Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 970934" data-attributes="member: 32260">SWH vs. malwareThank @[USER=52096]Gandalf_The_Grey[/USER] I examined the new Zloader Campaign:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/microsoft-code-sign-check-bypassed-to-drop-zloader-malware.111797/[/URL][URL unfurl=&quot;false&quot;]https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/[/URL]The infection chain will be stopped by SWH on level 3 (BAT file blocked):[ATTACH=full]263397[/ATTACH]This attack uses the MSI installer with a valid EV certificate, so this installer can bypass&nbsp; Windows SmartScreen and most AVs (this installer does not contain malicious code). Of course, the attack can be detected when &quot;true&quot; malicious code will be downloaded and executed (level 6). Such malware is used in the targeted attacks:It seems that this campaign was quite successful:[ATTACH=full]263398[/ATTACH]</blockquote>

[QUOTE="Andy Ful, post: 970934, member: 32260"] [B][SIZE=5]SWH vs. malware[/SIZE][/B] [SIZE=4]Thank @[USER=52096]Gandalf_The_Grey[/USER] I examined the new [/SIZE]Zloader Campaign: [URL unfurl="false"]https://malwaretips.com/threads/microsoft-code-sign-check-bypassed-to-drop-zloader-malware.111797/[/URL] [URL unfurl="false"]https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/[/URL] The infection chain will be stopped by SWH on level 3 (BAT file blocked): [ATTACH type="full" alt="1641399603004.png"]263397[/ATTACH] This attack uses the MSI installer with a valid EV certificate, so this installer can bypass Windows SmartScreen and most AVs (this installer does not contain malicious code). Of course, the attack can be detected when "true" malicious code will be downloaded and executed (level 6). Such malware is used in the targeted attacks: It seems that this campaign was quite successful: [ATTACH type="full" alt="1641401308501.png"]263398[/ATTACH] [/QUOTE]

Verification