article thumbnail

Malware researcher reverse engineered a threat that went undetected for at least 2 years

Security Affairs

In this stage the JavaScript is loading an encrypted content from the original JAR, using a KEY decrypts such a content and finally loads it (Dynamic Class Loader) on memory in order to fire it up as a new Java code. The following image represents a simple ‘cat’ command on the just dropped files.

article thumbnail

Hacking The Hacker. Stopping a big botnet targeting USA, Canada and Italy

Security Affairs

My entire “Cyber adventure” began with a simple email within a.ZIP file named “Nuovo Documento1.zip” Stage1 was dropping and executing a brand new PE file named: rEOuvWkRP.exe (sha256: 92f59c431fbf79bf23cff65d0c4787d0b9e223493edc51a4bbd3c88a5b30b05c) using the bitsadmin.exe native Microsoft program.