The focus will be on a multi-stage infection process involving Visual Basic Script (VBS), a batch file, and a PowerShell script, ultimately leading to the deployment of high-profile malware like DCRat or Rhadamanthys infostealer. The Acronis Threat Research Unit analyzes threats like DCRat as a part of our ongoing research and development work to ensure that our security solutions — such as Acronis Advanced Security + Extended Detection and Response (XDR) — are prepared for emerging threats. The Acronis Threat Research Unit (TRU) was presented with an interesting threat chain and malware sample for analysis that involved a known cyberthreat along with some interesting twists in targeting and obfuscation. The analysis of this malware delivery chain by the Acronis Threat Research Unit (TRU) has yielded several key findings. The complexity of the delivery chain introduces multiple layers of obfuscation, making it challenging for security solutions to detect and block the malware at each step. The multi-stage process, involving multiple script languages and obfuscation techniques, can effectively bypass security solutions, leading to unauthorized access, data theft, and system compromise. Acronis Threat Research Unit's detailed analysis of DCRat provides a comprehensive understanding of this new threat, including secure code samples and screenshots. The deployment of high-profile malware like DCRat or Rhadamanthys infostealer through this complex delivery chain poses significant risks. By monitoring and blocking the execution of encoded payloads in memory, these solutions can prevent the loading of final malware like DCRat, Rhadamanthys, or Remcos. When executed, this VBS file initiates a multistage delivery process, setting the stage for the deployment of the final malicious payload. Acronis XDR leverages real-time protection and in-house-developed generic script emulators to de-obfuscate and analyze scripts, allowing for early detection and neutralization of threats.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 01 Apr 2025 17:45:06 +0000