2 ms·
>>The proxy application and most of the malware delivering it are packed using Inno Setup, a free and popular Windows installer.<< ProxyNation: The dark nexus
by rolph 3y ago
>>The proxy application and most of the malware delivering it are packed using Inno Setup, a free and popular Windows installer.<<
ProxyNation: The dark nexus between proxy apps and malware
https://cybersecurity.att.com/blogs/labs-research/proxynation-the-dark-nexus-between-proxy-apps-and-malware?ref=thefinalhop.com https://cybersecurity.att.com/blogs/labs-research/proxynatio...
- ZeroZeroOneZero 3y agoMore specifically: All of the binaries are just Inno Setup files - even the proxy itself. Which means it should be easy to wipe out with the next MSRT/Windows update. Considering unpacking Inno and decompiling that weird Pascal(?) scripting it uses has been a thing forever now (innounp). Meaning you can also fully reverse engineer this with a single CLI command and Notepad++ lol Although this is super clever. I'll give them that.