in2al5d p3in4er is Almost Completely Undetectable

MITRE Techniques

• [T1566.003] Phishing: Spearphishing via Service – Threat actors take over popular YouTube accounts and post videos with links to malicious websites. [‘Threat actors take over popular YouTube accounts and post videos with links to malicious websites.’]
• [T1036] Masquerading – Fake decoy websites look identical to original sites with similar URLs, logos, and branding. [‘The decoy websites look identical to the original websites.’]
• [T1497] Virtualization/Sandbox Evasion – Anti-VM checks using graphics vendor IDs to decide execution path. [‘The anti-VM function checks the graphics vendor ID.’]
• [T1055.012] Process Hollowing – Payload is decrypted and injected into sihost.exe via a process hollowing technique. [‘injects it into sihost.exe using a process hollowing technique.’]
• [T1027] Obfuscated/Deobfuscated Files and Information – Payload decrypted in chunks and Win APIs resolved dynamically with a XOR key ‘in2al5d p3in4er’. [‘resolve necessary Win APIs dynamically and decrypt these names using a XOR key: “in2al5d p3in4er”‘]
• [T1071.001] Web Protocols – Loader communicates with C2 infrastructure (Aurora) via IPs/ports (e.g., 45.15.156.182:8081). [‘C2 – Aurora’ and remote IPs on port 8081.]