New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight

mood · Sep 12, 2019

New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight
September 12, 2019
https://www.bleepingcomputer.com/ne...er-hides-netwire-rat-payloads-in-plain-sight/

A new malware dropper was observed while infecting computers with a Netwire malicious payload hidden between two benign binaries and using obfuscation to fly under the radar of most anti-malware solutions.

"WiryJMPer is a seemingly ordinary dropper with unusual obfuscation. It uses two benign binaries with superfluous jumps and dead branches sandwiched between the binaries to hide its virtual machine, protecting its Netwire payload," found Avast researchers Adolf Středa and Luigino Camastra.
"While the malware’s functionality isn’t very innovative, it has managed to pass under the radar for some time, probably due to obfuscation and rather low prevalence," conclude the Avast researchers.
Click to expand...

Avast: The tangle of WiryJMPer’s obfuscation

Log in or Sign up

New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight

mood Updates Team

Taxpayers Targeted With Improved NetWire RAT Variant

AZORult Variant, Other Malware Payloads Delivered by Multi-Pronged Attack Campaign

New Mozart Malware Gets Commands, Hides Traffic Using DNS

Parallax RAT: Popular Malware Payload After Hacker Forums Promotion

Threat Insight 2019 in Review: Year of the RAT

Log in or Sign up

New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight

mood Updates Team

Taxpayers Targeted With Improved NetWire RAT Variant

AZORult Variant, Other Malware Payloads Delivered by Multi-Pronged Attack Campaign

New Mozart Malware Gets Commands, Hides Traffic Using DNS

Parallax RAT: Popular Malware Payload After Hacker Forums Promotion

Threat Insight 2019 in Review: Year of the RAT

Useful Searches