LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)

At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. The message was not especially remarkable – it asked the recipient to review some attached requirements and provide a price quotation for a fiber optic system and appeared to impersonate an employee of a legitimate company.
 
 The receiving gateway quarantined the message because it detected malicious content in the attachment, though even if it didn’t, the e-mail would not have gotten much further due to failed SPF and DMARC checks.

≈