A deep dive into Saint Bot, a new downloader

This post was authored by Hasherezade with contributions from Hossein Jazi and Erika Noerenberg In late March 2021, Malwarebytes analysts discovered a phishing email with an attached zip file containing unfamiliar malware. Contained within the zip file was a PowerShell script masquerading as a li...

Spear Phishing Campaign Targets Ukraine Government and Military; Infrastructure Reveals Potential Link to So-Called Luhansk People's Republic

In early 2019, FireEye Threat Intelligence identified a spear phishing email targeting government entities in Ukraine. The spear phishing email included a malicious LNK file with PowerShell script to download the second-stage payload from the command and control C&C server. The email was received...

EFTP .lnk File Handling Remote Overflow

The version of EFTP running on the remote host has a remote buffer overflow vulnerability. Issuing the LS command on a maliciously crafted .lnk file results in an overflow. A remote attacker could exploit this to crash the service, or possibly execute arbitrary code. C Tenable Network Security,...