Resultados

2 casos · pág. 1/1

thehackernews.com · há 1d medium

ROMULUS ClickFix delivery platform used to distribute Legion Loader and trojanized MSI payloads

Forescout Research - Vedere Labs disclosed ROMULUS, a ClickFix delivery platform that uses bogus landing pages with ClickFix-style lures to trick users into running malicious commands that infect their own machines. It is used to distribute malware such as Legion Loader (also tracked as Satacom downloader, CurlyGate and RobotDropper). For…

trustedsec.com · há 1d medium

Multi-stage loader chains Kramer-obfuscated Python, Donut shellcode and laZzzy to deliver an embedded .NET DLL

TrustedSec analyzed a multi-stage malware loader that starts as obfuscated Python bytecode (.pyc, CPython 3.13) and ends in an encrypted .NET payload. The chain layers Kramer Python obfuscation, two Donut shellcode layers and a laZzzy shellcode-loader PE, so a signature for any single format misses the others. The author unpacked it with …