0x3obad.github.ioPublished
MustangPanda New Backdoor LotusLite
Excerpt
LotusLite in nutshell
Chinese state-sponsored APT Mustang Panda has added a new undocumented C++ backdoor LotusLite to its arsenal targets the financial sectors in India , South Korea and U.S . The analyzed sample is a fully-featured Windows backdoor DLL disguised as a WPS Office component. Upon execution it silently installs itself under C:\ProgramData\WKwpsOffice2\ , establishes registry-based persistence, and enters a perpetual C2 beacon loop. The operator gains an interactive reverse shell, full filesystem access, and file staging capabilities. The malware employs multiple anti-analysis techniques including dynamic API resolution, runtime string decryption, sandbox evasion via command…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by 0x3obad.github.io on 0x3obad.github.io.
Mentioned in the excerpt
More from 0x3obad.github.io1
- PlugX : Mustang Panda APT0x3obad.github.io · Published 27 Mar
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
