Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 963542" data-attributes="member: 32260"><h3><a href="https://thehackernews.com/2021/11/mekotio-banking-trojan-resurfaces-with.html" target="_blank">Mekotio Banking Trojan</a></h3>[URL unfurl=&quot;false&quot;]https://thehackernews.com/2021/11/mekotio-banking-trojan-resurfaces-with.html[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/mekotio-banking-trojan-resurfaces-with-new-attacking-and-stealth-techniques.110791/[/URL][ATTACH]261671[/ATTACH]Simple Windows Hardening settings can break the infection chain just after unpacking the malware (level 3) - the BAT script will be blocked.It is worth mentioning that on the last infection level&nbsp; (6) the above malware uses three files: AHK interpreter + AHK script + DLL payload.Using the AHK scripting is also possible via the compiled executable (EXE malware). Simple Windows Hardening does not block EXE files, but it will break the infection chain very quickly by blocking VBS or PS scripting:<img src="https://lh3.googleusercontent.com/mfEzzee-9cMgGVxvJ_nAta82emy25RvnvZAuSyvwCa7ca1rJbA8lOm9nBkBremgWyj0_IFSbn4bXcmoMS6X0kZfvh8ahrZ3W5aaRSMte5UY6Ep3TY1xaf2ePEiMC5FhWIkftxKaH" alt="" class="fr-fic fr-dii fr-draggable " style="" />[URL unfurl=&quot;false][URL=&quot;https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns&quot;https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns&quot;]AHK RAT Loader Used in Unique Delivery Campaigns[/URL][/URL]</blockquote>

[QUOTE="Andy Ful, post: 963542, member: 32260"] [HEADING=2][URL='https://thehackernews.com/2021/11/mekotio-banking-trojan-resurfaces-with.html']Mekotio Banking Trojan[/URL][/HEADING] [URL unfurl="false"]https://thehackernews.com/2021/11/mekotio-banking-trojan-resurfaces-with.html[/URL] [URL unfurl="false"]https://malwaretips.com/threads/mekotio-banking-trojan-resurfaces-with-new-attacking-and-stealth-techniques.110791/[/URL] [ATTACH]261671[/ATTACH] Simple Windows Hardening settings can break the infection chain just after unpacking the malware (level 3) - the BAT script will be blocked. It is worth mentioning that on the last infection level (6) the above malware uses three files: AHK interpreter + AHK script + DLL payload. Using the AHK scripting is also possible via the compiled executable (EXE malware). Simple Windows Hardening does not block EXE files, but it will break the infection chain very quickly by blocking VBS or PS scripting: [IMG]https://lh3.googleusercontent.com/mfEzzee-9cMgGVxvJ_nAta82emy25RvnvZAuSyvwCa7ca1rJbA8lOm9nBkBremgWyj0_IFSbn4bXcmoMS6X0kZfvh8ahrZ3W5aaRSMte5UY6Ep3TY1xaf2ePEiMC5FhWIkftxKaH[/IMG] [URL unfurl="false][URL="https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns"https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns"]AHK RAT Loader Used in Unique Delivery Campaigns[/URL][/URL] [/QUOTE]

Verification