malwareinfo.appPublished
Fake GlobalProtect MSI Targets Myanmar Using Cloudflare and Google Sheets as C2
By Malware INFO Research Team
Excerpt
Executive summary
An organization received an email containing a link to a Google Sites landing page that presented a download as Palo Alto Networks GlobalProtect. To protect the organization and its personnel, this article does not reproduce the email, identify the recipient, or publish the landing page. Our analysis begins with the downloaded Windows Installer package.
The supplied GlobalProtect.msi was unsigned and contained an unsigned 64-bit executable named GlobalProtect.exe .
Static analysis exposed…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by malwareinfo.app on malwareinfo.app.