Cybercriminals Advertising Godzilla Loader Malware On Dark Web Forums


Cybercriminals Advertising Godzilla Loader Malware for $500 on Dark web forums, the malware found actively maintained and getting new updates periodically.

Godzilla modern downloader or dropper which first runs the binary on victim’s machine and then it downloads the payload form a remote server.

According to Checkpoint investigation, the Godzilla Loader malware rate of infection is very less when compared to its competitor, Emotet.

The Godzilla loader advertised as it comes with built-in UAC bypass, the User Account Control(UAC) is a Microsoft security tool that helps in preventing the intrusion of malicious software.

Godzilla Loader Malware

With the new version of “Godzilla, the author boasts that they have converted even more of the control flow to rely entirely on COM interfaces; persistence is achieved via the IPresistFile interface and shell executions of programs on the local disk are triggered via the IShellDispatch interface,” reads Checkpoint blog post.

It also performs other functions such as deletion of file backup, the only possible reason for it to be the anti-Ransomware measure which operates by recovering the original files from the shadow file backups.

The threat actors offered a bouble-layered fail-safe for C&C communication and employs RSA-2048 to verify the identity of the C&C server.

Last version of the malware appears to be under development from last December, the latest version contains propagation module, keylogger module and password stealing module.

Based on it’s existence and adoption rate, researchers said it could be a good example for the principle of the Long Tail.

To read the original article

Laisser un commentaire

Next Post

Facebook a confirmé que les hackers ont volé des données personnelles détaillées de 14 millions de personnes

Le 28 septembre dernier, Facebook annonçait le piratage d’environ 50 millions de comptes dans une attaque considérée comme étant la plus importante de l’histoire du réseau social. Selon Facebook, les attaquants ont exploité une vulnérabilité de sécurité résultant de l’interaction de trois bogues distincts sur deux fonctionnalités du réseau social, à savoir, […]