ttps_attack:T1055 × criticity:medium × limpar

Resultados

2 casos · pág. 1/1

trustedsec.com · há 1d medium

Multi-stage loader chains Kramer-obfuscated Python, Donut shellcode and laZzzy to deliver an embedded .NET DLL

TrustedSec analyzed a multi-stage malware loader that starts as obfuscated Python bytecode (.pyc, CPython 3.13) and ends in an encrypted .NET payload. The chain layers Kramer Python obfuscation, two Donut shellcode layers and a laZzzy shellcode-loader PE, so a signature for any single format misses the others. The author unpacked it with …

feeds.fortinet.com · há 1d medium

TrickBot variant uses DNS tunneling for C2 instead of HTTP, with ADS-stored config and in-memory modules

FortiGuard Labs analyzed a TrickBot variant that carries command-and-control (C2) traffic over DNS tunneling, embedding encoded data in DNS queries and responses, instead of the HTTP used by earlier variants. The malware persists through Windows Task Scheduler, stores its configuration in NTFS Alternate Data Streams, and hinders analysis …