In March of 2020, MalwareHunterTeam discovered a downloader which installed both a KPot infostealer as well as a second payload which was a ransomware variant that used the string "CoronaVirus".
Using static analysis, it is possible to find out what the evolution of SpyNet looked like, how different versions can be found without even looking at the code, and how to find its authors so their future activities can be monitored.
Get the best of RL Blog delivered to your in-box weekly to stay up to date on key trends, analysis and best practices across threat intelligence and software supply chain security.
