Max_Malyutin on Twitter: "#Emotet and #Bazarloader DLL payload Similarly 🚨 Next stage #CONTI (?) #DFIR #Threatintel File Version Information, the same pattern: Product [a-z]{10} Description rqdads Original Name [a-z]{10}.dll Internal Name [a-z]{10}.dll File Version [0-9]{1}.[0-9]{1}.[0-9]{1}.[0-9]{1} https://t.co/ptQq68Ye3E" / Twitter
https://twitter.com/Max_Mal_/status/1467603148474834952