diff --git a/North Koreans APT/Stardust Chollima/README.md b/North Koreans APT/Stardust Chollima/README.md index e89940d..06e2a72 100644 --- a/North Koreans APT/Stardust Chollima/README.md +++ b/North Koreans APT/Stardust Chollima/README.md @@ -71,5 +71,19 @@ The dropper downloads and executes PowerRatankba in the background by useing (Ba Screenshot From 2025-07-27 17-47-46 +Breakdown of the Malicious Code Execution: +1. Automatic Execution: When the program starts, it automatically calls the function ExecuteBase64Script(), which is responsible for decoding + and executing the malicious payload. + +2. Base64-Encoded PowerShell Script: The program contains Base64-encoded data, which is often used to hide malicious commands from antivirus and + security software. + +3. Execution with Unrestricted Policy: The PowerShell script is executed with bypassed execution policy (-ExecutionPolicy Bypass), meaning it ignores any + security restrictions on running scripts. + + This is a known technique used by attackers to execute unauthorized PowerShell commands without user consent. + +4. Decoding and Writing to File: The Base64 string is decoded and saved as a PowerShell script file named "PowerRatankba.ps1" + which is then used as the attack payload.