Trusted Design

FluxerBot: Nginx Powered Proxy Malware

概要

What first appeared last week to be yet another malspam campaign solely spread to infect victims with Andromeda, also downloaded some interesting second stage payloads; including several keyloggers and what was later discovered to be labeled as the Fluxer proxybot. The initial malspam lures contained Italian language informing its victims that he or she has received an invoice as the message attachment. The message attachment is a ZIP archive which contained the Andromeda malware installer. Source : http://phishme.com/fluxerbot-nginx-powered-proxy-malware/

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Botnet - Fluxerbot (score: 0.76)
• THL 2015-12-09: Invoice ... from Valley Dynamo, L.P. (score: 0.59)
• Malware-Traffic-Analysis.net - 2017-07-31 - malspam pushing GlobeImposter ransomware (score: 0.58)
• DYNAMOO 2016-01-12: Malware: "Lattitude Global Volunteering" (score: 0.58)
• GamaPoS: The Andromeda Botnet Connection (score: 0.58)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る