The report analyzes APT28’s sophisticated HTA Trojan and its cyber espionage activities in Central Asia, particularly Kazakhstan. It delves into the Trojan’s advanced obfuscation techniques, including encoding methods used by Windows vbscript.dll and the properties of its loader. The analysis highlights various layers of complexity involved in decoding the malware and emphasizes its ongoing threats to cybersecurity. Affected: APT28, Kazakhstan, Central Asia, cybersecurity sector
Keypoints :
- APT28 conducts cyber espionage particularly focusing on Kazakhstan and Central Asia.
- This report follows up on previous findings regarding the HATVIBE and CHERRYSPY infection chains.
- Deep technical analysis using x32dbg debugging to understand the HTA Trojan’s obfuscated code.
- Utilization of ‘@#@’ to split obfuscated strings within the malware code.
- Registry EDI is used to navigate and decode obfuscated strings in the malware.
- Identified that the characters within the Trojan are chosen randomly and decoded character by character.
- Obfuscated strings are encoded using the VBE technique, which makes them harder to understand.
- A Python script is utilized for deobfuscation of the encoded files.
- The document includes various malware hashes for identification and tracking purposes.
- Findings highlight APT28’s evolving tactics in cyber espionage and their implications for digital security.
MITRE Techniques :
- T1027 – Obfuscated Files or Information: APT28 uses obfuscation techniques such as string splitting and encoding to conceal malicious code.
- T1071 – Application Layer Protocol: The malware may use common application layer protocols to communicate with its C2 servers.
- T1203 – Exploitation for Client Execution: The HTA Trojan exploits user interactions to execute malicious content.
Indicator of Compromise :
- MD5 Hash: d0c3b49e788600ff3967f784eb5de973
- SHA256 Hash: 332d9db35daa83c5ad226b9bf50e992713bc6a69c9ecd52a1223b81e992bc725
- MD5 Hash: 690fe881d288167fde157c6fb834c3ef
- SHA256 Hash: 0fa7e3ffb8a9ca246cc1f1e3f6118ced7a7b785de510d777b316dfcefdddb0be
- MD5 Hash: 2505649df3f33cf3b65059d338e3dd6f
Full Story: https://malwareanalysisspace.blogspot.com/2025/03/deobfuscating-apt28s-hta-trojan-deep.html