From 4f45305c75b8306cf0f248f897b7e50319a36793 Mon Sep 17 00:00:00 2001 From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com> Date: Sun, 27 Jul 2025 18:14:15 -0400 Subject: [PATCH] Update README.md --- North Koreans APT/Stardust Chollima/README.md | 24 ++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/North Koreans APT/Stardust Chollima/README.md b/North Koreans APT/Stardust Chollima/README.md index 06e2a72..b4aecda 100644 --- a/North Koreans APT/Stardust Chollima/README.md +++ b/North Koreans APT/Stardust Chollima/README.md @@ -69,7 +69,8 @@ This Stager is a graphical user interface (GUI) designed to look like a registra Processing Center, LTD." However, in reality, it contains malicious code that executes a hidden PowerShell script when run. The dropper downloads and executes PowerRatankba in the background by useing (Base64). -Screenshot From 2025-07-27 17-47-46 +Screenshot From 2025-07-27 17-47-46 + Breakdown of the Malicious Code Execution: @@ -87,3 +88,24 @@ Breakdown of the Malicious Code Execution: 4. Decoding and Writing to File: The Base64 string is decoded and saved as a PowerShell script file named "PowerRatankba.ps1" which is then used as the attack payload. + +## The third stage (PowerRatankba.ps1 - Backdoor) + +This PowerShell script is a reverse shell with persistence, meaning it allows an attacker to gain remote access to the +infected machine and ensures it runs every time the system starts. + +Screenshot From 2025-07-27 18-12-05 + +Once connected: + +1. waits for commands from the attacker. + +3. executes the commands on the victim’s machine. + +4. sends the command output back to the attacker. + + +Persistence (Runs at Startup): The script modifies the Windows Registry (Run key) to automatically start on reboot. +Every time the user logs in, the malicious script executes again, ensuring the attacker regains control. + +