Mastodon

LukasHab heute spannenderweise einen <a href="https://chaos.social/tags/Virus" class="mention hashtag" rel="nofollow noopener" target="_blank">#Virus</a> in einer <a href="https://chaos.social/tags/Mail" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mail</a> bekommen, der im ACE-Format gepackt wurde.Wer kann denn heutzutage noch ACE entpacken? Hat man drauf spekuliert, dass der bei den Virenscannern vorbei rutscht, weil sie das Archiv nicht öffnen können?Ich verschicke demnächst meine Dateien im <a href="https://chaos.social/tags/ARJ" class="mention hashtag" rel="nofollow noopener" target="_blank">#ARJ</a>-Format, mal sehen, wie viele Virenscanner das noch können.<a href="https://chaos.social/tags/Snakeoil" class="mention hashtag" rel="nofollow noopener" target="_blank">#Snakeoil</a>

El Club De Los Físicos Muertos<a href="https://mastodon.social/tags/ARJ" class="mention hashtag" rel="tag">#ARJ</a> was a utility program for <a href="https://mastodon.social/tags/MSDOS" class="mention hashtag" rel="tag">#MSDOS</a> that enjoyed great popularity in the early 90s when there was no <a href="https://mastodon.social/tags/Internet" class="mention hashtag" rel="tag">#Internet</a> and files were distributed to users vía Bulletin Board Systems BBS were accessed by computers with modems and direct phone calls ARJ allowed many files to be packaged and the size reduced.

Tonton FredARJ, l'archiveur vedette des années 1990.<a href="https://peertube.pcservice46.fr/videos/watch/56e1c029-1042-488e-839c-e34b19de3294" rel="nofollow noopener" translate="no" target="_blank">https://peertube.pcservice46.fr/videos/watch/56e1c029-1042-488e-839c-e34b19de3294</a>

SECUINFRA Falcon TeamToday in our section on "uncoventional <a href="https://infosec.exchange/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a> delivery": <a href="https://infosec.exchange/tags/ARJ" class="mention hashtag" rel="nofollow noopener" target="_blank">#ARJ</a> archives! 📦 ARJ (Archived by Robert Jung) has been around since the MS-DOS days and is occasionally used to deliver e.g. <a href="https://infosec.exchange/tags/AgentTesla" class="mention hashtag" rel="nofollow noopener" target="_blank">#AgentTesla</a>, <a href="https://infosec.exchange/tags/Formbook" class="mention hashtag" rel="nofollow noopener" target="_blank">#Formbook</a> or <a href="https://infosec.exchange/tags/Guloader" class="mention hashtag" rel="nofollow noopener" target="_blank">#Guloader</a> You can recognize ARJ archives by their Magic: 60 EA Extraction can be handled with 7zip for example. For more information on the file format check out Ange Albertini's excellent graphic representation: <a href="https://twitter.com/angealbertini/status/1619006171360395264" rel="nofollow noopener" target="_blank">https://twitter.com/angealbertini/status/1619006171360395264</a>As an example we dug up a <a href="https://infosec.exchange/tags/Lokibot" class="mention hashtag" rel="nofollow noopener" target="_blank">#Lokibot</a> sample from last year where the delivery chain looked like this: ARJ --> RAR --> EXE To fool the victims into opening the next file they used the common <a href="https://infosec.exchange/tags/doubleExtension" class="mention hashtag" rel="nofollow noopener" target="_blank">#doubleExtension</a> tick, e.g. .pdf.exeIoC for those playing along at home: 162.0.223[.]13 kbfvzoboss[.]bid alphastand[.]trade alphastand[.]win alphastand[.]top ➡️/alien/fre.phpPO_Payment for invoice[...].eml.arj d0c8824d1e19ca1af0b88a477fa4cad6SHIPPING_DL-PL-EXPRESS_EXPORT.PDF.exe 88bdf4f8fe035276da984c370e4cda2c<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#blueteam</a>

Gregory P. Smith (he/him) :python: 🚲🦝 :donor:This is just a modern <a href="https://infosec.exchange/tags/BBS" class="mention hashtag" rel="nofollow noopener" target="_blank">#BBS</a>. But thankfully with infinite modems and, being 30 years on, I don't need to download <a href="https://infosec.exchange/tags/ARJ" class="mention hashtag" rel="nofollow noopener" target="_blank">#ARJ</a> and a <a href="https://infosec.exchange/tags/DOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#DOS</a> <a href="https://infosec.exchange/tags/JPEG" class="mention hashtag" rel="nofollow noopener" target="_blank">#JPEG</a> decoder for <a href="https://infosec.exchange/tags/caturday" class="mention hashtag" rel="nofollow noopener" target="_blank">#caturday</a>! 😺(and I'm no longer reading Dr. Dobbs Journal and BYTE to hear about Unicode and wondering how that'll ever fit in memory and if the 16-bits that Microsoft is bravely choosing for some mysterious Windows <a href="https://infosec.exchange/tags/NT" class="mention hashtag" rel="nofollow noopener" target="_blank">#NT</a> toy is really enough anyways) _(narrator: it wasn't enough)_

ITSEC NewsCustom dropper hide and seek - Executive summaryMost users assume they are safe when surfing the web on a daily basis. But informat... more: <a href="http://feedproxy.google.com/~r/feedburner/Talos/~3/PUK1ri82T6Q/custom-dropper-hide-and-seek.html" rel="nofollow noopener" target="_blank">http://feedproxy.google.com/~r/feedburner/Talos/~3/PUK1ri82T6Q/custom-dropper-hide-and-seek.html</a> <a href="https://schleuss.online/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#malwareanalysis</a> <a href="https://schleuss.online/tags/agenttesla" class="mention hashtag" rel="nofollow noopener" target="_blank">#agenttesla</a> <a href="https://schleuss.online/tags/dropper" class="mention hashtag" rel="nofollow noopener" target="_blank">#dropper</a> <a href="https://schleuss.online/tags/lokibot" class="mention hashtag" rel="nofollow noopener" target="_blank">#lokibot</a> <a href="https://schleuss.online/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://schleuss.online/tags/autoit" class="mention hashtag" rel="nofollow noopener" target="_blank">#autoit</a> <a href="https://schleuss.online/tags/arj" class="mention hashtag" rel="nofollow noopener" target="_blank">#arj</a> <a href="https://schleuss.online/tags/rc4" class="mention hashtag" rel="nofollow noopener" target="_blank">#rc4</a>

Recent searches

Search options

Administered by:

Server stats:

#arj