reupen / console_panel Goto Github PK

Release v3.0.0 is flagged as malware by VirusTotal
MaxSecure Trojan.Malware.300983.susgen

https://www.virustotal.com/gui/url-analysis/u-976043f26acf1d30b7651b8336a24c1242e7338a6419469763973c6490294cc2-1686004820

title: Password Protected Compressed File Extraction Via 7Zip
id: b717b8fd-6467-4d7d-b3d3-27f9a463af77
status: experimental
description: Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files.
references:
    - https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023/03/10
tags:
    - attack.collection
    - attack.t1560.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Description|contains: '7-Zip'
        - Image|endswith:
            - '\7z.exe'
            - '\7zr.exe'
            - '\7za.exe'
        - OriginalFileName:
            - '7z.exe'
            - '7za.exe'
    selection_password:
        CommandLine|contains|all:
            - ' -p'
            - ' x '
            - ' -o'
    condition: all of selection_*
falsepositives:
    - Legitimate activity is expected since extracting files with a password can be common in some environement.
level: medium

DUI allows to save log to a file, but the option gets reset everytime foobar is restarted.
It would be great to have the possibility to write log files without having the option reset on every startup.

The rationale was that crash reports are already saved to other place (1), and logs could get bigger and bigger (2).... but (1) does not apply at all when there are tons of components writing other useful things to console (for example Spider Monkey Panel), (2) is not a real problem (since may programs have permanent logging to file...) and (2) could be solved by blanking log file on restart(*).

(*) Logs could then be moved\renamed with external scripts if required after closing foobar.

Apart from the obvious use-cases for everybody, I'm currently working on an updated online controller using the existing tools (foo http control and SMP). Logs are not exposed in any way, but the log file. So having the option to always save logs to a file allows to send the log to the server and read it on the controller point. Being able to read the logs at any place (and not only the Server PC) greatly expands its debugging capabilities and logging other info (for example many SMP scripts log useful info to console, and you could see the result of SMP scripts called by the controller on the log).

See attached the UI of where I'm referring: (not the same sunken appearance)

The relevant settings I have are here: