The article "UAC-0184 Malware Chain Uses bitsadmin and HTA Files for Gated Payload Delivery" discusses a sophisticated malware campaign that leverages legitimate Windows tools, such as bitsadmin, to deliver malicious payloads. Here are the key points:
Overview of the Campaign
- Malware Name: UAC-0184
- Initial Vector: Malicious HTA (HTML Application) files disguised as PDFs, Word documents, or Excel files.
- Delivery Mechanism: Uses
bitsadminto download and execute malicious payloads.
Technical Details of the Attack
Initial Infection Vector:
- The attackers use social engineering tactics to trick users into downloading malicious HTA files that appear legitimate (e.g., as PDFs, Word documents, or Excel files).
- Once executed, these HTA files download additional components using
bitsadmin.
Payload Delivery:
- BITSAdmin: A Windows utility used for background file transfers. The attackers use this tool to download and execute malicious payloads in the background without user interaction.
- Stage 1: Download of an initial payload ZIP archive from a C2 server.
- Stage 2: Extraction and execution of components within the
Read the full article at Cyber Security News
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.
6
Contents
Ali NematiWritten by Ali
