Excerpt
The icon of the executable gives us a hit about how this is spreading. It has Photoshop icon, most probably it was spreading using Malvertising.
First we want to know some basic information about the file so I will use DiE to do so.
It was identified as GO binary. .symtab is a legacy section in GO binaries. In GO binaries prior to Version…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by d01a.github.io on d01a.github.io.
Mentioned in the excerpt
More from d01a.github.io1
- The road to Xloaderd01a.github.io · Published 5 Sep
On the same topics
- Vidar v1.5 in Go: same family, new language, heavy sandbox checksderp.ca · Published 16 May
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
