Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1007070" data-attributes="member: 32260">Another example of DLL hijacking in the wild:[URL unfurl=&quot;false&quot;]https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims.117675/[/URL][ATTACH=full]269923[/ATTACH]Figure 1 – Partial map of countries previously targeted by Mustang PandaThe infection chain:[ATTACH=full]269924[/ATTACH]This attack vector is usually related to phishing. The victim must be first convinced by the attacker to download and open the RAR archive. Using something like VirusTotal is not useful, because the EXE file is legit and signed. Furthermore, the DLL loader is not harmful without the DAT file, and the DAT file is encrypted.In many cases, such files are properly detected on VirusTotal several days after the malware is already dead.</blockquote>

[QUOTE="Andy Ful, post: 1007070, member: 32260"] Another example of DLL hijacking in the wild: [URL unfurl="false"]https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims[/URL] [URL unfurl="false"]https://malwaretips.com/threads/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims.117675/[/URL] [ATTACH type="full" alt="1665396648491.png"]269923[/ATTACH] [I]Figure 1 – Partial map of countries previously targeted by Mustang Panda[/I] The infection chain: [I][ATTACH type="full" alt="1665396688452.png"]269924[/ATTACH][/I] This attack vector is usually related to phishing. The victim must be first convinced by the attacker to download and open the RAR archive. Using something like VirusTotal is not useful, because the EXE file is legit and signed. Furthermore, the DLL loader is not harmful without the DAT file, and the DAT file is encrypted. In many cases, such files are properly detected on VirusTotal several days after the malware is already dead. [/QUOTE]

Verification