This is a waterhole-style injection, jquery and executable are injected to the main frame.
Google confirmed there was a zero-day vulnerability, but did not patch this one up.
The payload is downloaded as described before as an encrypted binary, After decryption,
the malware module is dropped as updata.exe to disk and executed.
For persistence the malware installs tasks in Windows Task Scheduler.
This also has a melting element to it, where it is virtually impossible to find the final file
after execution, and thus far it has yielded good results and has not been flagged as
any false negative/positives by any malware program.
Demonstration has been given, there are 2 exploits combined in this, also a side-note
covering outlook's new merged system which can be exploited for @Hotmail and @live
emails. This won't be patched any time soon, seeing as they over-looked it several times.
Prices are ranging from 25-30 BTC for this, and I have consulted 1 team in details,
but they have a purpose to patch this and make statistical patch-reports, I wish this
to stay open.
PM me if interested.
Google confirmed there was a zero-day vulnerability, but did not patch this one up.
The payload is downloaded as described before as an encrypted binary, After decryption,
the malware module is dropped as updata.exe to disk and executed.
For persistence the malware installs tasks in Windows Task Scheduler.
This also has a melting element to it, where it is virtually impossible to find the final file
after execution, and thus far it has yielded good results and has not been flagged as
any false negative/positives by any malware program.
Demonstration has been given, there are 2 exploits combined in this, also a side-note
covering outlook's new merged system which can be exploited for @Hotmail and @live
emails. This won't be patched any time soon, seeing as they over-looked it several times.
Prices are ranging from 25-30 BTC for this, and I have consulted 1 team in details,
but they have a purpose to patch this and make statistical patch-reports, I wish this
to stay open.
PM me if interested.
![[Image: dDT1QBf.png]](https://i.imgur.com/dDT1QBf.png)