Trojan:Win64/SnailResin.A!dha

Phishing and other social engineering techniques are utilized to provide intended targets with a ZIP file containing two malicious Dynamic Link Library (DLL) files and a benign executable file. The DLL file secur32.dll is a modified version of trojan loader SnailResin, while CoreUIComponent.dll is the SlugResin backdoor. Launching the EXE file loads secur32.dll, which leads to the creation of a staging directory, usually within %LOCALAPPDATA%, where all the files apart from secur32.dll are copied over. During the copying process, the EXE file is renamed to the legitimate file name FileCoAuth.exe, and the malicious binary CoreUIComponent.dll is renamed to secur32.dll for the second stage DLL search order hijacking activity. 

FileCoAuth.exe loads the newly renamed malicious binary secur32.dll resulting in a SlugResin backdoor and command-and-control (C2) connection. As a decoy to the malicious activity, the following activity occurs parallel to the second stage activity: The executable extracts essential.dat—an archive file containing a file also named with a name matching the initial EXE file and petition.jpg— to the desktop. Running the new EXE file launches the following popup message: Software extracted shortcut on desktop. The !dha suffix of the name denotes Dynamic Heuristics Analysis, which means this version of SnailResin is built with polymorphic properties and detection can only be successful with behavioral monitoring like registry manipulation and process injection.