neko_koneko

FAR Manager is really great, you should give it a try: https://www.farmanager.com/screenshots.php?l=en

By the way, is there a list of things that Windows collects about computer/user activity?

Yep. Malware is constantly repacked/encrypted. It is impractical/impossible to write static unpacking engines for every type of malware packing technique, so behavioral analysis engine is a must (btw, behavioral engines still detect malware using signatures).

Malware authors often incorporate legitimate software into their malware - e.g. Nir Sofer's Mail PassView and Web PassView are used in Emotet spam bot to harvest user credentials. Usually such files are marked as "Potentially unsafe software" by analysts, or in some cases could be detected as part of a malware family by AV companies' automated detection tools.

When I was in similar situation (bought an old SGI O2 box and didn’t had any other SGI machines to plug HDD into to get /etc/passwd), I used telnet RCE/privilege escalation exploit: https://www.exploit-db.com/exploits/20149/, worked like a charm. These old systems have many vulnerable services running by default, including telnet.

Sorry, my bad. I meant files in OOXML format.

.docx files could contain macros just fine.

What do you mean, exactly? All I want so say that while targeted attacks are the most difficult to defend against (well, by definition), it is the medium-sophistication-level attacks that cause the most damage (in my experience), just because of their volume. It's not some state-of-the-art APT malware, it's bundles of RATs + generic backdoors/keyloggers packed in SFX archives, that are usually quickly detected by most AVs (provided that AV bases are regularly updated).

Well, I agree that AV most likely wouldn't protect you against targeted attacks - but most of the attacks that we investigated were targeted quite broadly - phishing email campaigns targeting financial organizations (with address lists based on some hacked legitimate resources for accountants, for example). And usually these attack succeeded because of insecure infrastructure, poorly trained admins, old, non-updating systems (some people still think using Windows XP on internet-connected computers is fine), and lack of AV software.

There are many criminal groups that develop malware - it's a multi-million dollar business.

Ok, disclaimer first: I've previously worked at Kaspersky Lab (incident response division). Now, I want to say that many of the incidents that we have investigated, would have been prevented by anti-virus software (in many cases AV software was deliberately disabled by user). And I'm talking about incidents that resulted in million-dollar thefts - not just cases of some user getting cryptolocker on their home computer. I agree that AV software is bloated and has very large, messy and barely maintainable codebase, but I disagree with people who say that "I have never used any AV products and in 10 years have never been infected with malware" - this attitude is careless, to say the least, and in corporate environment could lead to huge financial losses. There are many criminal groups that put serious effort in the development and distribution of malware - not just script kiddies, but professional programmers and hackers.

BTW, there are also region-specific malware - so for example I would rely more on Kaspersky for detection of malware targeted at Russian businesses, than Symantec or Microsoft AVs.

> It looks like it's pretty easy to create a spaghetti-code mess

Can confirm. I currently work as a malware analyst, and I frequently have to analyze (somewhat) obfuscated malware NSIS installers.

Older version of the 7-zip software (v. 9.38) can extract and decompile NSIS installers, but in the newer versions this feature is no longer available, because some people on the 7-zip forums complained that users could unpack their installers and see hidden S/Ns. It's a pity.