A new MuddyWater APT campaign spreads Backdoor RAT

Fri, 11 Jan 2019 22:00:00 +0530

MuddyWater is an APT group that has been active throughout 2017, targeting victims in the Middle East with in-memory vectors leveraging PowerShell.

In October 2018, Kaspersky Lab published a good analysis report on the malware by this APT group.

Here I am publishing my analysis report on recent malware by this APT group which targeted several parts of the Middle East.

Sample - 8899c0dac9f6bb73ce750ae7b3250dbd (Virustotal)

References :

The document has obfuscated macro code which contains encrypted binary data. On execution, it decrypts the data, drops files and executes them.

MuddyWater on Melted in Hex