article thumbnail

Hackers hijacked the eScan Antivirus update mechanism in malware campaign

Security Affairs

Puppeteer orchestrates the core functionality of the malware, including the cryptocurrency mining as well as the backdoor deployment. This loader is a simple PE that decompresses another shellcode using Gzip and executes it in a separate thread that kiads the Stage 3 malware Puppeteer.

Cleanup 102
article thumbnail

Researchers uncovered a new Malware Builder dubbed APOMacroSploit

Security Affairs

In order to avoid detection, the BAT scripts add the malware location in the exclusion path of Windows Defender and disabling Windows cleanup before executing the malware. BitRAT implements multiple features, including mining cryptocurrencies and RAT features.

Cleanup 114