is a malicious archive associated with a sophisticated spear-phishing campaign targeting high-profile organizations . It typically contains a multi-stage loader designed to bypass traditional security defenses and deploy final payloads like information stealers or remote access trojans (RATs). Overview of the Infection Chain
: Educate employees on the dangers of downloading files from unsolicited links, even if the hosting service (like Google Drive) appears legitimate.
: DAHALO.rar , DAHALO_Update.rar , or localized variations targeting specific departments (e.g., Finance_Report.rar ).
: The malware often creates a scheduled task or modifies registry run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run ) to ensure it remains active after a system reboot.
: Often uses a double extension (e.g., Project_Specs.pdf.lnk ) and executes a hidden command that launches mshta.exe or powershell.exe to run a remote script.
: Once downloaded and extracted, the RAR file typically reveals a shortcut file ( .LNK ) or a heavily obfuscated script (VBScript or PowerShell) disguised as a document.
: Restrict the download of .rar , .7z , and .lnk files from external email sources or unknown web domains.