New NWHStealer Delivery Chain Uses Bun Loader, Anti-VM Checks, and Encrypted C2

The article discusses a new delivery chain for the NWHStealer malware that incorporates several sophisticated techniques to evade detection and enhance its effectiveness. Here are the key points:

1. Use of Bun Loader: The malware now uses a loader called "Bun" to download and execute the main payload. This loader helps in bypassing security measures by dynamically downloading components.

2. Anti-VM Checks: NWHStealer includes checks to detect if it is running in a virtual environment, which is common for malware analysis. If detected as running in a VM, the malware will terminate itself to avoid being studied and mitigated.

3. Encrypted C2 Communication: The command-and-control (C2) server communication is encrypted, making it harder for security researchers and defenders to intercept or analyze the data exchanged between the infected machines and the attackers' servers.

4. Indicators of Compromise (IoCs): The article provides a list of domain names and SHA-256 hashes associated with the malware's activities. These IoCs can be used by cybersecurity professionals to detect and block NWHStealer infections in their networks.

5. Distribution Methods: The malware is distributed through malicious websites, phishing emails, or other social

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.