External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2026-07-29 07:18:45 -04:00
committed by GitHub
parent f7f5575c7c
commit 00a68b8a5e
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Iranian APT/Charming Kitten/README.md
+3
View File
@@ -49,6 +49,9 @@ These operations demonstrate the group’s continued reliance on social engineer
## The second stage (Malicious VBA Macro with Conditional Download and Execution) ## The second stage (Malicious VBA Macro with Conditional Download and Execution)
A special thanks to **[Mohamed Montaser](https://www.linkedin.com/in/m-montaser?utm_source=share_via&utm_content=profile&utm_medium=member_android)** for his valuable contribution to this adversary simulation project. He was responsible for developing and refining the VBA macro components used throughout this simulation. His expertise and contributions played an important role in making this project possible.
**Sub `love_me_____()`:** **Sub `love_me_____()`:**
Acts as the primary controller for the entire macro, coordinating the payload workflow from start to finish. The routine begins by decoding an obfuscated file path from a hexadecimal string, concealing the actual location until runtime to reduce static detection. It then checks whether the target payload already exists on the system. If the file is found, the macro immediately transfers execution to the execution routine. If the file is not present, it invokes the download routine to retrieve the payload before executing it. This conditional logic allows the macro to support both first-time infections and subsequent executions without downloading the payload multiple times. Acts as the primary controller for the entire macro, coordinating the payload workflow from start to finish. The routine begins by decoding an obfuscated file path from a hexadecimal string, concealing the actual location until runtime to reduce static detection. It then checks whether the target payload already exists on the system. If the file is found, the macro immediately transfers execution to the execution routine. If the file is not present, it invokes the download routine to retrieve the payload before executing it. This conditional logic allows the macro to support both first-time infections and subsequent executions without downloading the payload multiple times.