Tuesday, December 18, 2018

latest samples of Gandcrab ransomware (hashes)

Malware researcher spotted the latest samples of GandCrab in the wild. Please refer samples hashes table:

File Hashes
07352c50cbd7b33d8f4f25003a22acb81b0c12d760a48381b7218e96883db3d0
afd19d99fe1bbdb6b3a39c44da944d221391aaebb03483c0835df39a27b258e0
2b31c924296ed03f0a56ec8a803676445dec44996105bd6a3a174cfb0ff5c37d
ec2be4772af2ba186647767c5709a9ab9571a8e2ddc6853d067cb10d234d7870
bb73eec7e3048710816c2b4c48cec74fb85ab2fdbaf4fd757c7442d1fdda4444
ec234db2717349685699d5c680c753ba137f3ded7443c2eb0a3be65668ba38af
13eae8d976a0887f4f3335ec1ccfa6fd927b0b102abfef9ed570019cf402b4e1
874b7e73d8609c3dc2e4c0cef9bd661f9fdddc1fbd8ba8a9e102f499d991301c
3b6b2e7182deba9fef91134a83dbf977e9e5cebb366d6461f6dd08004906a3de
3f1dde3ff8fcb869d150ed547b1af79fa6c6fddf0d2c4c4b5715523d6f7717fb
1a74af4d95f260bc93216d132196f6e820f55968daf771bb719aded893da7f0f
c2b86832fd2509b3183b8542ffb78dd70c5ab7c07ae136c6ff8f65a3ba1b28eb
3bd207423d0ac1c993dc7f0981bf6dc380ebaab1b8efbd04ccb924299c787c26
5d13c8592c209a74b1ac1614e7521b1a0389743eadfe4ed7a1e9933d6466ead4
54075a283edb5352b252563da3aa225b0e0c2fedbc3eefb832383369c3f83b2c
ac6492e5285fb59404d1a4363987126b75acc826db5035289179bc9af6ab0458
44b42617e9d51de205d1a25f7e2c99d85bfc1f60db7a7c249f324b0e4ca9be20
dc6cd1df1c93a06b09da60894ccfc88d48594c8fed7b6227075f2fe2e5b6f574
44066d3244099f4ca44581bbe7f23edc7acb60a88abc63c159c3013f8f3609a6
fdaf07c6a63635162cf53e340dabdd7904be889f657494b387cdbdd815945957
694ec395450aa42257c41cd5b90c5df36afa2a6ec2728143bfa15f91944301e4
43f63e9c58dc3391f9282352c8adabfbaae3840fd0689b985847b6e4f3a86e79
d2902a536a2406cb793e63071ce848229df5a988fe494361d8306fb5be6f71f4
b138371ffa789064c83e314ae63a762a73041779498dd586de5d3650b472e938
9c07c772d1aff143854285ed851f51b565b171448e1e90413721e2b94d407d29


Latest versions of Gandcrab


Post by

Monday, December 17, 2018

Quantum Physics:

Mathematics representation and the modification of the actions among heavy object and the sub-atomic particle. Classical mechanics also need a lot of mathematics representation to understand and back the theory. Though, classical mechanics are easier than quantum mechanics. This made classical physics easier to understand. Quantum physics demands more mathematics system to firm the theory. One must have strong mathematics knowledge to understand theoretical physics.
Quantum physics requires the following mathematics system:
  • Advanced probability theory
  • Complex number
  • Partial differentiation
  • Matrix algebraic



Quantum physics is very uncertain and completely different from the normal world. We can predict the orbit of the planet but can’t predict the subatomic particle. One of the famous principles, Heisenberg uncertainty principle says that if we predict the how fast it goes then we can’t predict where that thing is, but if predict where that thing is, we can’t find how fast it goes. Pretty confusing right (FYI, we didn’t write anything technically yet). You can predict and be sure where will the ball falls to and how the ball falls after being thrown. In the case of particles such as an electron, where will the electron locate after being “thrown”? This is a wrong question. No matter how many times the electron be “thrown” in the same magnitudes is it, the felt locations will be always different. As a result, physicist preferred to ask how much is the probability to find the electron at the location that we want. (Please refer to Young's double slit experiment). Yes, that is weird and difficult to understand. It is one of the strange behaviors of the particles. Quantum physics also showed very unexpected experiment results, it was totally different to the reality. To study quantum physics, step by step is the key. Please start working on the following topics:
  • Photoelectric effect
  • Wave-particle duality
  • Schrodinger's cat
  • Quantum entanglement
  • Superposition



Quantum physics is always an interesting topic and someday it reveals the mystery of the universe.



Related post:





Friday, December 14, 2018

Is really Einstein performed poorly in Mathematics?


To become a theoretical physicist, one must have strong knowledge in the field of mathematics. In other words, mathematics is a way of expressing physics to others. Many questioned us, is really Einstein good in mathematics? Is he really performed poorly in Mathematics during school times?

Our Answer is very simple: Look at the mathematical expressions in the relativity paper, especially field equations in general relativity, people will understand how strong Einstein in the field of mathematics.

Let's discuss this topic little elaborately:

Einstein, obviously, was splendid at math. At a youthful age, he stepped up with regards to contemplating propelled math with the help of his family. The sayings on Einstein was terrible at math is not a valid one.



Time Magazine quoted: 
"In 1935, a rabbi in Princeton showed him a clipping of the Ripley’s column with the headline “Greatest living mathematician failed in mathematics.” Einstein laughed. “I never failed in mathematics,” he replied, correctly. “Before I was fifteen I had mastered differential and integral calculus.” In primary school, he was at the top of his class and “far above the school requirements” in math. By age 12, his sister recalled, “he already had a predilection for solving complicated problems in applied arithmetic,” and he decided to see if he could jump ahead by learning geometry and algebra on his own. His parents bought him the textbooks in advance so that he could master them over summer vacation. Not only did he learn the proofs in the books, he also tackled the new theories by trying to prove them on his own. He even came up on his own with a way to prove the Pythagorean theory."



Related post:


Physics - arguably the greatest branch of science:


Physics is the characteristic science that reviews the matter and its movement and conduct through existence and that reviews the related elements of vitality and power. Physics is a standout amongst the most crucial logical orders, and its principle objective is to see how the universe carries on. Physics is one of the most established scholarly teaches and, through its consideration of cosmology, maybe the most established. In the course of the most recent two centuries, physics, science, science, and certain parts of arithmetic were a piece of regular reasoning, yet amid the logical unrest in the seventeenth century, these common sciences developed as extraordinary research attempts in their own right. Physics crosses with numerous interdisciplinary territories of research, for example, biophysics and quantum science, and the limits of physical science are not inflexibly characterized. New thoughts in physics frequently clarify the principal systems contemplated by different sciences and recommend new roads of research on scholastic trains, for example, arithmetic and rationality. Advances in physics frequently empower progresses in new advances. For instance, propels in the comprehension of electromagnetism and atomic physics drove specifically to the improvement of new items that have significantly changed current society, for example, TV, PCs, household apparatuses, and atomic weapons; progresses in thermodynamics prompted the improvement of industrialization; and advances in mechanics enlivened the improvement of math.



Physics amid medieval time

- Europe: 
The Western Roman Empire fell in the fifth century, and this brought about a decrease in scholarly interests in the western piece of Europe. On the other hand, the Eastern Roman Empire (otherwise called the Byzantine Empire) opposed the assaults from the brutes and kept on progressing different fields of getting the hang of, including physics. In the 6th century, Isidore of Miletus made an essential arrangement of Archimedes' works that are replicated in the Archimedes Palimpsest. In 6th century Europe John Philoponus, a Byzantine researcher, scrutinized Aristotle's instructing of physics and taking note of its blemishes. He presented the hypothesis of the driving force. Aristotle's physics was not investigated until John Philoponus showed up, and not at all like Aristotle who put together his physical science with respect to verbal contention, Philoponus depended on perception. John Philoponus' analysis of Aristotelian standards of physics filled in as a motivation for Galileo Galilei ten centuries later, amid the Scientific Revolution. Galileo refered to Philoponus generously in his works when contending that Aristotelian physics was imperfect. During the 1300s Jean Buridan, an instructor in the workforce of expressions at the University of Paris, built up the idea of force. It was a stage toward the cutting edge thoughts of latency and energy.

- Islamic locale: 
Islamic grant acquired Aristotelian physics from the Greeks and amid the Islamic Golden Age created it further, particularly putting accentuation on perception and from the earlier thinking, growing early types of the logical technique. The most remarkable advancements were in the field of optics and vision, which originated from crafted by numerous researchers like Ibn Sahl, Al-Kindi, Ibn al-Haytham, Al-Farisi and Avicenna. The most outstanding work was The Book of Optics (otherwise called Kitāb al-Manāẓir), composed by Ibn al-Haytham, in which he definitively refuted the antiquated Greek thought regarding vision, yet in addition, concocted another hypothesis. In the book, he introduced an investigation of the marvel of the camera obscura (his thousand-year-old variant of the pinhole camera) and dove further into the manner in which the eye itself works. Utilizing analyzations and the information of past researchers, he had the capacity to start to clarify how light enters the eye. He attested that the light beam is centered, however the real clarification of how light anticipated to the back of the eye needed to hold up until 1604. His Treatise on Light clarified the camera obscura, several years prior to the advanced improvement of photography. The seven-volume Book of Optics (Kitab al-Manathir) enormously impacted reasoning crosswise over orders from the hypothesis of visual recognition to the idea of the point of view in medieval workmanship, in both the East and the West, for over 600 years. Numerous later European researchers and individual polymaths, from Robert Grosseteste and Leonardo da Vinci to René Descartes, Johannes Kepler, and Isaac Newton, were in his obligation. Without a doubt, the impact of Ibn al-Haytham's Optics positions close by that of Newton's work of a similar title, distributed 700 years after the fact. The interpretation of The Book of Optics hugely affected Europe. From it, later European researchers had the ability to fabricate gadgets that imitated those Ibn al-Haytham had manufactured, and comprehend the way light works. From this, such critical things as eyeglasses, amplifying glasses, telescopes, and cameras were created.


In the upcoming post, we will cover the last 1000 years of physics.

Post by Physics Universe

Router:

A router is a systems administration gadget that advances information bundles between PC systems. routers play out the traffic coordinating capacities on the Internet. Information sent through the web, for example, a site page or email, is as information bundles. A parcel is commonly sent starting with one router then onto the next router through the systems that establish an internetwork until the point when it achieves its goal hub. A router is associated with at least two information lines from various systems. At the point when an information bundle comes in on one of the lines, the router peruses the system address data in the parcel to decide a definitive goal. At that point, utilizing data in its steering table or steering strategy, it guides the bundle to the following system on its voyage. The most well-known kind of routers is home and little office routers that essentially forward IP bundles between the home PCs and the Internet. A case of a router would be the proprietor's link or DSL router, which associates with the Internet through an Internet specialist organization (ISP). Increasingly advanced routers, for example, undertaking routers, interface vast business or ISP arranges up to the amazing center routers that forward information at rapid along the optical fiber lines of the Internet spine. Despite the fact that routers are ordinarily devoted equipment gadgets, programming based routers additionally exist.

The first ARPANET router (1969)


Uses of router

A router may have interfaces for various sorts of physical layer associations, for example, copper links, fiber optic, or remote transmission. It can likewise bolster distinctive system layer transmission models. Each system interface is utilized to empower information bundles to be sent starting with one transmission framework then onto the next. Routers may likewise be utilized to interface at least two coherent gatherings of PC gadgets known as subnets, each with an alternate system prefix. Routers may give availability inside endeavors, among ventures and the Internet, or between web access suppliers' (ISPs') systems. The biggest routers, (for example, the Cisco CRS-1 or Juniper PTX) interconnect the different ISPs or might be utilized in expansive undertaking systems. Littler routers more often than not give availability to a common home and office systems. All sizes of routers might be found inside endeavors. The most ground-breaking routers are normally found in ISPs, scholastic and research offices. Vast organizations may likewise require all the more ground-breaking routers to adapt to regularly expanding requests of intranet information traffic. A various leveled internetworking model for interconnecting routers in substantial systems is in like manner used.


Post by newWorld

Cyber attack on the Italian oil and gas administrations organization Saipem

Saipem has clients in excess of 60 nations, including Saudi Arabian oil and gas goliath Saudi Aramco. It could be viewed as a key focus for a wide scope of risk on-screen characters. The assault has been recognized out of India on Monday and principally influenced the servers in the Middle East, including Saudi Arabia, the United Arab Emirates, and Kuwait. Principle working focuses in Italy, France and Britain had not been influenced. The assault influenced just a predetermined number of servers in its foundation, Saipem said it is attempting to reestablish them utilizing reinforcements, a condition that could recommend that a ransomware hit the organization.




Saipem revealed to Reuters the assault started in Chennai, India, however the character of the aggressors is obscure. The Italian oil administrations organization Saipem was hit by a cyber assault, it affirmed the occasion however has shared a couple of insights regarding the assault. At the time it is difficult to property the assault, it isn't clear is the organization confronted a focused on assault or whenever was hit in a more extensive battle completed by risk on-screen characters. We can't reject that assailants hit the organization to focus on its colleagues as well, for instance, Saudi Aramco that endured Shamoon assaults in 2012 and 2016. Saipem told media it was announcing the episode to the capable experts.

Post by newWorld

Hashes of Latest Ransomware variants:

This list of hashes are added here for analysis purpose and also helpful for blocking them in host-based detection.
Image from Archive of old ransomware

List of Hashes (SHA256)

  • 3416bdb49c534fc05c4c2de19063c1227fbc4489edb0cabdef438f459cfeba24
  • 09fb9a9219fe4b0bfff15d7c55d4d4121178129226c9f986e88b195e84eb05b6
  • 9939416f4f376a7b5a5351ed9564d32125fcd118a44791617dfbb49584fa2a7e
  • 5a58d33e7a71d7b5b0d7ab71c44188eb51f70365ce2916be413d65d417f4d35a
  • d41d64ad1197769e6e1e085482d03e56bd08ee7407d79f3ace24dcfde49f2405
  • 45682aecd2486f0574dc9bd510ecea5c108418ebed66494214a144ce6221bc6f
  • 2ade62bef7c7e7097b8976331380d139115acb7b7244e4eb56032a1fa73b3208
  • 958259eae582be868d92261ef751abcbb829b53a92c3bf1f7f5e508c267fdad0
  • 7b6654c73c56b8fc8f7c0cb0b1de8d2ea0946aee9bfc7de9ff435f44430567ff
  • fbf71461103a9234c195bfdbab12cdb5f24e891658cb4932e54f58a350cba653
  • 5ff682c17c0df3c66e45ea96f6b4cf7f2f6fcad4ea60309f0a04308fbaa71004
  • e57e854feeb225ba7488ffa42dacd6ccbbd0dda9557be5182dc4d6bc9684d142
  • a52d07007b769bc71849a2f54a901c13e3d95ffb965b871c189de9e563c72fc4
  • e7420eab56b9ce407f38f30af393255c3a7e8c5b5b8a0b3d00baac9c1d102070
  • 2b0977cc2c30520b19f727b03eedb656973c83ec2d0263081b522ac03bec629b
  • dde2fbc02b70203a8214ed1713036f184ff878358997633cfb9637480289f5aa
  • 90d99c4fe7f81533fb02cf0f1ff296cc1b2d88ea5c4c8567142bb455f435ee5b
  • dd8f267654c63bd177362e6e0634f8ba718b284f414a70e4a1ef399d69e5e601
  • dc8f856e879796f8c1c46d087ec2cca1b94848b4095769c23b0c839edd529096
  • ac7e094fda0299255c7c833054dd0f75ea9a2a9211be0d8db90800c73f2e265d
  • c805920b3f0d64789d7aeb1ebc4ae8a0519d500bb6e8d39c84a3bee103189320
  • b0ac973c57292f75deff73b282bd6d2cb9fffe09513e2e9b5dd149658c2ad940
  • 490de12b04949e87b7fc42cd439955f053e847d8f6bd22fe1214e3d2a21b823c



Post by newWorld


Other interesting posts from newWorld team on ransomware:



Novidade EK (Exploit Kit) Targets routers

Security researchers at Trend Micro have found another EK, named Novidade ("oddity" in Portuguese), that is focusing on SOHO switches to trade off the gadgets associated with the system gear. The Novidade misuse unit uses cross-site ask for falsification (CSRF) to change the Domain Name System (DNS) settings of SOHO switches and divert traffic from the associated gadgets to the IP address under the control of the assailants. Since its first disclosure in August 2017, specialists watched three variations of the adventure pack, incorporating one engaged with the DNSChanger arrangement of an ongoing GhostDNS crusade. Right now, Novidade is utilized in various crusades, specialists trust it has been sold to different risk on-screen characters or its source code spilled.

A large portion of the battles found by the specialists influences phishing assaults to recover managing account qualifications in Brazil. Specialists likewise watched crusades with no explicit target geolocation, a situation that proposes assailants are growing their objective regions or a bigger number of danger performing artists are utilizing the endeavor unit.

Specialists say that the point of arrival performs HTTP asks for produced by JavaScript Image capacity to a predefined rundown of neighborhood IP tends to that are utilized by switches. When setting up an association, the Novidade toolbox questions the IP deliver to download an endeavor payload encoded in base64. The adventure pack aimlessly assaults the recognized IP address with every one of its endeavors. The noxious code likewise endeavors to sign into the switch with a lot of default qualifications and afterward executes a CSRF assault to change the DNS settings. Underneath the rundown of conceivable influenced switch models dependent on Trend Micro correlations of the malignant code, arrange traffic, and distributed POC code.

  • A-Link WL54AP3 / WL54AP2 (CVE-2008-6823)
  • D-Link DSL-2740R
  • D-Link DIR 905L
  • Medialink MWN-WAPR300 (CVE-2015-5996)
  • Motorola SBG6580
  • Realtron
  • Roteador GWR-120
  • Secutech RiS-11/RiS-22/RiS-33 (CVE-2018-10080)
  • TP-Link TL-WR340G / TL-WR340GD
  • TP-Link WR1043ND V1 (CVE-2013-2645)


For more analysis, please refer to the TrendMicro page: https://blog.trendmicro.com/trendlabs-security-intelligence/new-exploit-kit-novidade-found-targeting-home-and-soho-routers/

IOC table from Trend Micro:


Threat identification
Specifies
globo[.]jelastic[.]servint[.]net
Novidade exploit kit domain
landpagebrazil[.]whelastic[.[net
Novidade exploit kit domain
light[.]jelastic[.]servint[.]net
Novidade exploit kit domain
52[.]47[.]94[.]175
Novidade exploit kit IP address
pesquisaeleitoral2018[.]online
Social Engineering Domain
pesquisaparapresidente[.]online
Social Engineering Domain
108[.]174[.]198[.]177
Suspicious DNS server
144[.]217[.]24[.]233
Suspicious DNS server
172[.]245[.]14[.]114
Malicious DNS server
192[.]3[.]178[.]178
Malicious DNS server
192[.]3[.]190[.]114
Malicious DNS server
192[.]3[.]8[.]186
Malicious DNS server
198[.]23[.]140[.]10
Malicious DNS server
198[.]46[.]131[.]130
Malicious DNS server
23[.]94[.]149[.]242
Malicious DNS server
23[.]94[.]190[.]242
Malicious DNS server
23[.]95[.]82[.]42
Malicious DNS server


Post by

Thursday, December 13, 2018

French Foreign ministry reported its Travel Alert Registry Hack:

French ministry affirmed that malicious hackers ruptured into the Ariane framework, its movement ready library site, and individual information of residents "could be abused". The Ariane framework gives security cautions to enrolled clients when voyaging abroad. At the time there aren't specialized insights concerning the interruption or the quantity of influenced individuals. articulation did not show who may be behind the assault.


The service began telling the occurrence to the influenced clients, it additionally educated media to have taken fundamental measures to maintain a strategic distance from comparable episodes later on. The Ministry affirmed that the site was currently anchored.

What is Intraday Trading?

Purchasing and moving of stocks inside a similar exchanging day is known as intraday exchanging. Commonly, in such cases, the aim of the speculator isn't to contribute for the long haul dependent on the development prospects of an organization, yet making additions dependent on the unpredictability of offers on a specific day. Intraday exchanging should be possible through a demat account. Merchants or financial specialists need to specify while purchasing a specific offer whether she plans to contribute for intraday or conveyance (to hold the offers for over one day).
Intraday exchanging is clearly a utilized amusement. That implies your dealer will enable you to take an exchanging position that is numerous of your edge cash in the exchanging account. To that degree, it is progressively unsafe and requires an alternate arrangement of abilities and mental makeup contrasted with conveyance exchanging.


Some important tips for Intraday traders are starting to learn from their own mistakes, focus on risk factor, trade with a positive mindset, and set a realistic goal.


Post by
newWorld

Operating system - Part 1:

 In our blog, we published several articles on OS concepts which mostly on the perspective for malware analysis/security research. In few in...