{"id":13839,"date":"2025-05-22T12:44:42","date_gmt":"2025-05-22T12:44:42","guid":{"rendered":"\/cybersecurity-blog\/?p=13839"},"modified":"2025-05-22T12:48:49","modified_gmt":"2025-05-22T12:48:49","slug":"dbatloader-drops-remcos","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/dbatloader-drops-remcos\/","title":{"rendered":"DBatLoader Delivers Remcos via .pif Files and UAC Bypass in New Phishing Campaign\u00a0"},"content":{"rendered":"\n

A new phishing campaign is spreading the Remcos<\/a> Remote Access Trojan (RAT<\/a>) through DBatLoader<\/a>. It employs User Account Control (UAC<\/a>) bypass, obfuscated scripts, Living Off the Land Binaries (LOLBAS) abuse, and persistence mechanisms.<\/p>\n\n\n\n

Here\u2019s an analysis of the infection chain, key techniques, and detection tips. <\/p>\n\n\n\n

How the Attack Works  <\/h2>\n\n\n\n

To see how the attack unfolds, we analyzed the sample inside ANY.RUN\u2019s Interactive Sandbox<\/a>. <\/p>\n\n\n\n

View full execution and analysis<\/a> <\/p>\n\n\n\n

The attack likely starts with a phishing<\/a> email containing an archive.  <\/p>\n\n\n

\n
\"\"
Analysis of the malicious sample inside ANY.RUN\u2019s Interactive Sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n

Inside it, there is a malicious executable named \u201cFAKTURA\u201d, which deploys DBatLoader on the system.  <\/p>\n\n\n\n

Use of .pif Files for Disguise and UAC Bypass<\/strong> <\/h3>\n\n\n\n

DBatLoader uses .pif (Program Information File) files as a method of disguise and execution.  <\/p>\n\n\n\n

Originally intended for configuring how DOS-based programs should run in early Windows systems, .pif files have become obsolete for legitimate use. However, they are still executable on modern Windows versions, making them useful for attackers. <\/p>\n\n\n\n

Windows treats .pif files similarly to .exe files. When executed, they can run without triggering warning dialogs, depending on system configuration.  <\/p>\n\n\n

\n
\"\"
Trailing spaces allow attackers to abuse Windows\u2019s folder name handling<\/em> <\/figcaption><\/figure><\/div>\n\n\n

In the analysis, the malicious alpha.pif (a Portable Executable file) bypassed UAC by creating fake directories like \u201cC:\\Windows \u201c (note the empty space), exploiting Windows\u2019s folder name handling to gain elevated privileges. <\/p>\n\n\n\n\n

\n\n

\nGet extra sandbox licenses for your team as a gift
Take advantage of ANY.RUN’s special offers<\/span> before May 31  \n<\/p>\n\n\nSee all offers\n<\/a>\n<\/div>\n\n\n\n