Re:My application ran away and called home from Redmond
by inanutshellus on Monday October 07, 2019 @10:08AM
(#21180937)
Perhaps it's not running the EXE but instead identifying URLs in the code, cURLing them to see what it gets, and doing so to verify what they get isn't malware?
[ Parent
| on HN ]
Re:My application ran away and called home from Redmond
by oherrala on Monday October 07, 2019 @10:20AM
(#21181109)
The software in question (called Beacon) is designed to call home. The binary has built-in cryptographic keys and it sends traffic encrypted. The receiving end, called Home, receives these packets, decrypts it and verifies the sender and after that gives an alert.
The exe must have been running to be able to generate the proper encrypted payload and send it to right place. In this case ports 20 and 1025 over TCP.
Disclaimer: I am one of the people who wrote the software.
Re:My application ran away and called home from Redmond
by kemonocode on Monday October 07, 2019 @10:35AM
(#21181314)
String obfuscation is trivial to do so I have a feeling they're actually running the binaries in order to do anything. Just a feeling, though- I don't think the author of the post stuck around long enough to see if the remote instance behaved as it should.