Questions tagged [malware]
Malware is any malicious software, script, or code developed or used for the purpose of compromising or harming information assets without the owner’s informed consent. Examples include viruses, worms, spyware, keyloggers, backdoors, etc.
829
questions
0
votes
2
answers
27
views
MISP instance through docker on raspberry pi running Ubuntu 20.04 server
Thanks so much in advance for taking the time to read/provide any advice here.
So, I am trying to get an instance of MISP running through docker. The hardware I have it running on is a raspberry pi 4 ...
-1
votes
0
answers
23
views
.Bytes format is an hex file or exe file? [closed]
I am doing a research in malware and I have downloaded the Microsoft_MalwareClassification
dataset which is made of .asm files and .bytes files (which are two different representation of the same ...
-1
votes
0
answers
6
views
How to fix the Start_up_url
I am currently facing tracker problems. In my chrome secure preference the start_up_url is shown as find-it.pro. It's shown as like that "session":{"startup_urls":["https://...
1
vote
1
answer
54
views
Can python37.dll suddenly become a malware?
On my computer I have a few conda environments. I was running my pycharm project using one of them. I use this environment for the last few months, but today, out of nowhere, malwarebytes (my ...
0
votes
0
answers
59
views
Has been infected with what seems like Poweshell Script
I downloaded some book collections as a zip which had some legitimate jpegs and 1 fake jpeg which was a text file that had multiple spam lines and periodically hidden code lines.I want to understand ...
0
votes
0
answers
7
views
Creating Kibana Dashboard based on Malware
I am thinking of creating a Kibana Dashboard to detect malware by the use of graphs/visualizations. Anyone have any ideas on how I can implement a dashboard based on different visualizations of ...
0
votes
0
answers
13
views
When I scan my magento website it Detected encoded JavaScript code commonly used to hide suspicious behaviour
When I scan my magento website (using tool: https://scanner.pcrisk.com/) it Detected encoded JavaScript code commonly used to hide suspicious behaviour.
Severity: Suspicious
Reason: Detected ...
0
votes
0
answers
23
views
Analysing malware with VM [closed]
Can anyone recommend a VM for testing Malware safely with no risk of main computer/network being affected?
I've heard some people suggest even just using Windows Sandbox.
Anything I should consider ...
0
votes
1
answer
15
views
How did this machine establish an encrypted connection with a server with just a TCP handshake?
beginner here.
I am currently looking at some C&C traffic from an infected machine and have come across some interesting TCP segments within the PCAP file. Most of the traffic is just regular ...
0
votes
0
answers
17
views
Difference between File-based and Fileless malware
First question on here. I'm reading up about malware and I've hit a bit of a wall. The distinction is between a filebased virus and a fileless virus. Apparently a file based virus sticks itself into ...
0
votes
0
answers
37
views
Google COLAB crashes whenever I try to import the ember [dataset] library
First I install the EMBER dataset packages to the notebook as specified on their repo, https://github.com/elastic/ember
!mv ember ember-master
!cp -r ember-master/* .
!pip install -r requirements.txt
!...
0
votes
0
answers
22
views
How to resolve website is reported as malicious by antivirus softwares
My website is flagged as malicious by some software and therefore blocked on some Windows computers.
For more details I use React for the front end, express for the API, all deployed by Azure services,...
0
votes
0
answers
54
views
Command to remove a long JavaScript malware code with all sorts of special characters
As my subject line states, I have thousands of .js and .html files infected with javascript code (WordPress) and want to remove the code. I tried different sed and find combinations to no avail.. ...
0
votes
1
answer
27
views
Windows Reverse Engineering
In the part of my malware analysis. I wish to learn more about windows malware reverse engineering. but I only have a little knowledge of reverse engineering. now I read some books related to reverse ...
0
votes
1
answer
50
views
understanding cuckoo sandbox json report
I have setup cuckoo sandbox and already analyzing some malware
the problem is im having a difficult time trying to understand the json report . could anyone please help me understand the following : ...
0
votes
1
answer
19
views
How to download CTU-IoT-Malware-Capture in IoT-23?
Stratosphere IPS Team (IoT-23) doesn't permit me to download all CTU-IoT-Malware-Capture.
I want CTU-IoT-Malware-Capture-7-1 to complete my research.
Thanks :((
enter image description here
0
votes
0
answers
27
views
Converting a HEX user input to executable HEX and not a string
Scope: I am trying to research on a malware where a ShellCode in HEX is statically declared in a variable. I am trying to make it dynamic so it can work on the same hex but taken from user input. The ...
0
votes
0
answers
8
views
How to create a virtual environment inside window with availability of security solutions?
Hy I want to test public exploits and i don't want to disturb the network for it, Is there any way to create a virtualization in window which contains the security solutions and at the end it can be ...
0
votes
0
answers
101
views
Hook instagram apk using Frida
I wanted to hook some functions from instagram apk using frida, decompiled the apk with
jadx/JEB, one of the functions I wanted to hook was in this:
public static void A00(HGf arg8, I1Y arg9) {
...
0
votes
0
answers
133
views
Access class variables declared inside another class using frida
I was trying to print an instance value which is declared using another class by using Frida how can I print the value of this instance, for example I have this code::
public final class myclass {
...
0
votes
0
answers
23
views
Testing the performance of android application used for malware-detection
I am implementing an Android application that detects the existence of malware in any other selected application, I want to test the efficiency of my application by running live malware, what is the ...
0
votes
0
answers
14
views
A process named - abnormally occupies GPU resources
Every time I just connect to the server and execute the command nvidia-smi to check the GPU usage, I find a process named '-' using GPU resources. But when I execute the nvidia-smi command again, the ...
0
votes
0
answers
41
views
/System/Library/Kernels/kernel is Unsigned on MacOs Monterey
process "kernel_task (pid: 0)" /System/Library/Kernels/kernel appears to be unsigned in Objective See TaskExplorer, though it is not flagged by VirusTotal: https://www.virustotal.com/gui/...
0
votes
2
answers
409
views
I installed a software from chrome, and I think it was a piece of malware
The malware affects my Chrome. Whenever I search, it makes me use bing as my search engine. At random times, it redirects me to an advertisement website. Virus detectors like Malwarebytes cannot find ...
0
votes
0
answers
61
views
Is return unserialize(base64_decode($settings)) malicious?
Wordfence is highlighting this as a malicious code:
function customFiltersSettings() {
$settings = get_option('wp_custom_filters');
if (!$settings) {
return null;
}
return ...
0
votes
0
answers
27
views
webc2-greencat-2 decompile unknown function use
I am currently in a malware class and we have been tasked to decompile a known malware. I have a 2 functions I cannot figure out the use of. Both these functions are only called a few times in the ...
0
votes
1
answer
135
views
Hide A specific Admin Account From WordPress User List
I use the following code for hiding an admin user, but when I press save button in cPanel I get error message (BAILOUT malware detected).
function dt_pre_user_query($user_search) {
global $...
0
votes
0
answers
228
views
Wordpress website index.php is injected with malware and code regenerated once deleted and wp-admin is not access
Problem 1: can not access to wp-admin even top logedined bar is visible and body with 500 error as show in picture below
black page image
Home page image
Problem 2: can not delete the malware from ...
1
vote
1
answer
13
views
Why do Malwares such as Karkoff create and store log files?
I am discovering computer security principles and came across malwares and saw that some of them create and store log files...any insights regarding this matter?
-2
votes
1
answer
282
views
How do I Remove Malware on Wordpress Website when I have cleaned up files?
WARNING - Website contains malware.
Website is https://officialsportips[.]com
Hello, My wordpress site contains malware and when navigating to the home page it points to: line[.]storerightdesicion[.]...
0
votes
0
answers
17
views
Is there a way to identify which system calls a program will do?
I want to write a program that does something like this.
this may be stupid, but I have thought of two ways to achieve this:
run the program and identify which system calls it does during run time
...
0
votes
1
answer
154
views
what is os.dup2() method for and what is its use
I am learning python and hacking stuff, when I came across the following code snippet:
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.20....
0
votes
0
answers
39
views
Why does antivirus software have difficulty scanning memory when malware is unpacked?
I can understand why antivirus software has problems detecting malware on disk because of packers. However, what is the problem with scanning memory when it's unpacked?
Why doesn't AV software just ...
0
votes
0
answers
26
views
How to remove IIS coinhive malware attack 403 forbidden?
I'm running my .net core API on IIS server. When I call any endpoints of my API most of the time it works fine, but sometimes I get 403 forbidden error. From the browser I don't see anything in the ...
0
votes
0
answers
51
views
How to set the Exchange/Forefront proxy authentication property?
In Exchange Powershell shell, if you run
Add-PSSnapin Microsoft.Forefront.Filtering.Management.Powershell; Get-ProxySettings
you'll see an output as shown in the window.
How can I set AuthRequired : ...
0
votes
0
answers
80
views
What precaution to take when opening malware file using python script
I'm writing a Python script to check the file hash of a malware sample against the VirusTotal database.
At the moment, I'm using a build in open and read functions provided in a standard python ...
3
votes
1
answer
156
views
Need to identify malicious code in hacked Wordpress site so I can stop other sites getting hacked
Many of my Wordpress sites have been hacked with a very similar bit of code.
A single malicious file gets injected into the wp-admin folder with a path like
wp-admin/.1e9732/4f085115.php
The php code ...
0
votes
0
answers
78
views
How to give python script admin permission_
Im curretly working on a 'malware' in python. This should download a meterpreter payload and run it, after seal google chrome saved password and show a message box that tell 'You got hacked :)'.
I can'...
0
votes
0
answers
36
views
How to read a file (exe) like bin text application in Malware Analysis by Python
How to read a file (exe) like bin text application in Malware Analysis but by Python
-3
votes
1
answer
41
views
How to remove unwanted program from startup [closed]
This just started to show up on my Windows10 machine. No browser is open. The down arrow includes a "feedback" option that goes to a .cn website. (I don't understand mandarin!) Right ...
0
votes
0
answers
23
views
Is there way to modify/redirect Garbage Collection behaviors in Monterey and save them to a folder?
I've been researching a new strain of MacOS malware for about a year and am trying to zero in on changes that are made to the OS as well as capturing files that the malware is self-deleting. I was ...
0
votes
1
answer
120
views
Does each language compile jump tables to custom locations, or are there specific places within ELF / PE headers for them to be?
I'm trying to figure out where jump tables (a data table pairing subroutine names with their addresses) are placed within an executable, and whether it's based on the language, the compiler, or if ...
0
votes
0
answers
45
views
Removing memory dumps from sandbox for analysis
So I'm trying to do some memory forensics on (potentially) malware infected docker containers. The containers run on a docker host in a sandbox.
What would be a safe way to move the memory dumps out ...
0
votes
0
answers
167
views
Weird code in .htaccess and cannot log in to wp-admin just keeps on redirecting
I can't sign in to the WordPress admin dashboard it just keeps redirecting back to the login page. I notice the .htaccess has a weird code in it,
<FilesMatch ".(py|exe|php)$">
Order ...
0
votes
2
answers
941
views
How to remove malware code from in index.php and htaccess File in WordPress website and run website smoothly
I have one WordPress woocommerce website. But website not running properly because of malware attack.I have logged in cpanel hosting and check htaccess and index.php. there are some unwanted code ...
0
votes
0
answers
12
views
Is the generation of symmetric keys in ransomware unique for each system at different times?
As we all know, new ransomware generates a unique key for each system, according to the specifications of that system (and then sends it to the attacker using asymmetric algorithms).
My question is, ...
0
votes
0
answers
19
views
Magento 2 Credit Card Phishing Attempts to PayTrace Gateway without being logged in Magento?
we are having some issues with CC phishing attempts on our Magento 2.3.4 PayTrace gateway.
No transactions are being logged in the Magento admin.
There is no traffic spike on the server.
No carts or ...
1
vote
0
answers
23
views
ransomware- why recreate file then delete instead of overwriting?
I've been researching a lot of well known ransomware variants and it seems most of them copy, encrypt, write to a new file then delete the original.
Is there any advantage to this in comparison to ...
1
vote
1
answer
593
views
.htaccess files are repeatedly being created in File Directory
I am having around 10 sites in a shared hosting. Recently I have noticed that there are so many .htaccess files have been created and restricting user access.
<FilesMatch ".(py|exe|phtml|php|...
0
votes
1
answer
841
views
How delete virus /tmp/.git/kthreaddw from ubuntu server
I have a ubuntu server which have some laravel project , couple of weeks I found one site crashed due to malware. Please help me remove malware from ubuntu server?