kienmanowar.wordpress.comPublished
[QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis
Excerpt
Rate This
Sample: 32-bit Windows shellcode, position-independent (decoded and loaded via SolidPDFCreator.dll – see Campaign 3 DLL report)
Family: Mustang Panda ToneShell (APT tracking: S1239 / Hive0154 / Earth Preta)
Note on the ToneShell similarity: It is a ToneShell variant – Mustang Panda’s own backdoor family. The 0xC85E31 constant is a coincidence in the DJB2 hash variant chosen by both authors; all other characteristics (256-byte XOR key, HMAC key persistence, WebSocket transport, WinHTTP-as-C2) are ToneShell-native. An…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by kienmanowar.wordpress.com on kienmanowar.wordpress.com.
Mentioned in the excerpt
More from kienmanowar.wordpress.com2
- Quick analysis note about DealPly (Adware)kienmanowar.wordpress.com · Published 11 May 2021
- Manual Unpacking IcedID Write-upkienmanowar.wordpress.com · Published 16 Aug 2020
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
