LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)
SANS dissects a LausivLoader JavaScript malspam sample that passes staged payload file paths to PowerShell via process environment variables.
1
Stories per day · 30 days
4 stories, newest first · one card per story
Stories tagged #malspam
"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Unit 42 profiles the Blank Slate malspam campaign: blank emails with double-zipped attachments delivering Cerber ransomware while cycling abused hosting provider domains.
2
Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Unit 42 tracks the new Mole ransomware (CryptoMix family) spread via USPS-themed malspam, with tactics escalating to JavaScript downloaders dropping multiple malware families.
Malspam Targeting Brazil Continues to Evolve
Brazilian malspam campaigns continue evolving, abusing Google URL shortener and Dropbox and using Squiblydoo plus DLL side-loading to deploy likely infostealing botnet malware.
2