www.secnews.physaphae.fr This is the RSS 2.0 feed from www.secnews.physaphae.fr. IT's a simple agragated flow of multiple articles soruces. Liste of sources, can be found on www.secnews.physaphae.fr. 2024-06-02T20:16:45+00:00 www.secnews.physaphae.fr Minerva - Minerva Security researcher Blog A new BluStealer Loader Uses Direct Syscalls to Evade EDRs A new BluStealer Loader Uses Direct Syscalls to Evade EDRs BluStealer malware was first detected in May 2021 by James_inthe_box. Back then, it was delivered through a phishing mail, either as an attachment or a Discord link leading to the malware download URL. According to Avast 2021 analysis, it “consists of a core written in Visual Basic and the C# .NET inner payload(s). The VB core reuses a large amount of code from a 2004 SpyEx project. Its capabilities to steal crypto wallet data, swap crypto addresses present in the clipboard, find and upload document files, exfiltrate data through SMTP and the Telegram Bot API, as well as anti-analysis/anti-VM tactics” ]]> 2022-05-03T15:37:31+00:00 https://blog.minerva-labs.com/a-new-blustealer-loader-uses-direct-syscalls-to-evade-edrs www.secnews.physaphae.fr/article.php?IdArticle=5667599 False Malware,Guideline None None