by Jaromir Horejsi, Joseph C. Chen, and Loseway Lu – We noticed a series of testing submissions in VirusTotal that apparently came from the same group of malware developers in Moldova, at least based on the filenames and the submissions’ source.
It appears they are working on a new malware that — based on how they were coded — is most likely intended to spread through spam emails embedded with malicious attachments. Trend Micro detects this malware as JS_DLOADR and W2KM_DLOADR.
The downloader malware’s payloads (TROJ_SPYSIVIT.A and JAVA_ SPYSIVIT.A) are what make it notable. It delivers a version of the Revisit remote administration tool, which is used to hijack the infected system. More importantly, it also delivers a malicious extension that could serve as a backdoor, stealing information keyed in on browsers.
Abusing legitimate remote access tools (and stealing its configurations) is not new…
Lese weiter auf: Malicious Edge and Chrome Extension Used to Deliver Backdoor
Quelle: TrendLabs Malware Blog
Kommentare und FragenMöchtest Du zu diesem Artikel ein Kommentar abgeben oder hast dazu eine Frage, dann mach dies bitte immer auf der Herausgeberseite!
Aktuelles von TrendLabs Malware Blog
- Exploring Emotet: Examining Emotet’s Activities, Infrastructure
- November Patch Tuesday Fixes Another Zero-Day Win32k Bug, Other Public Vulnerabilities
- Using Machine Learning to Cluster Malicious Network Flows From Gh0st RAT Variants
- Hide and Script: Inserted Malicious URLs within Office Documents’ Embedded Videos
- Cryptocurrency-Mining Malware uses Various Evasion Techniques, Including Windows Installer, as Part of its Routine
- Fake Banking App Found on Google Play Used in SMiShing Scheme
- Trickbot Shows Off New Trick: Password Grabber Module
- Perl-Based Shellbot Looks to Target Organizations via C&C
- Gathering Insights on the Reemergence and Evolution of Old Threats Through Managed Detection and Response
- Disrupting the Flow: Exposed and Vulnerable Water and Energy Infrastructures
Diese Information erscheint unabhängig vom Artikel!