Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1026483" data-attributes="member: 99014">I think that for one company that employs 5K people and secures some of the largest businesses, also publishes extremely high-quality research on their website it is not the exception… It’s the rule. It’s not applicable only to infostealers but I am mainly passionate about them. I am not so interested in ransomware and other threats (unless they include exfiltration abilities as well).It was not one sample, it was a lot from 2 families: one of them notorious for its love for Explorer.exe and for being distributed as a signed executable, and the other family was script-based. At the time of discovering the opendir, there were hundreds of scripts there calling each other, and all of them had detection rate of maximum 2-3 on VT. After my daily submissions (the opendir was updated few times a day) things got a bit better, but in both cases I observed inability for the final payload to be terminated.&nbsp; Infection chain was MS Office Document -&gt; JS -&gt; VBS-&gt; LOLBin. It would also check certain directories to identify installed AV and download a tailored “Bypass” as they called it on the Middle Eastern forum.&nbsp;I trust this information will be enough to pinpoint which threats exactly I am talking about.But I can also get samples and hashes as well.If you wanna have a nice sweet talk about this and other malware, feel free to PM me. This is not the right place for it.</blockquote>

[QUOTE="Trident, post: 1026483, member: 99014"] I think that for one company that employs 5K people and secures some of the largest businesses, also publishes extremely high-quality research on their website it is not the exception… It’s the rule. It’s not applicable only to infostealers but I am mainly passionate about them. I am not so interested in ransomware and other threats (unless they include exfiltration abilities as well). It was not one sample, it was a lot from 2 families: one of them notorious for its love for Explorer.exe and for being distributed as a signed executable, and the other family was script-based. At the time of discovering the opendir, there were hundreds of scripts there calling each other, and all of them had detection rate of maximum 2-3 on VT. After my daily submissions (the opendir was updated few times a day) things got a bit better, but in both cases I observed inability for the final payload to be terminated. Infection chain was MS Office Document -> JS -> VBS-> LOLBin. It would also check certain directories to identify installed AV and download a tailored “Bypass” as they called it on the Middle Eastern forum. I trust this information will be enough to pinpoint which threats exactly I am talking about. But I can also get samples and hashes as well. If you wanna have a nice sweet talk about this and other malware, feel free to PM me. This is not the right place for it. [/QUOTE]

Verification