Category: Forensics
IcedID & Qakbot’s VNC Backdoors: Dark Cat, Anubis & Keyhole
In this post we introduce Dark Cat, Anubis and Keyhole, three IcedID & Kakbot VNC backdoor variants NVISO observed. We'll follow by exposing common TTPs before revealing information leaked through the attackers' clipboard data.
Investigating an engineering workstation – Part 4
Finally, as the last part of the blog series we will have a look at the network traffic observed. We will do this in two sections, the first one will cover a few things useful to know if we are in the situation that Wireshark can dissect the traffic for us. The second section will … Continue reading Investigating an engineering workstation – Part 4
Enforcing a Sysmon Archive Quota
This blog post will create a Sysmon archive quota through WMI event consumption to avoid storage exhaustion.
NVISO approved as APT Response Service Provider
NVISO is proud to announce that it has successfully qualified as an APT Response service provider and is now recommended on the website of the German Federal Office for Information Security (BSI). Advanced Persistent Threats (APT) are typically described as attack campaigns in which highly skilled, often state-sponsored, intruders orchestrate targeted, long-term attacks. Due to their … Continue reading NVISO approved as APT Response Service Provider
Investigating an engineering workstation – Part 3
In our third blog post (part one and two are referenced above) we will focus on information we can get from the projects itself. You may remember from Part 1 that a project created with the TIA Portal is not a single file. So far we talked about files with the “.apXX” extension, like “.ap15_1” … Continue reading Investigating an engineering workstation – Part 3