Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1054477" data-attributes="member: 96560">[USER=62850]@danb[/USER] Hi I recently had an encounter with some custom / obfuscated malware. I was doing a Windows Update, Cyber Locked detected it, it said it was almost safe (around 70%) but I blocked it. Apparently it must have re-tried downloading while I was looking at the CL dialog, because it was installed. ( I remembered the package name and went looking for it in Data Store \ Repositories&nbsp; ) The thing was signed by a RealTek cert. So anyways I uploaded it to VirusTotal. It said no AV vendor detected it, but upon clicking on the Behavior tab, it revealed Log Key Strokes and Anti-VM . That is enough to prove to me that it was malicious. I had long known that my red team is capable of inserting stuff into Windows Update. Perhaps the capability is due to their presence in my LAN using a Bell modem exploit. Anyways, I just want to notify you that the malware successfully downloaded and installed while I was pondering over one CL dialog. Perhaps some multi-threading is needed.</blockquote>

[QUOTE="Victor M, post: 1054477, member: 96560"] [USER=62850]@danb[/USER] Hi I recently had an encounter with some custom / obfuscated malware. I was doing a Windows Update, Cyber Locked detected it, it said it was almost safe (around 70%) but I blocked it. Apparently it must have re-tried downloading while I was looking at the CL dialog, because it was installed. ( I remembered the package name and went looking for it in Data Store \ Repositories ) The thing was signed by a RealTek cert. So anyways I uploaded it to VirusTotal. It said no AV vendor detected it, but upon clicking on the Behavior tab, it revealed Log Key Strokes and Anti-VM . That is enough to prove to me that it was malicious. I had long known that my red team is capable of inserting stuff into Windows Update. Perhaps the capability is due to their presence in my LAN using a Bell modem exploit. Anyways, I just want to notify you that the malware successfully downloaded and installed while I was pondering over one CL dialog. Perhaps some multi-threading is needed. [/QUOTE]

Verification