#APT37 - Most likely #GOLDBACKDOOR
ISO: 2cd04d9e11c6e458ec16db1ab810d625
LNK: be32725e676d49eaa11ff51c61f18907
The ISO file contains 2 LNK files, both inflated filesize.
The LNK drops a decoy file named 230401.hwp and 230401.bat
ISO: 2cd04d9e11c6e458ec16db1ab810d625
LNK: be32725e676d49eaa11ff51c61f18907
The ISO file contains 2 LNK files, both inflated filesize.
The LNK drops a decoy file named 230401.hwp and 230401.bat
Stage 1:
https://api.onedrive[.]com/v1.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBdTJteTF4aDZ0OFhnUjJNem1zOG5oUndvLTZCP2U9akhIQzZ5/root/content
dragon32[.zip - XOR encoded using the first-byte as a key.
c76fe6b56b4373138d5d3539c0c49587
https://api.onedrive[.]com/v1.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBdTJteTF4aDZ0OFhnUjJNem1zOG5oUndvLTZCP2U9akhIQzZ5/root/content
dragon32[.zip - XOR encoded using the first-byte as a key.
c76fe6b56b4373138d5d3539c0c49587
Possible next stage or just the ability to download additional files. Payload might be gone already ....
https://api.pcloud[.]com/getfilelink?path=/Program/41ED0C850E56A52E&forcedownload=1&skipfilename=1
https://api.pcloud[.]com/getfilelink?path=/Program/41ED0C850E56A52E&forcedownload=1&skipfilename=1
Upload:
https://api.pcloud[.]com/uploadfile?path=/Comment&filename=[snipped]&nopartial=1
The .TMP files are actually screenshots taken by the payload. They are uploaded to the C2. It seems able to upload sound / voice as well.
https://api.pcloud[.]com/uploadfile?path=/Comment&filename=[snipped]&nopartial=1
The .TMP files are actually screenshots taken by the payload. They are uploaded to the C2. It seems able to upload sound / voice as well.
More API endpoints in the loaded PE / Backdoor
Reference: github.com/blackorbird/AP…
Triage RUN: tria.ge/230404-hzalcaf…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
