Security News > 2022 > February > Cybercriminals Swarm Windows Utility Regsvr32 to Spread Malware

A Windows living-off-the-land binary known as Regsvr32 is seeing a big uptick in abuse of late, researchers are warning, mainly spreading trojans like Lokibot and Qbot.

In this case, Regsvr32 is aMicrosoft-signed command line utility in Windows that allows users to register and unregister libraries.

Malicious use of Regsvr32 has been cresting of late in the Uptycs telemetry, researchers warned, with cybercrooks specifically attempting to register.

"The Uptycs Threat Research team has observed more than 500+ malware samples using Regsvr32.exe to register [malicious].OCX files," researchers warned.

"During our analysis of these malware samples, we have identified that some of the malware samples belonged to Qbot and Lokibot attempting to execute.OCX files97 percent of these samples belonged to malicious Microsoft Office documents such as Excel spreadsheet files."

Look for parent/child process relationships where Regsvr32 is executed with parent process of Microsoft Word or Microsoft Excel;.

News URL

https://threatpost.com/cybercriminals-windows-utility-regsvr32-malware/178333/