Forest Global Training Partners

Cyber Risks · Cisco Talos

Combing Through Brushaloader Amid Massive Detection Uptick

Summary: Cisco Talos reports a marked increase in Brushaloader malware distribution, a VBScript-based loader active since mid-2018 that spreads primarily through Polish-language 'Faktura' invoice spam campaigns carrying RAR archives, mainly to deliver Danabot. Talos documents the loader's repeated revisions - switching between hard-coded IPs and domains, moving from WScript to Internet Explorer and later PowerShell, adopting HTTPS POST command-and-control, and adding sandbox-evasion tricks such as requests to non-existent domains and a Fibonacci dialog box that requires a user click before downloading a PE32 executable.

What you should know: Brushaloader's evasion - non-existent domains, sleep timers, and a dialog box that blocks automated analysis until someone clicks OK - produced significantly lower detection rates, and a late-January campaign reached a scale Talos had not previously seen from this loader, with potential to spread beyond Europe.

Read the original at Cisco Talos ↗

Topics
Malware
Related