Warn Windows users to watch out for Dead # Vax attack campaigns.

Remind Windows users to beware of Dead campaigns.# VaxAttack the system with Fileless malware.

Fileless attacks, or fileless attacks, are malware downloading into memory directly, which makes most malware detection tools undetectable, have become more popular today, making cyberspace more dangerous than ever. This is another campaign to watch because of the adoption of this method.

According to a report by the website, Siliconangle mentioned how a research team from Securonix Inc., a cybersecurity specialist firm, had detected the Dead campaign.# VaxThis is a malware release campaign that combines several strategies - the use of social engineering deception, the negative use of Disc Image files, and the direct loading of payload files on memory - all of which lead to the release of the last payload as a RAT or Remote Access Trojan called AsyncRAT on the victim's machine.

The attack campaign starts by sending phishing fraudulent victims with deception. The victim trusts a link sent by the hacker. The link leads to the download of a Virtual Hard Disk file hosted on the InterPlanetary File System (IPFS). By using this file format, the malware can easily emanate the Email Gateway. After the victim downloads and connects the emulated file to the Mount system, the image file has the same condition as the local drive. Mark-of-the-Web Protection (MOTW or file protection feature downloaded from an untrusted source)

After the victim opens the simulation drive, it leads to a chain of embedded malware (Infection Chain) that is well designed to look harmless and difficult to detect, while the scripts inside try to quietly assemble the code into Payload (Reconstruction) one by one, starting with the Windows script in the Batch file format (. Bat, which uses Self-Parsing Logic by reading related files to decryption manually, while PowerShell scripts use Multi-Layers Obfuscation to disrupt detection systems through methods such as Unicode Pollution, Base64 encryption, Character Shifting to hide important string values, etc.

And at the last step, the Loader will use tools on Windows (Native Windows Application) such as OpenProcess, VirtualAllocEx, and CreateRemoteThread to launch X64-encrypted Shellcode into reliable processes such as OneDrive.exe or RuntimeBroker.exe, which is considered to launch code directly into memory without leaving a trace on the hard disk, making it difficult to detect. After that, the code will eventually be decrypted into AsyncRAT malware.

AsyncRAT malware is a malware that has a variety of capabilities including password theft, the ability to spy on the victim's machine, the ability to steal data exfiltration, and emitting other malware on the victim's machine.

# Trending # lemon 8 diary # Lemon 8 Howtoo