Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution

Authored by By Yashvi Shah 

McAfee Labs have identified an increase in Wextract.exe samples, that drop a malware payload at multiple stages.  

Wextract.exe is a Windows executable file that is used to extract files from a cabinet (.cab) file. Cabinet files are compressed archives that are used to package and distribute software, drivers, and other files. It is a legitimate file that is part of the Windows operating system, and it is located in the System32 folder of the Windows …

amadey attack distribution extract file files labs latest malware malware distribution mcafee package payload software stage windows