来源:

https://app.any.run/tasks/3da796b4-041f-4d0b-9d44-7a00cb69b7e1

相关：

APT group: Promethium, StrongPity ，APT-C-41

Country：Turkey

样本时间：2021.3

基本信息：

md5,6D0FD5F76FBE861695B140828AAC6443

sha1,71B54D8219AB3A44AC434C41495C8D0DB62A7D3F

sha256,0E4651625ABDA88DF56952B7E97D7FB64A3E1EA97BFE01E931D47381C0952E98

description,Find and Mount Setup

file-type,executable

cpu,32-bit

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/c20e5b68-08f0-4f5c-adaa-83a9262958ac/Untitled.png

程序是一个伪造的安装包，原版软件是http://findandmount.com/。

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/dc74c4a7-d964-48b6-8a6c-5505821c3704/Untitled.png

获取临时目录，并且拼接上"ndaData",预备后续释放被控到这个目录。

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/5439a0bc-dcc5-4433-a190-613b708524a0/Untitled.png

从程序资源中提取数据

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/2c941d0b-24a3-4a8f-bbc3-b19de7df339c/Untitled.png