The malware creates a suspended AppLaunch.exe process (from the .NET Framework directory) and injects malicious code into its memory space, evading detection by unhooking ntdll.dll functions and employing virtual machine (VM) evasion techniques derived from the open-source Al-Khaser project. This downloads and executes a PowerShell script from a remote server, deploying Rhadamanthys as eRSg.mp3 in the user’s %LocalAppData% directory—a tactic exploiting perceived trust in media file extensions. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Stolen data is exfiltrated to command-and-control (C2) servers via SOAP messages, with attackers optionally deploying secondary modules like file grabbers or custom PowerShell scripts. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. Recent campaigns observed by ASEC use Google Ads to redirect users to spoofed software download pages (e.g., Zoom, AnyDesk) hosting the malicious MSC files. She is covering various cyber security incidents happening in the Cyber Space. The second method abuses the MMC’s Console Taskpad feature, which interprets XML-based commands between <ConsoleTaskpads> and </ConsoleTaskpads> tags.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 20 Feb 2025 14:55:16 +0000