Read on Twitter
Fresh APT loader technique for today's #DailyScriptlet:
cs=Array(#,#,#,#,...): cmd="": For each c in cs: cmd=cmd&Chr(c): Next: cmd=cmd&vbcrlf: Execute(cmd)
This is remotely loaded into memory from source phishing doc that uses renamed wscript & pubprn.vbs to load COM Scriptlet.
cs=Array(#,#,#,#,...): cmd="": For each c in cs: cmd=cmd&Chr(c): Next: cmd=cmd&vbcrlf: Execute(cmd)
This is remotely loaded into memory from source phishing doc that uses renamed wscript & pubprn.vbs to load COM Scriptlet.
@bwithnell and I shared an earlier version of this #APT32 phish technique:
Relevant slide screenshots attached.
They are continually improving each phase of their dynamic, multi-stage infection chain.
https://twitter.com/ItsReallyNick/status/915800233455575040
Relevant slide screenshots attached.
They are continually improving each phase of their dynamic, multi-stage infection chain.
@bwithnell SPOILER: the VBScript *still* doesn't properly convert temperatures as promised, but it *will* load good tidings of great Cobalt Strike 🎅🏽
I know @subTee and @enigma0x3 just love the slide that shows timestamps of APTweet32 technique adoption.
@bwithnell @JohnLaTwC Here is a different malicious Temperature Conversion example 🌡️
More info:
More info:
https://twitter.com/ItsReallyNick/status/915331407630802945
@threadreaderapp unroll me a #threatintel blog breh
• • •
Missing some Tweet in this thread? You can try to
force a refresh
