Understanding Pronsus Loader Malware

Pronsus Loader is a newly identified type of malware that operates by connecting to remote servers controlled by threat actors to download additional harmful payloads. It is categorized as 'loader malware' due to its primary function of initiating other types of malware, which may include info stealers or other loaders. This variant is particularly interesting because it utilizes JPHP, a Java version of PHP, a less common coding framework among malware types. The discovery of Pronsus Loader occurred during a campaign targeting another loader called Latrodectus, illustrating how different malware types can interact and facilitate further attacks on systems.