External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2025-08-27 02:46:17 -04:00
committed by GitHub
parent 6c00c0f307
commit d520e3a92e
1 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
North Koreans APT/Ricochet Chollima/README.md
+2 -4
View File
@@ -63,13 +63,11 @@ After using WinRAR to compress the file, I will create a shortcut to this file a
Because I put the command line in the setup (Run after extraction) menu in the Advanced SFX options of the WinRAR program, now when the victim opens the ZIP file to view the images, they also see an HWP document containing a letter addressed to North Korean soldiers deployed to Russia. Because I put the command line in the setup (Run after extraction) menu in the Advanced SFX options of the WinRAR program, now when the victim opens the ZIP file to view the images, they also see an HWP document containing a letter addressed to North Korean soldiers deployed to Russia.
https://github.com/user-attachments/assets/45420912-5110-49eb-b64a-531410459f94 https://github.com/user-attachments/assets/45420912-5110-49eb-b64a-531410459f94
## The fourth stage (Toy.bat - shellcode)
When the PowerShell command in “toy03.bat” executes, it loads the “toy02.dat” file created in the temporary folder to function as a loader; the embedded PowerShell within “toy02.dat” then runs and loads “toy01.dat” from the same folder, during which XOR transformed data is decoded and mapped into memory and a new thread is spawned; as a result, the shellcode is placed in memory and the region is made executable, after which another thread is created to run the memory-resident code constituting a fileless technique for dynamic code execution and runtime malware injection.