Few days ago I spotted a new pattern in some Angler EK threads
more here............http://malware.dontneedcoffee.com/2014/08/angler-ek-now-capable-of-fileless.html
more here............http://malware.dontneedcoffee.com/2014/08/angler-ek-now-capable-of-fileless.html