Blaze's Security Blog

Today's post is a brief one on some Microsoft Word and sandbox detection / discovery / fun.
Collect user name from Microsoft Office
Most sandboxes will trigger somehow or something if a tool or malware tries to collect system information or user information. But what if we collect the user name via the registry and more specifically, what user info Microsoft Office sees?...

 <img alt="" height="697" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAo8AAAMSCAYAAAALHy5SAAAgAElEQVR4Xux9B4BU1fX+N3V7pXcEAQUssaGgxoo9scQeu2LDlthi7xqjYhSNGk00aoq9JFGwoaKCvaMgSJW+fXd2+v879747c+fNm93B8k/Mj2cIy+yb9+49t333O9851+cfskMavPx+v/wFn...

Introduction
Earlier this week, I ran into a sample that turned out to be PureCrypter, a loader and obfuscator for all different kinds of malware such as Agent Tesla and RedLine.
Upon further investigation, I developed Yara rules for the various stages, which can be found here (excluding the final payload):...

FARA, or Faux YARA, is a simple repository that contains a set of purposefully erroneous Yara rules. It is meant as a training vehicle for new security analysts, those that are new to Yara and even Yara veterans that want to keep their rule writing ...