A StealthMutant sample that uses AES-256-ECB for decryptionįigure 4. Most of the StealthMutant samples we have observed use AES-256-ECB to decrypt their payloads, but we have also found older versions of this loader that use XOR instead.įigure 3. Like StealthVector, StealthMutant can disable ETW and go undetected by Windows’ built-in logging system. StealthMutant, a C# implementation of StealthVector, executes its payload by performing process hollowing, a technique widely used by both malicious actors and red teams.

The locations of StealthVector’s encrypted configuration and ChaCha20 key information StealthVector’s configuration is difficult to decrypt because the loader is encrypted with the ChaCha20 routine and a fixed custom initial counter.įigure 2.

It can be configured to uninstall itself, run its payload in a specific location, avoid detection by disabling Event Tracing for Windows (ETW), and perform username checking for context awareness. StealthVector, a shellcode loader written in C/C++, has various configurable features that malicious actors can easily implement without changing its source code. The loaders: StealthVector and StealthMutant Our analysis indicates that Earth Baku employs previously unidentified pieces of malware in this campaign: two shellcode loaders, which we have named StealthVector and StealthMutant, and a backdoor, which we have dubbed ScrambleCross. Source: Trend Micro™ Smart Protection Network™ infrastructure New tools Countries affected by Earth Baku’s campaign, all in the Indo-Pacific region

Beku instal the new for apple