Dissecting a new #Rust loader - SSLoad. Initially reported by @Unit42_Intel. The infection chain begins with a phishing email, consists of multiple stages, and implements various techniques. A technical analysis 🧵 [1/]
The phishing email delivers MSI installer files, which is set to execute a DLL named MenuEx.dll. This is a sophisticated and undocumented loader we named PhantomLoader. [2/]