Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1086636" data-attributes="member: 32260">An example of why malware testing should include real-world infection vectors.[URL unfurl=&quot;true&quot;]https://www.threatdown.com/blog/new-go-loader-pushes-rhadamanthys-stealer/[/URL]Attack flow:Malicious Ad ---&gt; attacker-controlled domain ----&gt; the computer IP stored on server + download the Loader ----&gt; the user executes the Loader -----&gt;&nbsp; Loader checks the computer IP with that stored on server ----&gt; the attack is stopped if the IPs are different&nbsp; ----&gt; ....The above fragment is crucial. Suppose the malicious sample (EXE dropper) is tested like in many video tests (the red fragment in the attack flow). In such a case, the malware will not try to infect the system to avoid detection in the sandbox or the analyst environment. The proper testing must start from the real-world starting point (Malicious Ad)</blockquote>

[QUOTE="Andy Ful, post: 1086636, member: 32260"] [B][SIZE=5]An example of why malware testing should include real-world infection vectors.[/SIZE][/B] [URL unfurl="true"]https://www.threatdown.com/blog/new-go-loader-pushes-rhadamanthys-stealer/[/URL] [B]Attack flow: [COLOR=rgb(41, 105, 176)]Malicious Ad[/COLOR][/B] ---> attacker-controlled domain ----> the computer IP stored on server + download the Loader ----> [COLOR=rgb(184, 49, 47)][B]the user executes the Loader -----> Loader checks the computer IP with that stored on server ----> the attack is stopped if the IPs are different[/B][/COLOR][B] ----> ....[/B] The above fragment is crucial. Suppose the malicious sample (EXE dropper) is tested like in many video tests ([COLOR=rgb(184, 49, 47)][B]the red fragment in the attack flow[/B][/COLOR]). In such a case, the malware will not try to infect the system to avoid detection in the sandbox or the analyst environment. The proper testing must start from the real-world starting point ([B][COLOR=rgb(41, 105, 176)]Malicious Ad[/COLOR][/B]) [/QUOTE]

Verification