Trusted Design

Zscaler's Spymel - signed malware

概要

From the Zscaler website: IOC from the Malwr evaluation Several other VT claim to be linked. IOCs from them not included =/ Sophos also has a small write up Introduction ThreatLabZ came across yet another malware family where the authors are using compromised digital certificates to evade detection. The malware family in this case is the information stealing Trojan Spymel and involved a .NET executable signed with a legitimate DigiCert issued certificate. The infection cycle typically starts with a malicious JavaScript file that arrives in a ZIP archive via e-mail attachment. Once the user opens the JavaScript file, it will download and install the malware executable on the victim machine. The malicious JavaScript file, surprisingly, in this case is not obfuscated and easy to read as seen in screenshot below. The Trojan Spymel executable gets downloaded from a remote location hardcoded in the JavaScript.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• New Infostealer Trojan uses Fiddler Proxy (score: 0.68)
• Zusy malware on Metadefender.com (score: 0.66)
• Zusy malware on Metadefender.com (score: 0.66)
• Zusy malware on Metadefender.com (score: 0.66)
• Zusy malware on Metadefender.com (score: 0.66)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る