News for hackers. Stuff that matters.

A comment on AT&T Alien Labs Uncovers Expansive Campaign: Windows Machines Ensnared in Proxy.

Re:AT&T Alien Labs Uncovers Expansive Campaign: Windows Mach... by rolph on Monday August 21, 2023 @09:15PM (#37217386)
>>The proxy application and most of the malware delivering it are packed using Inno Setup, a free and popular Windows installer.<<

ProxyNation: The dark nexus between proxy apps and malware

https://cybersecurity.att.com/blogs/labs-research/proxynatio...

[ Parent | on HN ]
Re:AT&T Alien Labs Uncovers Expansive Campaign: Windows Mach... by ZeroZeroOneZero on Tuesday August 22, 2023 @12:39AM (#37218759)
More specifically: All of the binaries are just Inno Setup files - even the proxy itself.

Which means it should be easy to wipe out with the next MSRT/Windows update. Considering unpacking Inno and decompiling that weird Pascal(?) scripting it uses has been a thing forever now (innounp). Meaning you can also fully reverse engineer this with a single CLI command and Notepad++ lol

Although this is super clever. I'll give them that.

[ Parent | on HN ]