Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading

by Robin Dost A few months ago, I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a weaponized WinRAR archive.Of course, that wasn t it yet, we re going to keep tracking our friends, so let s go 🙂 The chain was relatively simple: Sample: 420f1931af9b3f7d02c5edfc78eb69abdad6e71d2c3e9b81f9cbc3823a503654 The sample discussed here follows the same general idea, but the [ ] The…