DBatLoader Distributed via CMD Files

AhnLab ASEC reports discovery of DBatLoader (ModiLoader) being distributed via compressed CMD files attached to phishing emails; attackers hide a Base64-encoded EXE inside a UTF-16LE CMD, leverage extrac32.exe and certutil -decodehex (with forced types) to produce and execute a .pif, and then load a Delphi-based EXE that loads a DLL and retrieves additional payloads. The report includes detection names, MD5 hashes, and mitigation recommendations (email caution, AV updates, OS/browser patches).