Security News > 2023 > February > GuLoader Malware Using Malicious NSIS Executables to Target E-Commerce Industry

The malspam activity is notable for transitioning away from malware-laced Microsoft Word documents to NSIS executable files for loading the malware.

While attack chains in 2021 leveraged a ZIP archive containing a macro-laced Word document to drop an executable file tasked with loading GuLoader, the new phishing wave employs NSIS files embedded within ZIP or ISO images to activate the infection.

"Embedding malicious executable files in archives and images can help threat actors evade detection," Trellix researcher Nico Paulo Yturriaga said.

Over the course of 2022, the NSIS scripts used to deliver GuLoader are said to have grown in sophistication, packing in additional obfuscation and encryption layers to conceal the shellcode.

The development is also emblematic of a broader shift within the threat landscape, which has witnessed spikes in alternative malware distribution methods in response to Microsoft's blocking of macros in Office files downloaded from the internet.

"The migration of GuLoader shellcode to NSIS executable files is a notable example to show the creativity and persistence of threat actors to evade detection, prevent sandbox analysis and obstruct reverse engineering," Yturriaga noted.

News URL

https://thehackernews.com/2023/02/guloader-malware-using-malicious-nsis.html