Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

2025-01-09: CVE-2017-0199 XLS --> HTA --> VBS --> steganography --> DBatLoader/GuiLoader style malware 2025-01-09 (THURSDAY): CVE-2017-0199 XLS --> HTA --> VBS --> STEGANOGRAPHY --> DBATLOADER/GUILOADER STYLE MALWARE NOTES: Zip files are password-protected.  Of note, this site has a new password scheme ... Read more Published Date: Jan 11, 2025 (4 hours, 23 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2017-0199

The Czech Republic has accused Chinese state-backed hackers of attempting to hack into its government network. The US Cybersecurity and Infrastructure Security Agency (CISA) has lost nearly all of its top officials in a recent purge. Google has warned of Vietnam-based hackers using fake AI video generators to spread malware. A new phishing campaign has been discovered that uses DBatLoader to drop the Remcos RAT malware. Hackers have mimicked a popular antivirus website to deliver malware and steal financial data. The real estate firm RE/MAX has allegedly had 150GB of data stolen by the Medusa ransomware, which is demanding a $200,000 ransom. An Iranian national has pleaded guilty to launching a ransomware attack on the city of Baltimore and faces up to 30 years in prison. Cybersecurity experts are warning of the importance of protecting neural data from being exploited. The CyberWire podcast features an interview with Tony Velleca, CEO of CyberProof, discussing exposure management and a more risk-focused approach to prioritize threats. The podcast also invites companies to advertise with them to reach influential leaders and operators in the industry.

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

Effortlessly remove Trojan:Win32/DBatLoader.LKZ!MTB with our step-by-step guide to restore security.

A newly identified phishing campaign deploys the Remcos Remote Access Trojan (RAT) using DBatLoader, leveraging a User Account Control (UAC) bypass technique involving mock trusted directories to evade security controls.

A new phishing campaign is utilizing DBatLoader to deploy the Remcos RAT. This campaign targets users by sending them emails with malicious attachments. When users open these files, DBatLoader is executed, enabling the download and installation of Remcos RAT. Remcos RAT is a remote access tool that allows attackers to take control of infected systems. Analysts have observed that this campaign employs social engineering techniques to persuade victims to open the attachments. The impacts include loss of control over infected systems and potential theft of sensitive data.

Learn about a new phishing campaign spreading Remcos through DBatLoader. It employs UAC bypass and obfuscated scripts to compromise systems.

New phishing campaign uses old Windows formats & DBatLoader to drop Remcos RAT, evading defenses via UAC bypass & LOLBins abuse.

A new phishing campaign is spreading the Remcos Remote Access Trojan (RAT) through DBatLoader. It employs User Account Control (UAC) bypass, obfuscated scripts, Living Off the Land Binaries (LOLBAS) abuse, and persistence mechanisms. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no ex...

A newly identified phishing campaign deploys the Remcos Remote Access Trojan (RAT) using DBatLoader, leveraging a User Account Control (UAC) bypass technique involving mock trusted directories to evade security controls.

ModiLoader (aka DBatLoader) targets Windows users via crafted phishing, posing a major threat to individuals.

Just some lists of Malware Configs. Contribute to Gi7w0rm/MalwareConfigLists development by creating an account on GitHub.