Posté par: igor51 le novembre 21, 2019, 04:00:42
We recently saw a malicious spam campaign that has AutoIT-compiled payloads – the trojan spy Negasteal or Agent Tesla (detected by Trend Micro as TrojanSpy.Win32.NEGASTEAL.DOCGC), and remote access trojan (RAT) Ave Maria or Warzone (TrojanSpy.Win32.AVEMARIA.T) – in our honeypots. The upgrading of payloads from a typical trojan spy to a more insidious RAT may indicate that the cybercriminals behind this campaign are moving towards deploying more destructive (and lucrative) payloads, such as ransomware, post-reconnaissance.
The post AutoIT-compiled Negasteal/Agent Tesla, Ave Maria Delivered via Malspam appeared first on .
Source: AutoIT-compiled Negasteal/Agent Tesla, Ave Maria Delivered via Malspam (http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Z99iFrvN2yw/)