Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1076619" data-attributes="member: 32260">WHHLight vs. DBatLoader[URL unfurl=&quot;false&quot;]https://www.zscaler.com/blogs/security-research/dbatloader-actively-distributing-malwares-targeting-european-businesses[/URL][URL unfurl=&quot;false&quot;]https://securityintelligence.com/x-force/email-campaigns-leverage-updated-dbatloader-deliver-rats-stealers/[/URL]The importance of malware loaders is nicely described as follows:[URL unfurl=&quot;false&quot;]https://malcat.fr/blog/exploit-steganography-and-delphi-unpacking-dbatloader/[/URL]When inspecting one of the well-known malware repositories, I recently noticed many DBatLoader samples. A short note about the related phishing campaign can be found on the Italian webpage (translated into English):[URL unfurl=&quot;false&quot;]https://www.imagetechsrl.com/298/malware-aziende-sicurezza-informatica[/URL][ATTACH=full]281727[/ATTACH]Attack flow (1):[ATTACH=full]281733[/ATTACH]Attack flow (2):[ATTACH=full]281732[/ATTACH]I checked 100 recent DBatLoader samples. All were unsigned and blocked by SmartScreen except for one. When the samples were executed without MotW, they were blocked by WDAC ISG.The signed sample has a reputable certificate (allowed by SmartScreen) - it is most probably a benign application (Extreme Picture Finder):[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file/4de29373a57b722bee86a89fa4b704288d12219f1cc1cf29d4743175116a3b42[/URL]</blockquote>

[QUOTE="Andy Ful, post: 1076619, member: 32260"] [B][SIZE=5]WHHLight vs. DBatLoader[/SIZE][/B] [URL unfurl="false"]https://www.zscaler.com/blogs/security-research/dbatloader-actively-distributing-malwares-targeting-european-businesses[/URL] [URL unfurl="false"]https://securityintelligence.com/x-force/email-campaigns-leverage-updated-dbatloader-deliver-rats-stealers/[/URL] [B]The importance of malware loaders is nicely described as follows:[/B] [URL unfurl="false"]https://malcat.fr/blog/exploit-steganography-and-delphi-unpacking-dbatloader/[/URL] When inspecting one of the well-known malware repositories, I recently noticed many DBatLoader samples. A short note about the related phishing campaign can be found on the Italian webpage (translated into English): [URL unfurl="false"]https://www.imagetechsrl.com/298/malware-aziende-sicurezza-informatica[/URL] [ATTACH type="full" alt="1708731179185.png"]281727[/ATTACH] [COLOR=rgb(184, 49, 47)][B]Attack flow (1):[/B][/COLOR] [ATTACH type="full" alt="1708733368584.png"]281733[/ATTACH] [COLOR=rgb(184, 49, 47)][B]Attack flow (2):[/B][/COLOR] [ATTACH type="full" alt="1708733306471.png"]281732[/ATTACH] [B]I checked 100 recent DBatLoader samples. All were unsigned and blocked by SmartScreen except for one. When the samples were executed without MotW, they were blocked by WDAC ISG.[/B] The signed sample has a reputable certificate (allowed by SmartScreen) - it is most probably a benign application (Extreme Picture Finder): [URL unfurl="true"]https://www.virustotal.com/gui/file/4de29373a57b722bee86a89fa4b704288d12219f1cc1cf29d4743175116a3b42[/URL] [/QUOTE]

Verification