Threats Tagged 'obfuscation techniques'

A TrickBot malware variant has been identified that uses DNS tunneling for command-and-control (C2) communications, bypassing traditional HTTP channels. It persists on infected Windows systems by creating disguised scheduled tasks that run at startup and every five minutes. Configuration data is hidden in NTFS Alternate Data Streams to evade detection. The malware uses multiple obfuscation methods, including encrypted strings and runtime API resolution, and supports a modular architecture with twelve control commands enabling advanced capabilities such as module downloads, process injection via hollowing and doppelgänging, PowerShell execution, and raw machine code execution. Data transfer occurs through crafted DNS queries to public DNS servers, encoding commands in malformed domain names and receiving responses in multiple IPv4 addresses, achieving transfer speeds of about 30.7 KB/s.

An active Lampion malware campaign has been identified targeting Portuguese users through phishing emails that impersonate financial and administrative communications. Lampion, a Brazilian banking malware derived from the ChePro lineage, delivers initial payloads via ZIP archives containing heavily obfuscated HTML files designed to evade detection. The HTML stage retrieves additional scripts from attacker-controlled infrastructure, initiating a multistage VBS infection chain. Each stage employs extensive obfuscation techniques including junk code, encrypted strings, and dynamically generated scripts that inflate file sizes while concealing core functionality. The infection chain is deliberately fragmented across multiple independent execution stages, complicating behavioral analysis. Telemetry shows 94.6% of detections concentrated in Portugal, confirming this is a highly targeted threat focused on Portuguese-speaking victims.

MediumMalwarePortugal#phishing campaign#banking trojan#vbs infection chain