Threats Tagged 'python side-loading'

This threat involves a malicious email campaign that delivers a ZIP file hosted on MediaFire. The infection chain starts with a Python setup executable (Setu.exe) that side-loads a large malicious python37.dll containing repeated byte padding. The DLL performs process injection into dllhost.exe and communicates with a command-and-control server. The attacker establishes persistence using three methods: a PowerShell-based path, a fake EdgeUpdate Python executable with a scheduled task, and NetSupport RMM as a remote access tool. The analysis emphasizes the importance of comparing file timestamps during triage to detect malicious files within compressed archives.