APT36_Sindoor_Dropper_Linux_Dot_desktop_Phishing_Campaign

MITRE Techniques

• [T1566] Phishing – Use of spear-phishing .desktop attachments masquerading as PDFs to trick users into executing the malicious file: “The malicious .desktop file is crafted to appear harmless by masquerading as a legitimate document.”
• [T1204] User Execution – Relying on user to open the .desktop which launches decoy PDF while executing background payload: “Upon launch, the file opens a benign-looking decoy PDF … while a background process silently runs the obfuscated routines.”
• [T1574] Hijack Execution Flow – Restoring ELF magic bytes on the fly to make stripped binaries executable and evade platform scanning: “printf ‘x7FELF’ | dd of=mayuw bs=1 count=4 conv=notrunc”
• [T1027] Obfuscated Files or Information – Heavy obfuscation using Base64 and DES-CBC encryption of strings and payloads to evade static detection: “All strings are obfuscated using a combination of Base64 encoding and DES-CBC encryption.”
• [T1203] Exploitation for Client Execution (abuse of legitimate tools) – Using MeshAgent, a legitimate remote admin tool, repurposed for remote access and post-exploitation: “The final payload delivered … is a MeshAgent binary, a legitimate remote administration tool that has been repurposed for malicious use.”
• [T1490] Ingress Tool Transfer – Staged downloads from cloud hosting (Google Drive, Google Docs, Drive links) to deliver decoy and encrypted payload components: table of URLs showing multiple https://drive.google[.]com and docs.google[.]com links.
• [T1086] PowerShell? (not applicable) – (No PowerShell observed; included techniques reflect Linux-specific methods and dropper behavior.)