GandCrab returns with trojans and redundency

[Łowca]

The GandCrab ransomware has returned with a new set of trojans in addition to its initial infection.

The GandCrab ransomware has returned with a new set of trojans in addition to its initial infection.

The addition of new tools comes just over a week after at least one threat actor began using a combination the info stealer Vidar with the ransomware to increase their odds of taking something of value away from their attack.

The latest attacks are using PowerShell as an entry point to deliver the first stage of the attacks rather than for encryption.

The payload is a Base64 encoded bytecode of  portable executable (PE) which was made with the freeware automation language for Microsoft Windows, AutoIt.

“AutoIt generated PE acts as an unpacker to download other binaries from different servers and create multi layered attack scenario to cover all operating systems with different protections,” Check Point researchers said in the post.

Full Article