5 ms·
I'm a little confused. He says that it's a phishing attack and not a virus, but isn't the eventual payload an executable that does lots of dark win32 magic? I
by mcantor 17y ago
I'm a little confused. He says that it's a phishing attack and not a virus, but isn't the eventual payload an executable that does lots of dark win32 magic? I kept expecting him to describe how it launches your browser to a fake bank login site. Just curious... did I miss something?
- bigmac 17y agoYou're correct, the analysis is incomplete without analyzing the payload.
- angelbob 17y agoHe thinks it's for replacing a bit of your browser and doing phishing that way, based entirely on the symbols the executable imports. So it's a guess, but a semi-educated one.
- mcantor 17y agoI'll capitulate, but only if we get to subsequently call it a "phirus". (Though I suppose the lack of self-replication precludes calling it a virus.)