Cybersecurity researchers have detailed the inner workings of a highly evasive loader named "
in2al5d p3in4er" (read: invalid printer) that's used to deliver the Aurora information stealer malware.
"The in2al5d p3in4er loader is compiled with
Embarcadero RAD Studio and targets endpoint workstations using advanced anti-VM (virtual machine) technique," cybersecurity firm Morphisec
said in a report shared with The Hacker News.
Aurora is a Go-based information stealer that emerged on the threat landscape in late 2022. Offered as a commodity malware to other actors, it's distributed through
YouTube videos and SEO-poised fake cracked software download websites.
Clicking the links present in YouTube video descriptions redirects the victim to decoy websites where they are enticed into downloading the malware under the garb of a seemingly-legitimate utility.
thehackernews.com
