标题： BlotchyQuasar的内部情况：针对拉丁美洲的基于DLL的RAT活动 显示英文标题

标题： Under the Hood of BlotchyQuasar: DLL-Based RAT Campaigns Against Latin America

摘要： 最近发现了一种复杂的恶意软件垃圾邮件活动，针对拉丁美洲国家，特别是巴西。 该操作利用高度欺骗性的钓鱼电子邮件，诱使用户执行恶意的MSI文件，从而引发多阶段感染。 攻击的核心利用了DLL侧加载技术，使用来自Valve公司的合法可执行文件来加载被篡改的DLL，从而绕过标准安全防御。 一旦激活，该恶意软件是一种名为BlotchyQuasar的QuasarRAT变种，能够进行广泛的恶意活动。 它旨在窃取存储在浏览器中的敏感凭证和银行信息，后者通过模仿知名巴西银行的虚假登录窗口实现。 该威胁通过修改Windows注册表实现持久性，通过键盘记录捕获用户按键，并通过加密有效载荷将被盗数据发送到命令与控制（C2）服务器。 尽管其具有先进的功能，但恶意软件代码显示出匆忙开发的迹象，存在效率低下和错误处理不佳的问题，这表明威胁行为者更注重快速部署而非细致设计。 然而，该活动的广泛影响和复杂机制对目标地区构成了严重且紧迫的威胁，突显出需要强大的网络安全防御。 显示英文摘要

摘要： A sophisticated malspam campaign was recently uncovered targeting Latin American countries, with a particular focus on Brazil. This operation utilizes a highly deceptive phishing email to trick users into executing a malicious MSI file, initiating a multi-stage infection. The core of the attack leverages DLL side-loading, where a legitimate executable from Valve Corporation is used to load a trojanized DLL, thereby bypassing standard security defenses. Once active, the malware, a variant of QuasarRAT known as BlotchyQuasar, is capable of a wide range of malicious activities. It is designed to steal sensitive browser-stored credentials and banking information, the latter through fake login windows mimicking well-known Brazilian banks. The threat establishes persistence by modifying the Windows registry , captures user keystrokes through keylogging , and exfiltrates stolen data to a Command-and-Control (C2) server using encrypted payloads. Despite its advanced capabilities, the malware code exhibits signs of rushed development, with inefficiencies and poor error handling that suggest the threat actors prioritized rapid deployment over meticulous design. Nonetheless, the campaign extensive reach and sophisticated mechanisms pose a serious and immediate threat to the targeted regions, underscoring the need for robust cybersecurity defenses.