Deobfuscating APT28’s HTA Trojan: A Deep Dive into VBE Techniques & Multi-Layer Obfuscation
Summary I have recently noted that APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations, and the report from sekoia.io , the third part of the report referring to HATVIBE and CHERRYSPY infection chain, which related to another report from CERT-UA , attracted me to the extension. That sample is heavily obfuscated, so here it is, for this analysis, we will focus on doing deep dive with x32dbg debugging. Base on the last report title “ Unveiling APT28’s Advanced Obfuscated Loader and HTA Trojan: A Deep Dive with x32dbg Debugging” posted in 2025.02.25, But now on this report I will make a further process into the algorithm that decodes APT28’s HTA Trojan; it is very interesting to dive deeper inside. In brief, I am so excited to see what’s happened and what evasion technique it used. Technical analysis The sample HASH md5 d0c3b49e788600ff3967f784eb5de973 Sha256: 332d9db35daa83c5ad226b9bf50e992713bc6a69c9ecd52a1223b81e992bc725 ...