Docless Vietnam APT. A very interesting malware against Vietnam Government

guest · Apr 16, 2019

We have detected a malware sent to some email accounts belonging to a Vietnam government domain.

The attached file resulted in a very interesting infection system. It uses a combination of techniques never seen before, making us think about a very targeted campaign, using interesting resources to specifically infect Vietnam government.
Although it may look typical, the schema hides some very smart techniques to avoid detection and fool the system.
Docless DOC with three stages
Inside the ZIP there is no actual file. Instead, we can find a link file with .lnk extension that simulates a document icon. [...] The target contains MS-DOS obfuscated code to compose itself. [...] The result (using a technique called "carving") will be a PS file, base64 encoded, saved in %TEMP% variable [...]
Click to expand...

It hides even more surprises to stay stealth. All technical details in the following report.

New Research: Docless Vietnam APT from ElevenPaths
This malware uses some very interesting techniques that, if not new, are not common, and even less used altogether in a single attack.
Click to expand...

Log in or Sign up

Docless Vietnam APT. A very interesting malware against Vietnam Government

guest Guest

Log in or Sign up

Docless Vietnam APT. A very interesting malware against Vietnam Government

guest Guest

Useful Searches