Remove Encryption Remove File names Remove How To Remove Libraries
article thumbnail

[SI-LAB] FlawedAmmyy Leveraging Undetected XLM Macros as an Infection Vehicle

Security Affairs

File name: patent-2019-02-20T093A283A05-1.xls However, as already mentioned at the beginning of the technical analysis, SI-LAB team obtained two types of files, namely xls and doc archives. File name : 68131_46_20190219.doc Analyzing the MSI file – The installer/dropper of infamous FlawedAmmyy.

article thumbnail

Guarding Against Solorigate TTPs

eSecurity Planet

” In December, eSecurity Planet detailed FireEye’s initial findings , implications for the industry, and how to mitigate similar attacks. Presenting itself as a JPG file named “gracious_truth.jpg,” Teardrop is a memory-only dropper built to enter a network seamlessly and replace the embedded payload.