PHP WebShell Malware using Image Files Posted By jcleebobgatenet , December 9, 2020 WebShell is a file that is uploaded to a web server which runs file navigation or system shell commands. The attacker can use the web browser to navigate through the files of the server system and issue shell commands. Certain file extensions for uploaded files can be restricted to prevent malicious WebShell files from being uploaded to the server; however, the attacker can bypass such actions with the following method: Upload a file that bypasses the Server-Side Script’s file extension…
Remcos RAT Malware being Distributed as Spam Mail Posted By jcleebobgatenet , November 23, 2020 Remcos is a RAT (Remote Access Trojan) malware that has been distributed through spam mail for the past few years. Remcos is being sold by its developer using the website below, describing it as a RAT tool for remote management, it has been updated regularly until recent days. According to the features described on the Remcos website, it can be used for remote assistance or deleting and tracking sensitive data in case of theft, and the said features are actually…
Info Theft Malware Distribution Phishing Campaign Posted By jcleebobgatenet , November 9, 2020 The ASEC analysis team discovered a phishing site that distributes info-stealer malware by disguising it as a crack program of a normal utility. As shared in the post posted on June 29th (https://asec.ahnlab.com/ko/1339/), the phishing site appears in the top results when the utility program name is searched along with “Crack” on Google. It is assumed that many users were infected when they accessed the said site to download the crack of the utility program. As shown in Figure 2,…
Analysis of Info-Leaking Feature of Info-Stealer Malware Vidar Posted By AhnLab_en , September 8, 2020 Vidar is an info-stealer malware with the feature of leaking personal information. Although it is not included in the Top 5 of the weekly statistics shown below, it has constantly been included in the statistics. And considering the fact that it used to be included in the Top 5 for some time, its distribution rate may increase in the future. The number of files distributed over the last 1 month is shown in the table below. All the files were distributed…
Lokibot is at it Again, This Time Spreading via Purchase Order Posted By AhnLab_en , August 30, 2020 Lokibot malware has been around for several years, being distributed via phishing campaigns that include malicious email attachments or embedded URLs. Since its discovery in 2016, it had been used by various cybercriminals to create backdoors into the Windows machine. In the recent attacks, Lokibot was found being distributed via phishing emails disguised as Purchase Order attachments. Let’s take a closer look at Lokibot’s recent attack methods. Lokibot is an information-stealing trojan that that steals account information from various programs…
