Tag: nsis

3 Attack Reports | 0 Vulnerabilities

Attack reports

NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign

A malware campaign using fake software installers to deliver Winos v4.0, a memory-resident malware, has been tracked throughout 2025. The campaign, dubbed Catena, employs trojanized NSIS installers, reflective DLL loading, and shellcode-embedded INI files to evade detection. It stages payloads enti…

chinese-speaking targets

memory-resident malware

reflective dll injection

trojanized installers

Published: May 27, 2025

Downloadable IOCs: 31

Cyberattack: UAC-0125 using the theme "Army+" (CERT-UA#12559)

A cyber attack attributed to UAC-0125 has been identified, involving websites mimicking the official 'Army+' app page. These sites, hosted on Cloudflare Workers, prompt users to download a malicious executable. The EXE file, an NSIS installer, contains a decoy .NET file, Python interpreter, Tor fil…

cloudflare workers

Published: December 20, 2024

Downloadable IOCs: 6

Static Unpacking for the Widespread NSIS-based Malicious Packer

This article examines a malicious packer family based on the Nullsoft Scriptable Install System (NSIS) used by cybercriminals to protect various malware from detection. It describes the structure of packed samples, and presents an approach for creating a tool that automatically unpacks the encrypte…

Published: May 28, 2024

Downloadable IOCs: 11

Click here to see more Attack Reports