Threats Tagged 'downloader'

GuLoader, a malware downloader active since 2019, primarily delivers RATs and information stealers. It employs sophisticated anti-analysis techniques, including polymorphic code for dynamic constant construction and complex exception-based control flow obfuscation. The malware has evolved to handle multiple exception types, making tracing its execution flow challenging. GuLoader uses dynamic hashing, encrypted strings, and stack-based string encryption to conceal critical information. It often hosts payloads on trusted cloud services to bypass reputation-based detection. The malware's consistent development and updating of anti-analysis techniques suggest it will remain a significant threat in the future.

MediumMalwareGermanyUnited KingdomFrance+4#anti-analysis#cloudeye#guloader

Matanbuchus 3.0 is a sophisticated C++ malware downloader offered as Malware-as-a-Service since 2020, designed to deliver additional malicious payloads including ransomware and remote access trojans like Rhadamanthys and NetSupport RAT. It employs advanced obfuscation techniques such as junk code insertion, encrypted strings, and API hashing to evade detection. The malware features anti-analysis mechanisms including an expiration date and persistence via scheduled tasks. It communicates with its command and control servers using encrypted Protocol Buffers over HTTP(S), supporting a wide range of commands for payload execution, data collection, and system manipulation. While no known exploits are currently reported in the wild, its modular design and use in ransomware campaigns make it a medium-severity threat. European organizations are at risk due to the malware’s capability to facilitate ransomware attacks and backdoor access, potentially leading to data breaches and operational disruption. Mitigation requires targeted detection of its persistence mechanisms, network traffic analysis for encrypted C2 communications, and blocking associated domains and URLs. Countries with high technology adoption and ransomware targeting history, such as Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected.

MediumMalwareGermanyFranceItaly+4#netsupport rat#backdoor#ransomware

A malicious campaign is targeting users through fake YouTube video download sites, distributing Proxyware malware. The attack involves a downloader disguised as WinMemoryCleaner, which installs NodeJS and runs malicious JavaScript. This script then installs various Proxyware programs, including DigitalPulse, HoneyGain, and recently, Infatica. The malware uses Task Scheduler for persistence and sends system information to a C&C server. The Proxyware exploits the infected system's network bandwidth for the attacker's profit. Users in South Korea have been particularly targeted. To prevent infection, users should avoid installing executables from suspicious websites and use antivirus software.

MediumMalwareSouth KoreaGermanyUnited Kingdom+3#youtube#digitalpulse#task scheduler

A Malware-as-a-Service operation utilizing Amadey for payload delivery has been identified, with connections to a SmokeLoader phishing campaign targeting Ukrainian entities. The operation exploits fake GitHub accounts to host payloads and tools, bypassing web filtering. Emmenhtal, a multistage downloader, is used to download Amadey and other malware. The activity involves various malware families and GitHub repositories for staging custom payloads. Similarities in tactics and indicators between the SmokeLoader campaign and Amadey MaaS activity have been observed. The operation demonstrates adaptability in delivering diverse tooling, including legitimate software like PuTTY. The threat actors employ sophisticated obfuscation techniques and leverage public platforms for malware distribution.

MediumMalwareUkrainePolandGermany+5#github#downloader#redline

A malicious CHM file targeting Poland was discovered, containing an infection chain that drops and executes a C++ downloader. The CHM file displays a decoy image while executing obfuscated JavaScript to extract and run a DLL. The downloader retrieves a payload from a domain associated with previous Belarus-linked threat activities. The payload is encrypted and appended to an image file. The infection process involves multiple stages, including the use of LOLbins and the creation of a scheduled task for persistence. This campaign shows similarities to activities attributed to threat actors like FrostyNeighbor and UNC1151, known for targeting Eastern European countries.

MediumMalwarePolandLithuaniaLatvia+1#downloader#steganography#scheduled-task

A deceptive email containing a fake Zoom meeting invitation has been identified. Clicking the 'join' button leads to a website prompting users to install a purported Zoom client update. The downloaded executable, 'Session.ClientSetup.exe', is actually malware that installs an MSI package. This package deploys ScreenConnect, a remote access tool, allowing attackers to gain unauthorized access to the victim's computer. The malware establishes persistence by installing itself as a service and connects to a command and control server at tqtw21aa.anondns.net on port 8041. Users are advised to exercise caution when receiving unexpected Zoom invitations or update prompts.

MediumMalwareGermanyFranceNetherlands+7#zoom#screenconnect#remote access tool