DePriMon Malware Registers Itself as a Windows Print Monitor

guest · Nov 21, 2019

DePriMon Malware Registers Itself as a Windows Print Monitor
November 21, 2019
https://www.bleepingcomputer.com/ne...-registers-itself-as-a-windows-print-monitor/

A malware downloader being dubbed DePriMon registers itself as a Windows print monitor in order to gain persistence on infected user's computers.
Using this method, the malware will have SYSTEM privileges, which allows it to execute commands with elevated privileges such as the downloading of additional malware.

Discovered by ESET researchres, DePriMon is a malware that when loaded will quietly download and execute further malware on the victim's computer.
According to ESET's telemetry this malware has been active since as early as March 2017.
While the researchers do not know how this malware is initially infecting victims [...]

To make it harder for researchers to perform analysis, the configuration file for the malware is stored in an encrypted format in the %Temp% folder. When the malware needs to read it, it will decrypt the file, read it into memory, and then encrypt the file again.
Click to expand...

They have, though, noted that this malware has been detected on some victims along with the ColoredLambert malware, which is used by the Lamberts APT group.

"However, it should be noted that, in a few cases, DePriMon was detected with ColoredLambert malware on the same computers within a short time frame. ColoredLambert is used by the Lamberts (aka Longhorn) cyberespionage group and linked to the Vault 7 leak of CIA capabilities. Our colleagues from Symantec and Kaspersky published their analyses in April 2017."
Click to expand...

ESET: Registers as “Default Print Monitor”, but is a malicious downloader. Meet DePriMon

Log in or Sign up

DePriMon Malware Registers Itself as a Windows Print Monitor

guest Guest

Log in or Sign up

DePriMon Malware Registers Itself as a Windows Print Monitor

guest Guest

Useful Searches