UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos

by Robin Dost Malware: HijackLoader / IDATLoader - Remcos Agent 7.1.0 ProActor tracking: UAC-0184 / MB-0005Related analysis: UAC-0184: From HTA to a Signed Network StackA YARA rule for this sample is available on request: contact@robin-dost.de. In my previous UAC-0184 analysis, I documented a loader chain built around a legitimate Plane9 application, several local payload containers [ ] The post…