Recurring C# source links local compilation across malware analyses
A process reported as MSBuild launched a headless browser using the existing Default profile, while separate events named the MSBuild image in connections to a recovered C2 destination. The evidence puts build tools at both boundaries, but does not tie the browser launch and network events to one process instance or establish browser-data theft.
A process reported as Microsoft’s MSBuild.exe launched Chrome with headless mode, remote debugging on port 9223, and the browser’s existing Default profile selected. In the same malware sample’s analysis record, MSBuild also appears in outbound connection events to an address recovered from memory as a command-and-control endpoint. Why is a build tool appearing at both the browser and network boundaries?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read