ThreatLabz

This report provides a technical analysis of the MoonWalk backdoor (deployed via the DodgeBox loader) outlining its modular architecture, evasion techniques (DLL hollowing, DLL unhooking, call stack spoofing, Windows Fibers), and a covert Google Drive-based C2 using a custom encrypted protocol and ECDH/AES handshake. The analysis documents configuration storage, embedded plugins (C2 and utility), filepaths and OAuth-related credentials in configuration, the custom encoding/encryption scheme for exchanged files, and built-in handlers such as token impersonation and remote command execution, noting similarities to tools attributed to APT41.