One nice thing about having lots of traffic flowing through WebPulse, and having lots of modules watching for malicious and suspicious activity, is that it's always easy to find an interesting topic for the blog. (The tricky part is finding time to follow a lead, do the background research, and write the blog post. I […]
During the last couple of weeks I’ve come across three malware samples packed using compiled AutoIt scripts, so I decided to explore the connection between AutoIt and the malware world. I took the latest 50 samples marked as AutoIt that were submitted to the free scanning site VirusTotal.Here are the statistics: 11 wrongly classified as malware. Four […]
Did you ever had to identify a Cisco IOS image when you couldn’t rely on the filename?Look for strings starting with CW_ between strings CW_BEGIN and CW_END in the image file, for example like this:You will find strings like CW_IMAGE, CW_FAMILY, CW_FEATURE, CW_VERSION, CW_MEDIA, CW_SYSDESCR and CW_MAGIC between strings CW_BEGIN and CW_END.In this example, the […]
Latest Comments