This is very good malware.
This is solid-solid-SOLID B+ malware, very close to A- malware.
APT37 is using a old-school playbook. They're doing EPO (Entry Point Obfuscation) on a self-delivered binary for evasion. They also unironically are using something akin to cavity infection ... but on themselves. This is something you saw more in the Windows 95 - Windows XP era, not something you see in 2026.
Very cool. I respect it.
The multi-staged fragmentation of shellcode phases is also really, really, really cool. This is (once again) a more old-school technique usually reserved for infected binaries, not self-delivered binaries.
Despite all of these super cool features, APT37 shoots themselves in the foot immediately.
- EAT walking for Kernel32 functionality (???)
- XOR decryption is a huge red flag
- Allocating with PAGE_EXECUTE_READWRITE (???)
- Hardcoded OAuth token (???)
- Used external dependency for AES (???)
Why not use NT functionality to hook evasion? XOR is easily identified in static analysis, why XOR? Allocating memory with VirtualAlloc with RWX is a MASSIVE RED FLAG. They also hardcode a OAuth token ... they can multi-staged shellcode payload with old-school malware techniques but hardcore AN OAUTH TOKEN?
It unironically makes me wonder if they had one old-head malware guy working on it, then they had some newer dude do the non-hardcore stuff. There is a huge gap in skill sets here.
Or the old-head hasn't kept up to date on malware stuff since 2005... or they got lazy... I don't know, really weird.
🎉🎉 Celebrating Success! Airtel's Live Bug Bounty Triumph at nullcon Goa 🛡️
Huge shoutout to the talented ethical hackers and security experts who made this event a tremendous success. Your dedication to cybersecurity is truly commendable. 🙌👏 #nullconGoa#BugBounty#Airtel
😎For the past 3 editions, Airtel has been a strong supporter!
👊Super thrilled to welcome @airtelindia as our 🥈Silver Sponsor with a new identity
Keep an eye out on Live bug bounty 💰https://t.co/kqTyO6slg4
#NullconGoa2023#Infosec#Conference
Calling all security enthusiasts, bug bounty seekers, and researchers.
A live bug bounty competition is being held by Bharti Airtel at @nullcon Goa-2023 @antriksh_s@rahul_gehlaut@airtelindia
register here: https://t.co/Xf9Ua2myJP
😎For the past 3 editions, Airtel has been a strong supporter! 👊Super thrilled to welcome back Airtel @airtelindia as our 🥈Silver Sponsor
Keep an eye out on Live bug bounty 💰https://t.co/kqTyO6rNqw
#NullconGoa2023#Infosec#Conference