https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition Get a demo Home > Blog THREAT INTELLIGENCE We Value Your Privacy JSSLoader: the shellcode edition English Posted: August 15, 2022 by Mark Stockley We and our vendors use cookies and similar technologies to operate our website, enhance your experience, analyze site traffic, personalize The Malwarebytes Threat Intelligence team observed a content, and deliver targeted advertising. We malspam campaign in late June that we attribute to the FIN7 need your consent to use non-essential cookies. APT group. One of the samples was also reported on Twitter You can choose which categories to allow below. by Josh Trombley; during execution, it was observed to drop a For more details, please see our Privacy Policy. secondary payload, written in .NET. Accept All Details about FIN7 campaigns were described by Mandiant in the article “FIN7 Power Hour: Adversary Archeology and the Reject All Evolution of FIN7″. Earlier this year Morphisec and Secureworks described a new component Customize My Choices used by this group, delivered in XLL format. That element was Page 1 of 8 https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition the first step in the attack chain leading to another malware, Get a demo dubbed JSSLoader. During our analysis, we found out that the current malware We Value Your Privacyused by FIN7 is yet another rewrite of JSSLoader with expanded capabilities as well as new functions that include data exfiltration. We and our vendors use cookies and similar In this white paper, we will focus on the implementation details technologies to operate our website, enhance your experience, analyze site traffic, personalizeof the new observed sample, and provide a deep dive in the content, and deliver targeted advertising. Wecode, as well as compare it with earlier samples analyzed by need your consent to use non-essential cookies.other vendors. You can choose which categories to allow below. For more details, please see our Privacy Policy. Article continues below this ad. Page 2 of 8 ThreatDown is ranked as a leader in EDR + MDR by G2 Request demo Get a demo https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition Download the white paper. We Value Your Privacy We and our vendors use cookies and similar technologies to operate our website, enhance your experience, analyze site traffic, personalize content, and deliver targeted advertising. We need your consent to use non-essential cookies. You can choose which categories to allow below. For more details, please see our Privacy Policy. ThreatDown is ranked as a leader in EDR + MDR by G2 Page 3 of 8 https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition Get a demo Request demo Categories Breaches Product News Ransomware Threat Intelligence We Value Your Privacy Vulnerabilities We and our vendors use cookies and similar technologies to operate our website, enhance your experience, analyze site traffic, personalize content, and deliver targeted advertising. WeSign up to get the latest threat intelligence. need your consent to use non-essential cookies. Subscribe to newsletter You can choose which categories to allow below. For more details, please see our Privacy Policy. ThreatDown is ranked as a leader in EDR + MDR by G2 Page 4 of 8 Request demo Related articles We Value Your Privacy We and our vendors use cookies and similar technologies to operate our website, enhance your experience, analyze site traffic, personalize content, and deliver targeted advertising. We need your consent to use non-essential cookies. You can choose which categories to allow below. For more details, please see our Privacy Policy. https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition Get a demo THREAT INTELLIGENCE CARBONATO:​a​ ​ ​botnet​ ​built​ ​ around an AI agent​ minutes 11 RANSOMWARE This SonicWall bug is 2 years old. Akira ransomware is still… inutes 4 m NEWS AI threat so great that security “takes precedence over everythin… inutes 5 m Page 5 of 8 https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition Get a demo Products & Services Endpoint Detection & Response Endpoint Protection Managed Detection & Response Pricing Partners MSP Partner Program Reseller Partner Program Technology Partners Become a Partner We Value Your Privacy Managed Services Terms & Conditions Managed Service Terms We and our vendors use cookies and similar technologies to operate our website, enhanceMTH Service Description your experience, analyze site traffic, personalizeMDR Service Description content, and deliver targeted advertising. We need your consent to use non-essential cookies. You can choose which categories to allow below. Resources For more details, please see our Privacy Policy. Threat Center Resource Center Blog Glossary Support Nebula Support OneView Support Page 6 of 8 https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition Company Get a demo About Us Press Careers Privacy and Consent My Privacy Choices Get in Touch Contact Us Schedule a Meeting Request a Demo ThreatDown Newsletter Email Address SIGN UP We Value Your Privacy We and our vendors use cookies and similar technologies to operate our website, enhance your experience, analyze site traffic, personalize content, and deliver targeted advertising. We need your consent to use non-essential cookies. You can choose which categories to allow below. For more details, please see our Privacy Policy. Legal Privacy Terms of Service Page 7 of 8 https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition Accessibility Get a demo Vulnerability Disclosure © 2026 All Rights Reserved We Value Your Privacy We and our vendors use cookies and similar technologies to operate our website, enhance your experience, analyze site traffic, personalize content, and deliver targeted advertising. We need your consent to use non-essential cookies. You can choose which categories to allow below. For more details, please see our Privacy Policy. Page 8 of 8