New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight

mood · Sep 12, 2019

New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight
September 12, 2019
https://www.bleepingcomputer.com/ne...er-hides-netwire-rat-payloads-in-plain-sight/

A new malware dropper was observed while infecting computers with a Netwire malicious payload hidden between two benign binaries and using obfuscation to fly under the radar of most anti-malware solutions.

"WiryJMPer is a seemingly ordinary dropper with unusual obfuscation. It uses two benign binaries with superfluous jumps and dead branches sandwiched between the binaries to hide its virtual machine, protecting its Netwire payload," found Avast researchers Adolf Středa and Luigino Camastra.
"While the malware’s functionality isn’t very innovative, it has managed to pass under the radar for some time, probably due to obfuscation and rather low prevalence," conclude the Avast researchers.
Click to expand...

Avast: The tangle of WiryJMPer’s obfuscation

Log in or Sign up

New WiryJMPer Dropper Hides Netwire RAT Payloads in Plain Sight

mood Updates Team