Earth Freybug Uses UNAPIMON for Unhooking Critical APIs

This article provides an in-depth look into two techniques used by Earth Freybug actors: dynamic-link library (DLL) hijacking and application programming interface (API) unhooking to prevent child processes from being monitored via a new malware we’ve discovered and dubbed UNAPIMON.

api apis application application programming interface article child critical dll dynamic earth hijacking interface library link malware prevent processes programming reports techniques trend micro research : articles trend micro research : endpoints trend micro research : research