MetamorfoMalware

“… with Fortinet’s Security Awareness and Training Service, uses real-world phishing scenarios to train and test employees on common social engineering tactics.”

“The malicious payload involves a DLL file that is run via DLL side-loading or process injection.”

“Every served payload differs in variable names, function names, .NET type-name fragmentation, junk-code insertions, XOR keys, and AES-encrypted code blobs, making file-hash detection essentially impossible at population scale (Figure 5).”

“The JScript performs additional environment checks through Windows Management Instrumentation (WMI), including sandbox detection and OS language identification.”

“The script established persistence by invoking PS_ScheduledTask.ExecMethod(RegisterByUser), which registered a hidden scheduled task configured to execute powershell.exe with -WindowStyle Hidden, -ExecutionPolicy Bypass, and an encoded PowerShell command.”

“…cript bypasses the intermediate loader entirely and loads the banking trojan directly into the AutoIt process memory, skipping the process hollowing step and running as a simpler two-stage infection.”