LausivLoader JS self-copy to fake PhotoEngine PhotoStudio.js path

Ibrahim Saud@tektrix

•updated 20 days ago•0•0•2

Detects the creation of a JavaScript file masquerading as a legitimate Microsoft PhotoEngine component ('PhotoStudio.js') within the '%LOCALAPPDATA%' directory. This behavior is associated with the LausivLoader malware, which uses this masquerading technique to evade detection.