6 casos · pág. 1/1
FortiGuard Labs analyzed a Casbaneiro banking trojan campaign targeting users in Latin America. The campaign applies access restrictions at several stages to keep the malware away from analysis tools: the download page, the HTA downloader and Casbaneiro itself. Casbaneiro sends different types of stolen data to separate servers and uses a…
FortiGuard Labs analyzed a SectopRAT variant that is embedded in legitimate software to evade detection. The malware uses a multi-stage loader to extract its payload from files, then applies API hashing, indirect function calls and in-memory loading to run the final .NET payload. Once running, it sets up encrypted communication with its C…
FortiGuard Labs describes a large-scale, global campaign that uses heavily obfuscated JScript droppers to launch an AutoIt/Lua-based loader with low detection rates. The loader delivers several popular RATs and infostealers, including a version of Snake Keylogger. The infection chain relies on business email compromise tactics, impersonat…
FortiGuard Labs analyzed a TrickBot variant that carries command-and-control (C2) traffic over DNS tunneling, embedding encoded data in DNS queries and responses, instead of the HTTP used by earlier variants. The malware persists through Windows Task Scheduler, stores its configuration in NTFS Alternate Data Streams, and hinders analysis …
FortiGuard Labs describes Evooo1Bot, a Linux botnet that embeds the Mirai DDoS engine in a more modular and capable framework. It uses encrypted C2 communications, layered string obfuscation (AES-256-CTR, ChaCha20, XOR-based key derivation) and a 28-command remote administration interface. It also ships an integrated exploit arsenal again…
FortiGuard Labs describes ClingSTUN, a Linux back-connect proxy backdoor that keeps persistent access and turns compromised devices into remotely controlled proxy nodes. It combines persistence, process termination, watchdog manipulation and remote command execution. It also uses legitimate public STUN servers for NAT traversal, to discov…
