2022-07-08_ìì_ëì_ë³ê³ìíìì_ìëìíë_ììí_ëëí¼_ììì½ë.pdf (2 MB)

Hauri analyzed a dropper disguised as an ipTIME router firmware update that displayed a fake upgrade window while executing malicious activity in the background. The malware decrypted embedded data, created a mutex named like a Windows update artifact, wrote a payload under the user's roaming application-data path, and launched it through regsvr32.exe. It also opened iptime.com with Explorer for deception and communicated with a command-and-control server to conduct additional malicious actions.