Names | GpUpdates.exe | |
Category | Malware | |
Type | Dropper | |
Description | (Epic Turla) The droppers are misidentified as packed by Armadillo but in reality they’re built using now defunct Chilkat software, ‘Zip2Secure’ to create self-extracting executables. The packing alone has led the droppers to be detected under generic AV detections but the subcomponents have low-to-no detections at this time. The Zip2Secure configuration entrusts the distribution of the files contained therein to ‘Distribute.exe’, which places the files and silently registers the subcomponents with regsvr32.exe. | |
Information | <https://www.epicturla.com/blog/the-lost-nazar> |
Last change to this tool card: 24 April 2020
Download this tool card in JSON format
Previous: gpresult
Next: Grandoreiro
Changed | Name | Country | Observed | ||
APT groups | |||||
Nazar | ![]() | 2008 |
1 group listed (1 APT, 0 other, 0 unknown)
Digital Service Security Center Follow us on![]() ![]() |
Report incidents |
|
![]() |
+66 (0)2-123-1227 | |
![]() |
[email protected] |