I saw this all over VT last night (had 60 notifications when I woke up this morning lol). It's very nice! You can still see the CLSID for EE tho which is handy. Will upload a Yara rule in a sec. cc @GossiTheDog @James_inthe_box
Interesting how the payloads seem to be rather mundane, ie. the hashes that Shiao mentions drop FormBook, Netwire and Agent Tesla respectively.
-
-
Yeah, it looks like it's being used to drop a lot of crap, suggesting someone is selling the tool. Anyone know what it is?
-
Not sure, maybe
@GaborSzappanos has an idea? - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.