Hackers use PyInstaller to hide Xworm malware

Hackers use PyInstaller to hide Xworm malware inside and then fake it as a fake update to fool the victim.

According to a report by the SCWorld website, a research team from Point Wild has detected hackers using PyInstaller's developer tool to hack Xworm malware inside harmless files. Hackers take the files they use as carriers and insert the malware code with PyInstaller to create an Executable file from the script file. This will result in the victim opening the file feeling unnoticed, while in the background the malware is installed according to the inserted script, while the malware insert can emanate the detection system. The bait machine, too.

Within the code, the research team detected a Dummy code called "_ IAT _ PHANTOM _ FIX," which is expected to resist anti-analysis by malware analytics tools, and also to shut down the Windows virus scan system called Antimalware Scan Interface (AMSI) with the use of AMSI Memory Patching.

For the payload, hidden within the file, after it is released from the carrier file, it hides inside the% LOCALAPPDATA% folder on the victim's system under a file name that looks like a common file, such as "Win.Kernel _ Svc _ AJ8iOw.exe," and hides it. The malware file itself is mixed with other system files by the XWorm V7.4 malware. After successfully embedding it, it will contact the C2 or Command Control server with an AES encrypted Secret Key to receive attack commands. Attacking the victim's system ranges from stealing passwords, smuggling files on the machine, secretly using a webcam to spy on the victim, to using the victim's machine as part of a larger system shooting or DDoS (Distributed Denial-of-Service).

# Trending # Lemon 8 Howtoo # lemon 8 diary # Pylnataller # freedomhack