Lately, we have seen a good number of samples generating some interesting network traffic through our automated framework. The HTTP network pattern generated contains a few interesting parameters, names like “&av” (for antivirus?) and “&vm=”(VMware?), The response received looked to be encrypted, which drew my attention. Also, all the network traffic contained the same host […]
Introduction Orbit Downloader by Innoshock is a popular file downloading add-on for web browsers, used not only to speed up the transfer of files over the Internet but also for its ability to download embedded videos from popular streaming video sites like YouTube. Figure 1 – Orbit Downloader Orbit Downloader has been around since at […]
Spoofing – whether in the form of DNS, legitimate email notification, IP, address bar – is a common part of Web threats. We’ve seen its several incarnations in the past, but we recently found a technique known as header spoofing, which puts a different spin on evading detection.Header spoofing is when a URL appears to […]
Latest Comments