Cryptocurrency Lures & Pupy RAT: UTG-Q-010 Campaign

UTG-Q-010, a financially motivated East Asian APT, conducted a spear-phishing campaign targeting cryptocurrency enthusiasts and HR personnel by distributing a ZIP containing a malicious LNK that decrypts and drops an XOR-obfuscated loader DLL (faultrep.dll). The loader performs sandbox/VM checks, verifies internet connectivity, downloads and decrypts an encrypted payload (Pupy RAT), and uses DLL sideloading and in-memory/reflective execution to evade detection; the report includes detailed technical analysis and IOCs (hashes, URLs, IP).