Tool
tool:vba32_antirootkit_scanner
Also: vba32arkit.exe
Legitimate anti-rootkit scanning software whose signed executable was abused through DLL side-loading.
Legitimate anti-rootkit scanning software whose signed executable was abused through DLL side-loading.
“turned out to be a legitimate software called Vba32 AntiRootkit Scanner”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Cloud Hopper | Explicit | 103 |
Cloud Hopper USES Vba32 AntiRootkit Scanner
A legitimate Vba32 AntiRootkit Scanner binary was used in the DLL side-loading mechanism and connected to command-and-control infrastructure.
Explicit Confidence 97% · Fabio Viggiani EP 103 Details
“The name of the process was vba32arkit.exe”
“turned out to be a legitimate software called Vba32 AntiRootkit Scanner”