BOFの実行などに対応した新たなマルウェアSLOTAGENT

IIJ identified and analyzed a multifunctional remote access trojan (SLOTAGENT) found in a public malware repository. The report describes the loader and shellcode (reflective loading, RC4/XOR decryption), API hashing and string encryption anti-analysis techniques, the custom TCP C2 protocol to 43.156.59.110:699, an extensive set of remote commands (including BOF execution, timestomping, memory dumping, file transfer and remote shell), and supplies IoCs (SHA256 hashes, C2 IP) plus YARA rules for detection.