RemotePE

The malware supports extensive post-compromise functionality through multiple command classes: ... Command execution ...

IConsole ... Function ID 2 Execute a command and return its output

The first is HellsGate (specifically the TartarusGate variant), a technique that dynamically resolves Windows syscall numbers at runtime... Using these direct syscalls, RemotePELoader iterates the Process Environment Block’s module list and remaps each DLL...

“RemotePE also implements a plugin system that allows the operator to dynamically register DLL payloads at runtime.”

IProcess ... 3 Create a process 4 Create a process as a user

While sleeping, RemotePE also checks for the existence of a Windows event named 554D5C1F-AABE-49E4-AB57-994D22ECED28. If present, it wakes immediately and restarts both controller threads.

IProcess ... 3 Create a process 4 Create a process as a user

While sleeping, RemotePE also checks for the existence of a Windows event named 554D5C1F-AABE-49E4-AB57-994D22ECED28. If present, it wakes immediately and restarts both controller threads.

The first is HellsGate (specifically the TartarusGate variant), a technique that dynamically resolves Windows syscall numbers at runtime.

`decrypt_c2_message` decodes a base64 blob, derives a key and nonce, and uses `AES.new(key, AES.MODE_GCM, nonce)` to decrypt the ciphertext from the `C2Message` structure.

network packets utilize HTTP cookie names that mimic the Microsoft ecosystem. For instance, headers incorporate fields like MSCC and MicrosoftApplicationsTelemetryDeviceId to appear authentic.

Before contacting its command-and-control server, it removes security hooks placed by endpoint protection products and disables Windows event tracing, allowing the malware to operate with little or no visibility to defenders.

RemotePE also implements secure file deletion functionality by repeatedly overwriting files seven times prior to deletion, behavior previously associated with Lazarus-linked malware families such as PondRAT and POOLRAT.

On the first run it sleeps until the configured wake-up timestamp and on subsequent iterations it sleeps for a random interval within the configured bounds.

It filters out legitimate Microsoft Cabinet files by checking for the MSCF magic bytes and decrypts remaining files larger than 50 KiB using DPAPI before reflective loading through the open-source libpeconv library.

The malware supports extensive post-compromise functionality through multiple command classes: ... Process creation and termination ...

RemotePE supports various commands, including C2 configuration management, file operations, process manipulation, and self-management.

On the first run it sleeps until the configured wake-up timestamp and on subsequent iterations it sleeps for a random interval within the configured bounds.

The malware supports extensive post-compromise functionality through multiple command classes: ... ZIP compression and exfiltration

The script defines a `CabinetStream` structure with `compressed_buf` and uses `decompress_mszip` with zlib to decompress the command output after decryption.

It then initiates an encrypted HTTP communication loop with remote servers.

C2 communications occur over HTTP POST requests using specially crafted cookie fields designed to resemble legitimate Microsoft telemetry traffic.

RemotePELoader, the second-stage component responsible for retrieving the final RemotePE RAT from attacker-controlled infrastructure... Once the operator initiates payload delivery, the server returns an AES-GCM encrypted and Base64-encoded PE payload that is decrypted and reflectively loaded directly into memory.

All messages exchanged with the C2 server are AES-encrypted, except for the initial check-in response containing the session ID.

The malware supports extensive post-compromise functionality through multiple command classes: ... ZIP compression and exfiltration

DPAPILoader uses the Windows Data Protection API (DPAPI) to decrypt its payload... each deployment produces a unique encrypted blob, meaning the payload hash differs across victims and evades hash-based detection.

IProcess ... 1 Kill process by ID

The malware employs evasion techniques like Hell's Gate and patches Event Tracing for Windows (ETW) to avoid detection.

The attack followed a pattern increasingly common in Lazarus operations, social engineering via Telegram, with operatives posing as employees of a legitimate trading firm, scheduling fake meetings through spoofed Calendly and Picktime domains to gain initial access to a victim’s device.