Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Key Findings
• A targeted cyber-espionage operation against Bangladesh's military and defence establishment.
• Initial access: a spear-phished RTF weaponised as the biography of a Bangladesh Air Force officer.
• The RTF pulls a malicious VBA macro via remote template injection; server-side geofencing restricts delivery to victims in the target region.
• The macro injects architecture-aware shellcode into the host process through callback-based API abuse.
• Shellcode executes in chained XOR-encoded stages, each fetching and decoding the next from the same C2 domain under rotating file extensions (.ico, .mp3, .doc) to blend with normal traffic.
• The final stage drops a DLL implant that establishes scheduled-task persistence disguised as OneDrive telemetry, profiles the host, and beacons to a secondary C2 over HTTPS using AES-128-CBC.
• The C2 protocol runs a two-phase handshake: the implant registers with encrypted host data (CPU, OS version, hostname, installed software), and the server gates payload delivery on that profile.
• By engaging the delivery endpoint directly, the team pulled a live second-stage DoNot module (ejtest.dll) from active C2 infrastructure.
• The module's hardcoded AES key material is byte-for-byte identical to keys documented in independent DoNot (APT-C-35) research.
Article Link: DoNot (APT-C-35) Intrusion Targeting Bangladesh Military Personnel