From a7597637ef8dd286164389ac866138203e69b1d4 Mon Sep 17 00:00:00 2001 From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com> Date: Sun, 27 Jul 2025 17:52:57 -0400 Subject: [PATCH] Update README.md --- North Koreans APT/Stardust Chollima/README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/North Koreans APT/Stardust Chollima/README.md b/North Koreans APT/Stardust Chollima/README.md index e89940d..06e2a72 100644 --- a/North Koreans APT/Stardust Chollima/README.md +++ b/North Koreans APT/Stardust Chollima/README.md @@ -71,5 +71,19 @@ The dropper downloads and executes PowerRatankba in the background by useing (Ba Screenshot From 2025-07-27 17-47-46 +Breakdown of the Malicious Code Execution: +1. Automatic Execution: When the program starts, it automatically calls the function ExecuteBase64Script(), which is responsible for decoding + and executing the malicious payload. + +2. Base64-Encoded PowerShell Script: The program contains Base64-encoded data, which is often used to hide malicious commands from antivirus and + security software. + +3. Execution with Unrestricted Policy: The PowerShell script is executed with bypassed execution policy (-ExecutionPolicy Bypass), meaning it ignores any + security restrictions on running scripts. + + This is a known technique used by attackers to execute unauthorized PowerShell commands without user consent. + +4. Decoding and Writing to File: The Base64 string is decoded and saved as a PowerShell script file named "PowerRatankba.ps1" + which is then used as the attack payload.