Hackers Use PyInstaller and AMSI Patching to Deliver XWorm RAT v7.4
Cybersecurity researchers at Point Wild recently found a new way that cyberattackers are gaining unauthorised access to computers. The investigation, led by experts Kedar Shashikant Pandit, Prathamesh Shingare, and Amol Swami from the Lat61 Threat Intelligence Team, reveals that a common tool used by legitimate developers is being twisted by hackers to hide a nasty malware called XWorm.
Attack Details
The attack starts with a trick email or a fake software update, involving a harmless-looking file. This file is bundled with malicious code using PyInstaller, which is a tool to help programmers turn their scripts into an easy-to-run app. However, in this attack, it is converted into a delivery method for the threat.
When the victim opens the file, it runs a compiled script: BA4Q6ACPMNrd980FwZn9iEbEqkjvRmw7FhW.pyc that works in the background without showing any windows.
Discover more
Affiliate marketing guide
VPN services
Hacker training courses
Point Wild’s investigation further revealed...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
