{"id":19025,"date":"2022-05-12T07:40:05","date_gmt":"2022-05-12T15:40:05","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/05\/12\/news-12758\/"},"modified":"2022-05-12T07:40:05","modified_gmt":"2022-05-12T15:40:05","slug":"news-12758","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/05\/12\/news-12758\/","title":{"rendered":"Phishing Campaign Delivering Three Fileless Malware: AveMariaRAT \/ BitRAT \/ PandoraHVNC \u2013 Part I"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

Fortinet\u2019s FortiGuard Labs captured a phishing campaign that was delivering three fileless malware onto a victim\u2019s device. Once executed, they are able to steal sensitive information from that device. <\/p>\n

In this analysis, I\u2019ll reveal how the phishing campaign manages to transfer the fileless malware to the victim\u2019s device, what mechanism it uses to load, deploy, and execute the fileless malware in the target process, and how it maintains persistence on the victim\u2019s device.<\/p>\n

Affected platforms: <\/b>Microsoft Windows
Impacted parties: <\/b>Microsoft Windows Users
Impact:<\/b> Controls victim\u2019s device and collects sensitive information
Severity level: <\/b>Critical <\/p>\n

Observing the Phishing Email<\/h2>\n

The captured phishing<\/a> email is shown in Figure 1.1. It was disguised as a notification of a payment report from a trusted source.\u00a0<\/p>\n<\/p><\/div>\n