I stumbled upon VIPKeylogger which has multiple stages.
The last stage is an autoit script that loads and decrypt an encrypted shellcode and injects it into a legit windows process. The thing is that the shellcode was generated from Donut shellcode generator and I can't analyze it whatsoever, the dynamic analysis of that exact process didn't show any but the shellcode is was already injected in the process space with RWX permissions. Does anyone have a way to reverse a donut generated shellcode or some sort of way to debug and analyze shellcodes?
Vollständiges Original-Advisory
Ausführliche Details, Exploit-Analyse & Hersteller-Stellungnahme auf reddit.com.
SOCIAL SHARE CARD GENERATOR