by Jaromir Horejsi, Joseph C. Chen, and Loseway Lu – We noticed a series of testing submissions in VirusTotal that apparently came from the same group of malware developers in Moldova, at least based on the filenames and the submissions’ source.
It appears they are working on a new malware that — based on how they were coded — is most likely intended to spread through spam emails embedded with malicious attachments. Trend Micro detects this malware as JS_DLOADR and W2KM_DLOADR.
The downloader malware’s payloads (TROJ_SPYSIVIT.A and JAVA_ SPYSIVIT.A) are what make it notable. It delivers a version of the Revisit remote administration tool, which is used to hijack the infected system. More importantly, it also delivers a malicious extension that could serve as a backdoor, stealing information keyed in on browsers.
Abusing legitimate remote access tools (and stealing its configurations) is not new…
Lese weiter auf: Malicious Edge and Chrome Extension Used to Deliver Backdoor
Quelle: TrendLabs Malware Blog
Kommentare und FragenMöchtest Du zu diesem Artikel ein Kommentar abgeben oder hast dazu eine Frage, dann mach dies bitte immer auf der Herausgeberseite!
Aktuelles von TrendLabs Malware Blog
- VPNFilter-affected Devices Still Riddled with 19 Vulnerabilities
- July Patch Tuesday: Large Adobe Security Update and Patches for 18 Critical Microsoft Vulnerabilities
- Malicious Macro Hijacks Desktop Shortcuts to Deliver Backdoor
- Down but Not Out: A Look Into Recent Exploit Kit Activities
- The New Face of Necurs: Noteworthy Changes to Necurs’ Behaviors
- Cryptocurrency-Mining Bot Targets Devices With Running SSH Service via Potential Scam Site
- Necurs Poses a New Challenge Using Internet Query File
- Drupal Vulnerability (CVE-2018-7602) Exploited to Deliver Monero-Mining Malware
- FakeSpy Android Information-Stealing Malware Targets Japanese and Korean-Speaking Users
- North American Malware Trends: Taking a Proactive Approach to Modern Threats
Diese Information erscheint unabhängig vom Artikel!