All articles tagged as:


Analysis of APT28 hospitality malware (Part 2)

In the first part of this malware review, we looked at the VBA code used by APT28 to drop a DLL onto the victims' machine as part of their recently highlighted hospitality campaign. In this post, we will look at the dropped file, and understand just what it does, and how we can analyse it using IDA Pro. So we know from the first post that we have a DLL, which is run using the following command: rundll32.exe %APPDATA%\user.dat,#1 Loading the extracted DLL into IDA, the first thing that we notice is that we have an exported function of load with an ordinal of 1: We know from the rundll32.exe com…

Read more »