Security Affairs

OCTOBER 18, 2022

.” reads the analysis published by Symantec. Spyder Loader loads AES-encrypted blobs to create the wlbsctrl.dll which acts as a next-stage loader that executes the content. Like the sample analyzed by Cyberreason, the Spyder Loader sample analyzed by Symantec uses the CryptoPP C++ library. ” continues the report.

File names 114

File names Encryption Manufacturing Libraries 114

Security Affairs

NOVEMBER 5, 2020

The name KilllSomeOne comes from the phrase ‘KilllSomeOne’ used in the DLL side-loading attacks, the group is using poorly-written English messages relating to political subjects. . Dynamic-link library (DLL) side-loading takes advantage of how Microsoft Windows applications handle DLL files.

File names 110

File names Encryption Libraries IT 110

Security Affairs

JULY 8, 2023

” reads the analysis published by Proofpoint. At the provided URL, a password-encrypted.rar file named “Abraham Accords & MENA.rar” was hosted. The.rar archive contained a dropper named “Abraham Accords & MENA.pdf.lnk.” ” continues the analysis.

Archiving 97

Archiving Cloud File names Metadata 97

Security Affairs

APRIL 14, 2020

” reads the analysis published by PaloAlto Networks. “The emails all contained a malicious Rich Text Format (RTF) phishing lure with the file name 20200323- sitrep -63- covid -19. ” continues the analysis. ” continues the analysis. ” continues the analysis.

Ransomware 122

Ransomware Phishing File names Encryption 122

Security Affairs

FEBRUARY 19, 2019

Technical analysis. The phishing email contains a.zip file named “slavneft.zakaz.zip”, which means something like “slavneft order” in English, showing a direct reference to “Slavneft”. It contains a russian speaking JavaScript file named “«??? «??? «?????????» ??????????? Content of README.txt file.

Ransomware 76

Ransomware Mining File names Encryption 76

Security Affairs

SEPTEMBER 4, 2019

Despite the name could remind to JavaScript language and a possible “worm” logic, the malware does not include either of the two characteristics. Technical Analysis. JSWorm encrypts all the user files appending a new extension to their name. The HTA file corresponds to the ransom window shown in Figure 1.

Ransomware 84

Ransomware Encryption File names Libraries 84

Security Affairs

SEPTEMBER 12, 2019

This operation is similar to the threat group’s August 2018 campaign , using compromised university resources to send library-themed phishing emails.” ” reads the analysis published by Secureworks. The landing page appears to be identical or quite similar to the spoofed library resource. and Switzerland.

Phishing 81

Phishing Libraries File names Metadata 81