myonlinesecurity.co.ukPublished
More AgentTesla Keylogger And Nanocore RAT In One Bundle
By Darrel Heers
Excerpt
We are seeing a continuation of even more AgentTesla malspam campaigns again this morning. However today’s is somewhat different to usual and also delivers a Nanocore RAT. Actually the Nanocore RAT is downloading the AgentTesla keylogger. And after a bit of digging around and seeing an Open Directory listing on the AgentTesla download site we found another multi-stage JavaScript downloader which delivers what looks like Dunhini /Houdini /h-worm and WSHRAT along with more Nanocore or at least using the same C2 and download structures as recent nanocore samples.
Once again the scumbags sending these are using ISO attachments, which generally speaking are…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by myonlinesecurity.co.uk on myonlinesecurity.co.uk.
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun