diff --git a/galaxy.html b/galaxy.html index 56ee01f..5c2943c 100755 --- a/galaxy.html +++ b/galaxy.html @@ -99156,6 +99156,30 @@ The Nautilus service listens for HTTP requests from clients to process
Gamut was found to be downloaded by a Trojan Downloader that arrives as an attachment from a spam email message. The bot installation is quite simple. After the malware binary has been downloaded, it launches itself from its current directory, usually the Windows %Temp% folder and installs itself as a Windows service. +The malware utilizes an anti-VM (virtual machine) trick and terminates itself if it detects that it is running in a virtual machine environment. The bot uses INT 03h trap sporadically in its code, an anti-debugging technique which prevents its code from running within a debugger environment. It can also determine if it is being debugged by using the Kernel32 API - IsDebuggerPresent function.
+Links |
+
+ |
https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/ |
+
CORALDECK is an exfiltration tool that searches for specified files and exfiltrates them in password protected archives using hardcoded HTTP POST headers. CORALDECK has been observed dropping and using Winrar to exfiltrate data in password protected RAR files as well as WinImage and zip archives
@@ -99174,7 +99198,7 @@ The Nautilus service listens for HTTP requests from clients to process