PoisonIvy Uses Legitimate Application as Loader
I recently obtained a PoisonIvy sample which uses a legitimate application in an effort to stay under the radar. In this case, the PoisonIvy variant detected as BKDR_POISON.BTA (named as newdev.dll) took advantage of a technique known as a DLL preloading attack (aka binary planting) instead of exploiting previously known techniques. The malware was located [...]Post from: Trendlabs Security Intelligence Blog - by Trend Micro
PoisonIvy Uses Legitimate Application as Loader
Source: PoisonIvy Uses Legitimate Application as Loader (http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/C9_ZJyLJ1YA/)