Ursnif campaign with the macro-enabled documents - Part 2

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

Introduction In the first part of this analysis have been presented the two types of macro-enabled documents with powershell downloader spreading via emails in recent campaign. The powershell downloaders and/or the macros were slightly obfuscated, however, it was easy to defeat this obfuscation and reveal their purpose. Unfortunately, during my analysis the downloaded content was not present on…

Read on /posts/ursnif-requestdoc-campaign-2/ ↗