Skip To Main Content
Roger Galobardes on Muck Rack

Roger Galobardes

As seen in: Medium
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile

Get in touch with Roger

Contact Roger, search articles and posts on X, monitor coverage, and track replies from one place.

Learn more about Muck Rack

Actions

Share this page

Is this you?

As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile

Articles

Goblin Panda changes the dropper and reuses the old infrastructure

|
By Roger Galobardes, Jonathan Ticknor, Craig Hays, Will Coady
| Medium
I found a new dropper c580d77722d85238ed76689a17b0205b4d980c010bef9616b8611ffba21b142e with the same signature of others. But it changes the exploitation. Before, it uses the ole package to drop a 8.t file in %appdata% and decode two files, a legit file and an backdoor (PlugX, newcore rat, sysfader…). Now it’s a big object ole mapped in memory and one PE is used to drop the files. Now we have four object oles in the RTF. this RTF exploits again the CVE-2017_1882 on eqnedt32.exe.
Open in Who Shared Issue with article?
See all 1 articles