"Revenge of The Script Kiddies: Current Day Uses..."
summary
Three active bankers show concrete techniques: Gozi/ISFB stops writing executables and writes a PowerShell script into the registry then runs it via a regex-based run‑key and forfiles searching for PowerShell to execute encoded commands; Ramnit encrypts payloads per system with DPAPI, decrypts payload per-machine with DPAPI and launches them via a VBScript that calls PowerShell and reflective injection (AMSI hooks bypassed), enabling 100,000 infections in two months; BackSwap uses JSE droppers -> ~30k‑line scripts that download binaries from C2 (decoded with SCR_deck).
AI-written summary · about
chapters (21)
- 0:00Intro
- 3:12The Goal - Money • In-Session
- 4:18Financial Malware - Flow
- 5:34Control over the Browser
- 7:27Web Injections
- 11:18Infection Attempts
- 13:07Infection Script - Fool Ursnif
- 14:18Fileless Executable
- 15:19Raw Powershell
- 20:23Running The Script
- 21:42Windows DPAPI Data Protection API
- 24:52Ramnit - Background
- 27:10Ramnit's Folder
- 29:26The Smoking Gun
- 30:01Ramnit vs. Github
- 31:26Decrypted & Deobfuscated
- 32:25Architecture
- 34:23BackSwap is COOL
- 35:46Once Upon a Time
- 38:20Escape the unescape
- 39:14Wrapping Up
related talks
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
52mRansomware 101: Get Smart Understanding Real Attacks
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
42mStart Covering Your Bases And Stop Chasing APT Headlines
46mAttacks, Lies and the Underground World
01h 40mDefending against PowerShell attacks - in theory, and in practice
52mStart covering your bases & Stop chasing APT headlines