Under the Hood of BlotchyQuasar: DLL-Based RAT Campaigns Against Latin America

TL;DR

This paper analyzes a sophisticated DLL side-loading malware campaign targeting Latin America, which uses deception and multi-stage infection to steal sensitive data and establish persistence, highlighting its threat to regional cybersecurity.

Contribution

It uncovers the mechanisms of the BlotchyQuasar RAT campaign, detailing its DLL hijacking technique, infection process, and malicious capabilities, emphasizing its rapid development and regional impact.

Findings

Uses DLL side-loading to bypass security defenses

Steals browser credentials and banking info

Establishes persistence via registry modifications

Abstract

A sophisticated malspam campaign was recently uncovered targeting Latin American countries, with a particular focus on Brazil. This operation utilizes a highly deceptive phishing email to trick users into executing a malicious MSI file, initiating a multi-stage infection. The core of the attack leverages DLL side-loading, where a legitimate executable from Valve Corporation is used to load a trojanized DLL, thereby bypassing standard security defenses. Once active, the malware, a variant of QuasarRAT known as BlotchyQuasar, is capable of a wide range of malicious activities. It is designed to steal sensitive browser-stored credentials and banking information, the latter through fake login windows mimicking well-known Brazilian banks. The threat establishes persistence by modifying the Windows registry , captures user keystrokes through keylogging , and exfiltrates stolen data to a Command-and-Control (C2) server using encrypted payloads. Despite its advanced capabilities, the malware code exhibits signs of rushed development, with inefficiencies and poor error handling that suggest the threat actors prioritized rapid deployment over meticulous design. Nonetheless, the campaign extensive reach and sophisticated mechanisms pose a serious and immediate threat to the targeted regions, underscoring the need for robust cybersecurity defenses.