Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1071650" data-attributes="member: 32260">WHHLight vs. Pikabot [URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/pikabot-malware-surfaces-as-qakbot-replacement-for-black-basta-attacks.128285/[/URL][URL unfurl=&quot;false&quot;]https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html[/URL]Email Thread-Jacking (or Conversation Hijacking)[URL unfurl=&quot;false&quot;]https://www.kaspersky.com/blog/what-is-conversation-hijacking/48010/[/URL]Scenario 1Phishing email&nbsp; ( Thread-Jacking ) ----&gt;&nbsp; PDF&nbsp; with embedded URL&nbsp; ----&gt;&nbsp; ZIP archive downloaded from URL ---&gt; JavaScript (JScript) downloader/launcher in ZIP archive&nbsp; ---&gt;&nbsp; LOLBins (cmd[.]exe, curl.exe, rundll32.exe) used to download and execute a DLL payload[ATTACH=full]280831[/ATTACH]Scenario 2Phishing email&nbsp; ( Thread-Jacking ) ----&gt; IMG (disk image file) in ZIP attachment&nbsp; ----&gt;&nbsp; Shortcut (LNK file) + malicious DLL&nbsp; ----&gt; Shortcut executes DLL by using LOLBin (rundll32.exe)[ATTACH=full]280830[/ATTACH]The content of the IMG file (Shortcut icon spoofed as a document)
Such attacks are blocked by default SWH settings in WHHLight (JScript and LNK files are blocked).The attack from Scenario 1 can also be mitigated by FirewallHardening (blocked outbound connections of curl.exe)
</blockquote>

[QUOTE="Andy Ful, post: 1071650, member: 32260"] [B][SIZE=5]WHHLight vs. Pikabot [/SIZE][/B] [URL unfurl="false"]https://malwaretips.com/threads/pikabot-malware-surfaces-as-qakbot-replacement-for-black-basta-attacks.128285/[/URL] [URL unfurl="false"]https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html[/URL] Email Thread-Jacking (or Conversation Hijacking) [URL unfurl="false"]https://www.kaspersky.com/blog/what-is-conversation-hijacking/48010/[/URL] [B]Scenario 1[/B] Phishing email ( Thread-Jacking ) ----> PDF with embedded URL ----> ZIP archive downloaded from URL ---> JavaScript (JScript) downloader/launcher in ZIP archive ---> LOLBins (cmd[.]exe, curl.exe, rundll32.exe) used to download and execute a DLL payload [ATTACH type="full" alt="1704980562689.png"]280831[/ATTACH] [B]Scenario 2[/B] Phishing email ( Thread-Jacking ) ----> IMG (disk image file) in ZIP attachment ----> Shortcut (LNK file) + malicious DLL ----> Shortcut executes DLL by using LOLBin (rundll32.exe) [ATTACH type="full" alt="1704980386049.png"]280830[/ATTACH] [CENTER]The content of the IMG file (Shortcut icon spoofed as a document) [/CENTER] [B][COLOR=rgb(0, 168, 133)]Such attacks are blocked by default SWH settings in WHHLight (JScript and LNK files are blocked).[/COLOR][/B] The attack from Scenario 1 can also be mitigated by FirewallHardening (blocked outbound connections of curl.exe) [CENTER] [/CENTER] [/QUOTE]

Verification