New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight

mood · Sep 12, 2019

New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight
September 12, 2019
https://www.bleepingcomputer.com/ne...er-hides-netwire-rat-payloads-in-plain-sight/

A new malware dropper was observed while infecting computers with a Netwire malicious payload hidden between two benign binaries and using obfuscation to fly under the radar of most anti-malware solutions.

"WiryJMPer is a seemingly ordinary dropper with unusual obfuscation. It uses two benign binaries with superfluous jumps and dead branches sandwiched between the binaries to hide its virtual machine, protecting its Netwire payload," found Avast researchers Adolf Středa and Luigino Camastra.
"While the malware’s functionality isn’t very innovative, it has managed to pass under the radar for some time, probably due to obfuscation and rather low prevalence," conclude the Avast researchers.
Click to expand...

Avast: The tangle of WiryJMPer’s obfuscation

Log in or Sign up

New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight

mood Updates Team

Double Vision: Stealthy Malware Dropper Delivers Dual RATs

Hiding in Plain Sight: New Adwind jRAT Variant Uses New Tricks to Mask its Behavior

InnfiRAT: A new RAT aiming for your cryptocurrency and more

Remcos RAT campaign delivers new variant using AutoIt wrapper

Saefko – A new multi-layered RAT that targets cryptocurrency users

Log in or Sign up

New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight

mood Updates Team

Double Vision: Stealthy Malware Dropper Delivers Dual RATs

Hiding in Plain Sight: New Adwind jRAT Variant Uses New Tricks to Mask its Behavior

InnfiRAT: A new RAT aiming for your cryptocurrency and more

Remcos RAT campaign delivers new variant using AutoIt wrapper

Saefko – A new multi-layered RAT that targets cryptocurrency users

Useful Searches