AT&T Alien Labs Uncovers Expansive Campaign: Windows Machines Ensnared in Proxy(thefinalhop.com)
thefinalhop.com
AT&T Alien Labs Uncovers Expansive Campaign: Windows Machines Ensnared in Proxy
https://www.thefinalhop.com/at-t-alien-labs-uncovers-expansive-campaign-windows-machines-ensnared-in-proxy-service-scheme-a-continuation-of-the-mac-systems-adload-investigation/
2 comments
More specifically: All of the binaries are just Inno Setup files - even the proxy itself.
Which means it should be easy to wipe out with the next MSRT/Windows update. Considering unpacking Inno and decompiling that weird Pascal(?) scripting it uses has been a thing forever now (innounp). Meaning you can also fully reverse engineer this with a single CLI command and Notepad++ lol
Although this is super clever. I'll give them that.
Which means it should be easy to wipe out with the next MSRT/Windows update. Considering unpacking Inno and decompiling that weird Pascal(?) scripting it uses has been a thing forever now (innounp). Meaning you can also fully reverse engineer this with a single CLI command and Notepad++ lol
Although this is super clever. I'll give them that.
ProxyNation: The dark nexus between proxy apps and malware
https://cybersecurity.att.com/blogs/labs-research/proxynatio...