[Trend]PoisonIvy Uses Legitimate Application as Loader

[igor51]

PoisonIvy Uses Legitimate Application as Loader

I recently obtained a PoisonIvy sample which uses a legitimate application in an effort to stay under the radar. In this case, the PoisonIvy variant detected as BKDR_POISON.BTA (named as newdev.dll) took advantage of a technique known as a DLL preloading attack (aka binary planting) instead of exploiting previously known techniques. The malware was located [...]

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

PoisonIvy Uses Legitimate Application as Loader

Source: PoisonIvy Uses Legitimate Application as Loader