Infostealer Disguised as Adobe Reader Installer

AhnLab ASEC identified an Infostealer campaign delivering a malicious executable (Reader_Install_Setup.exe) masquerading as an Adobe Reader installer; users are lured via a Portuguese PDF and a GitHub raw download link. The installer creates require.exe and a malicious BluetoothDiagnosticUtil.dll, then abuses msdt.exe to run sdiagnhost.exe which loads the malicious DLL (DLL hijacking) enabling a UAC bypass; require.exe contacts C2 servers (blamefade.com.br and thinkforce.com.br), creates a hidden chrome.exe that collects system and browser data, and adds files to Defender exclusions. The report includes MD5 hashes, detection names, behavior details, and IOCs for detection and response.