Post

New Octowave Loader sample is leading to Amatera Stealer deployment over the past week. 0 VT detections on any component of the malware loader. Proofpoint rules detect the outbound C2 traffic. My Yara rule detects the installer.

Adobe printer driver sideloads tbb.dll, tbb.dll loads app-2.3.dll which gets stego from blood.wav, uses zxing.presentation.dll and Xceed.Wpf.AvalonDock.Themes.Aero.dll MSI: www.virustotal.com/gui/file/f5c... Components all with 0 VT detections. DLLs are legitimate ones that were modified.

TBB: www.virustotal.com/gui/file/f5c... APP-2.3: www.virustotal.com/gui/file/b50... ZXING: www.virustotal.com/gui/file/f4c... XCEED: www.virustotal.com/gui/file/118... BLOOD: www.virustotal.com/gui/file/d96...