@c_APT_ure @TrendLabs We've seen that in Brazil toohttp://blog.trendmicro.com/trendlabs-security-intelligence/control-panel-files-used-as-malicious-attachments/ …
-
-
Replying to @mer0x36
@MenteBinaria@TrendLabs seen some w/ DarkKomet & TROJ_FORUCON.BMC detections. Is that really DarkKomet or some RAT? https://www.virustotal.com/en/file/28e08c2174e341cca03662b31aaa540780cb8e39e7e309164a61c4a8d6244b72/analysis/1390997554/ …1 reply 0 retweets 0 likes -
Replying to @c_APT_ure
@c_APT_ure Hi there! We'll check with our experts on this and get back to you as soon as we can.@MenteBinaria1 reply 0 retweets 0 likes -
Replying to @TrendMicroRSRCH
.
@c_APT_ure. Looks like it's neither -- It's an RTF file (TROJ_ARTIEF.KVV) with a ZBOT attachment (TSPY_ZBOT.KVV)@MenteBinaria3 replies 2 retweets 2 likes -
Replying to @TrendMicroRSRCH
@TrendLabs So no exploit but embedded file?@c_APT_ure@MenteBinaria1 reply 0 retweets 0 likes -
Replying to @bartblaze
@bartblaze@TrendLabs@MenteBinaria correct, no exploit!#malware embedded in RTF (or .doc) file, user needs to run it (just like in ZIP)1 reply 0 retweets 0 likes -
Replying to @c_APT_ure
@c_APT_ure Pretty lame tactic indeed. Thanks Tom, I'll check it out.@TrendLabs@MenteBinaria2 replies 0 retweets 0 likes -
Replying to @bartblaze
@bartblaze Lame? Maybe, but hey it's pretty effective evading AV & perimeter defenses and get successful infections. Maybe not too lame :P2 replies 0 retweets 0 likes -
Replying to @c_APT_ure
@c_APT_ure Haha, that may be true. Do you know if any Yara signatures for this exist already by any chance?1 reply 0 retweets 0 likes -
Replying to @bartblaze
@bartblaze nope, sorry don't know. But would be nice, so go ahead ;)1 reply 0 retweets 0 likes
@c_APT_ure Agreed, Yara is on my to-do list for some time though... I'll let you know :-)
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.