<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,
<div><br>
</div>
<div>I hope everyone is doing well!</div>
<div><br>
</div>
<div>Below is the entry for today.</div>
<div><br>
</div>
<div>09/17/2021 - Diary entry #350:</div>
<div><br>
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div>
<p></p>
<div class="wiki">
<p>Researchers recently identified malicious samples that target Windows, but are compiled for Linux. These files are executed through the WSL environment in the Windows OS. Most are written in Python 3 - either pure Python or using ctypes - and also in PowerShell.
They act as loaders, running embedded or downloaded payloads injected into a running process, using Windows API calls.</p>
<p><br>
</p>
<p>WSL is a compatibility layer for running Linux binary executables (in ELF format) natively on Windows 10 and 11, allowing for functionality such as command-line tools from Linux. However, WSL is not available to all Windows 10 users by default. It needs
to be installed manually or by joining the Windows Insider program.</p>
<p><br>
</p>
<p>The samples were spotted in the wild since May 2021, and we believe that they are under active development. The payloads executed by these loaders contain threats generated by open-source tools like Meterpreter and MSFVenom, or shellcodes downloaded through
C2 servers. While these threats are not complex, new attack vectors are always dangerous because they evade most anti-malware engines.</p>
</div>
<p></p>
</div>
</blockquote>
<div><br>
</div>
Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:felipe.tarijon@appgate.com" title="mailto:felipe.tarijon@appgate.com">
felipe.tarijon@appgate.com</a></span><br>
O:<span> </span><span style="margin:0px; background-color:white">+55 11 97467 9549</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>