Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Latest research

Our Research

Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Welcome to our research page, where we provide you with the latest news, trends, and insights in the fast-paced world of tech. Join us on this exciting journey and discover the transformative power of technology today.

Home ResearchAnalysis of Suspected Mal...

Analysis of Suspected Malware Linked to APT-Q-27 Targeting Financial Institutions

12 minutes readFebruary 4 2026

Thieu Ha

Malware Researcher and Endpoint Defense

0 Views

DragonBreath with three head of dragon with three filetype extension

Đọc bản tiếng Việt tại đây

Overview

Context

In mid-January 2026, CyStack’s security team observed anomalous activity on a corporate customer’s environment. The signals were subtle: neither the end user nor endpoint controls such as antivirus raised an alert, and the evidence at that point did not meet the threshold for declaring an incident. For organizations where data integrity and trust are non‑negotiable, this kind of low-noise, high-impact intrusion path carries considerable risk.

Scoping and Investigation

Scoping narrowed the anomalous activity to a single workstation used by the customer support team. Prior to the event window, the user had clicked a link received through the support channel and, as a result, downloaded and executed a .pif file.

In practice, the .pif was an executable masked as a less familiar format and digitally signed as valid at the time it was distributed. This choice materially reduces suspicion during initial access and can help bypass reputation-based checks.

We then pivoted into artefact-led analysis across the affected host:

File system residues
Registry entries associated with logon/start-up behaviour
Windows service configuration
Process execution traces

The evidence points to a multi-stage targeted campaign. Techniques observed include staging payloads inside a directory designed to resemble a Windows Update cache, DLL sideloading, and in-memory execution of the final payload. The overall theme is consistent: reduce on-disk footprints, blend into expected system behaviour, and make retrospective detection harder.

Assessment

By the time the investigation concluded, we found no evidence that the malware had spread laterally to other systems in the same environment.

That said, the C&C infrastructure, the payload delivery pattern, and the modular backdoor design show notable overlap with previously published campaigns – particularly activity that QiAnXin Threat Intelligence has attributed to APT‑Q‑27 (GoldenEyeDog).

We cannot, on the basis of the available evidence, state definitively that this campaign is operated by APT‑Q‑27. However, the similarities are specific enough to warrant attention: naming conventions within the C2 infrastructure, a multi-stage architecture, payload storage inside log-like containers, and a plugin-based backdoor model. Taken together, these indicators suggest the campaign is likely part of the same broader tooling ecosystem, or at least built on shared frameworks and infrastructure that have been used over time.

⚠️ Disclaimer:

This publication is part of the cybersecurity research conducted by CyStack. It is intended strictly for educational and academic purposes, providing insights into security risks and vulnerability awareness. This report does not contain instructions for performing malware attacks or exploits.

All research findings have been disclosed to and authorized for publication by the affected organizations. Furthermore, to uphold ethical standards and privacy, all identifying details have been anonymized.

Attack Chain Overview

👤	User – Customer Support Department Receives link via Zendesk. Downloads & executes file.
⬇️	Dropper (Downloaded File) Connects to cloud. Downloads component loaders.
⚡	Loader Decrypts payload. Executes entirely in memory.
⚙️	Backdoor Establishes persistence (service). Connects to C&C. Receives commands / downloads modules.
📡	Maintain Presence & Remote Control Active connection established.

Detailed Technical Analysis

Initial access stage

The initial access vector was a URL delivered to an employee via a Zendesk ticket: hxxps://storage[.]googleapis[.]com/iwantuu/photo202512.pif#image2025-12-29-14-53.jpg

At a glance, the URL is crafted to look like it delivers a JPG image, by appending .jpg after the # character.

The critical detail is how URL fragments work:

Anything after # (the fragment identifier) is not sent to the server as part of the HTTP request. It is evaluated only client-side, usually for in-page navigation, and does not change which resource is actually fetched.

The downloaded file – referred to here as the Dropper – uses the .pif extension (Program Information File). While the format originates from MS‑DOS-era execution metadata, modern Windows still treats .pif as an executable type in Explorer, broadly comparable to .exe.

In many environments, file extensions are hidden by default. In that configuration, Explorer displays only the base name, which makes a .pif appear far less suspicious – particularly when it is presented as an “image” or “document”.

File dropper nguyên bản

Key characteristics of the Dropper:

.NET (C#)
Heavily packed/obfuscated
- Obfuscated function and variable names
- No critical strings stored as plaintext
- Runtime string decoding, mainly via:
  - Multi-layer Base64 for the FileList URI
  - Additional obfuscation of sensitive strings

Most notably, the Dropper was digitally signed and considered valid at the time it was distributed.

Chữ ký số giả mạo của dropper liên hệ đến DragonBreath

Signature heuristics shown that:

Certificate issued to Portier Global Pty Ltd
Hash algorithm: SHA‑256
Valid timestamp from a third-party timestamping service (SSL.com Timestamp)

Although the certificate was explicitly revoked by the time of analysis, the presence of a valid timestamp typically means:

Windows can still treat the signature as valid for the signing time
SmartScreen and several reputation checks are less likely to block the download at the time of delivery

Using a legitimate certificate that was once valid suggests access to a leaked certificate, or misuse of a certificate issued for another purpose. This is a common tradecraft choice in targeted intrusions and usually indicates a higher level of operational investment.

Dropper execution

On execution, the Dropper creates an HTTP client with:

A User-Agent randomly selected from the following three:
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/120.0.0.0
Standard headers (Accept, Accept-Language, Cache-Control)
Language values including en-US and zh-CN, consistent with reuse across multiple regions

The Dropper does not embed the primary payload. Instead, it performs staged retrieval:

1. Decodes a Base64 string to obtain the FileList URI

Code screen after decoding Base64

hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/updat.txt

2. Issues a GET request to the FileList URL to retrieve the required components

A browser screen with text that matched the information

Filename	MD5	Notes
updat.exe	64B07B1C385CF94A3559E323009F7641	Clean file, acts as the Loader
crashreport.dll	30917B5ABB991DF495827A9D7C7EBCBC	Malicious DLL with a digital signature
updat.log	543023ACE4F10B736C4C4109E005F0EF	Blob containing the main payload (compressed/encrypted)
vcruntime140.dll	4113057339D9E4E376BDED9074D20C17	Clean file
image.jpg	4DE8079431D85D3A37FD77FB26E8328F	Decoy file to legitimize the folder
msvcp140.dll	7E8BDD2C2304E204B44A3BEC09D66062	Clean file

3. Stores these files in a directory shaped to resemble a Windows Update cache path: C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsUpdate\\Cache\\WU_20251230_67e65f7b@27 . We refer to this directory as Staging.

A screen of Windows Explorer with multiple files inside

4. Marks the Staging directory with both Hidden and NotContentIndexed, reducing its visibility in normal browsing and excluding it from Windows indexing

CyStack Blog Image

5. Establishes temporary persistence via a Run key:

HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
SystemOptimizer = "<path_to_updat.exe> /minimized"

This ensures updat.exe (the Loader) runs at user logon. At this stage, persistence appears tactical – maintaining a foothold long enough to complete deployment – rather than an attempt at long-term durability.

CyStack Blog Image

The Dropper also includes options intended to remove traces, including the ability to delete the Run key above.

CyStack Blog Image

Loader execution

Within this chain, updat.exe functions as a signed, benign loader, while crashreport.dll provides the malicious loader stage. The DLL is named to match a dependency expected by updat.exe. As a result, the Windows loader preferentially loads crashreport.dll from the Staging directory, executing malicious code inside the context of a legitimate, signed process. The DLL is also signed by the same signer as the .NET component.

When crashreport.dll loads, execution passes through DllMain, which triggers the core loader logic:

The payload container name (updat.log) is not hardcoded. It is reconstructed at runtime using a simple XOR decode (0xAA) over a static byte array.
The loader opens updat.log, reads the full contents into memory, and decrypts the blob to recover the complete payload (shellcode plus PE data).
After decryption:

VirtualProtect is invoked to set the relevant memory region to PAGE_EXECUTE_READ
The payload entry point is called directly, transferring execution to the shellcode

Observed shellcode responsibilities:

Decompress the main payload into a PE image
Map the PE image into memory
Repair the import table
Dynamically resolve required APIs

The final, mapped PE is the operational Backdoor. It is decrypted and executed entirely in RAM (in-memory execution), which helps it evade many file-based detection and retrospective scanning techniques.

Backdoor execution

Anti-analysis and environment checks

Immediately after loading, the Backdoor performs a series of defensive checks:

1. Single-instance enforcement / run marker

Creates a mutex via CreateMutexA().
If GetLastError() == 183, an instance already exists, and the malware typically exits or changes execution flow.

2. Anti-debug

Calls IsDebuggerPresent().
If a debugger is detected, it exits.

3. Resource checks (sandbox avoidance)

The CPUandRamCheck() routine calls:

GetSystemInfo() (CPU cores ≥ 3)
GlobalMemoryStatusEx() (RAM ≥ 3 GB)

If the host does not meet these thresholds, the malware terminates – behaviour commonly used to avoid low-resource VM/sandbox environments.

CyStack Blog Image

Runtime decryption of C2 list

The Backdoor stores its C2 list in encrypted form and decrypts it at runtime, reducing exposure to static string scanning.
Decryption uses an XOR routine (sub_1001F582, byte-wise XOR over byte_10046160[...]).
Decrypted entries are in the format: <ip>:15628

CyStack Blog Image

Privilege handling

The Backdoor checks the current execution context:

If not running as Administrator, it re-launches itself elevated via ShellExecuteExA.
If already elevated, it proceeds to establish persistence (service creation) before enabling the rest of its operational logic.

Persistence via Windows Service

With administrative privileges confirmed, the Backdoor seeks long-term persistence using the Windows Service Control Manager (SCM), ensuring it can start automatically at boot and retain control after restarts.

It checks for a service named Windows EventN – a name chosen to blend in with legitimate Windows event-related services.

Persistence branches:

If the service does not exist:
- Creates a directory under the user profile: C:\\Users\\<User>\\Videos\\<random_string>@27
- Copies related executables into that location.
- Calls OpenSCManagerA() and CreateServiceA() to register a new service pointing to the deployed executable.
- Configures the service to start automatically.
If the service already exists:
- Checks service status and configuration.
- If auto-start is not set, updates configuration via ChangeServiceConfigA / ChangeServiceConfig2A.
- If the service exists but is stopped, restarts it and terminates the current process.

CyStack Blog Image

UAC policy changes

The Backdoor then attempts to reduce friction for future malicious activity by preventing UAC prompts.

It checks the OS version using GetVersionExA() and, if dwMajorVersion >= 6 (Windows Vista and later), modifies UAC-related policy keys:

HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System

Values modified including:

EnableLUA
ConsentPromptBehaviorAdmin
PromptOnSecureDesktop

The intended effect is to reduce or disable UAC prompts and allow follow-on processes/modules to execute in an elevated context without user interaction.

CyStack Blog Image

C2 communications and modular command handling

Only after persistence and privilege controls are in place does the Backdoor establish a connection to its C2 infrastructure.

On successful connection, it initialises a command dispatch table that maps command IDs to dedicated handlers/modules – consistent with a plugin-based architecture.

Observed modules include:

File operations
Screen capture / screen hiding
Keystroke logging
Shell execution
Placeholder modules awaiting later activation

This model allows attackers to switch capabilities on and off as needed and to extend functionality without replacing the main payload.

CyStack Blog Image

Relationship to Known Attack Campaigns

During extended analysis, we compared these technical indicators with publicly documented campaigns. A particularly relevant reference is QiAnXin Threat Intelligence’s reporting on APT‑Q‑27 (GoldenEyeDog).

Similarities in C2 naming

A standout overlap is naming. In the activity we analysed, C2 domains such as wk.goldeyeuu.io appear. The inclusion of “goldeye” in the domain aligns with naming patterns described in public reporting on GoldenEyeDog.

Similarities in C&C infrastructure

The decrypted C&C list includes IP addresses such as 192.252.182.53 and 27.124.41.140, and uses port 15628 – elements that have been referenced in prior public analyses. The geographic spread of infrastructure (including Hong Kong, Japan and the United States) also fits a common APT pattern of distributed hosting to improve resilience.

Similarities in payload handling

The use of a log-like file (updat.log) as an encrypted payload container, subsequently decrypted and executed purely in memory, matches payload-handling tradecraft described in APT‑Q‑27 reporting.

Backdoor architecture

The plugin-based design – mapping C&C command IDs to independent functional modules – looks far more like a maintained backdoor framework than opportunistic malware.

While attribution cannot be confirmed from these indicators alone, the overlaps across infrastructure, staging method and backdoor design strongly suggest shared tooling, shared development lineage, or a closely related ecosystem.

Recommendations for Enterprises

Based on the findings in this case, CyStack recommends the following priorities:

Proactive endpoint threat hunting focused on behaviours that signatures often miss: DLL sideloading, in-memory execution, legitimate processes behaving abnormally, and suspicious or unknown Windows services.
Incident response readiness to rapidly scope affected hosts, collect forensic artefacts, and isolate systems before stable C&C connections are established or lateral movement becomes possible.
Behaviour-based endpoint protection, rather than relying only on signatures or file reputation. Solutions such as CyStack Endpoint can monitor process behaviour, flag abnormal persistence, and intervene against previously unseen samples.
Contextual threat intelligence (infrastructure, TTPs and campaign linkage) to improve early detection and avoid purely reactive IOC-by-IOC response.
Review of non-traditional attack surfaces, particularly customer support channels and ticketing workflows where sophisticated social engineering is increasingly effective.

Appendix

Appendix A. System compromise indicators (IOC) – Control servers

C&C	Country / Region
wk.goldeyeuu.io (185.135.79.200)	Tokyo, Japan
1.32.250.21	Hong Kong, China
1.32.250.227	Hong Kong, China
103.145.87.3	Hong Kong, China
103.145.87.143	Hong Kong, China
103.151.44.6	Noida, India
103.151.44.82	Noida, India
103.215.49.173	Guangdong, China
103.97.228.178	Iowa, United States
104.233.164.136	Tokyo, Japan
107.148.52.201	Hong Kong, China
134.122.190.220	Tokyo, Japan
134.122.205.97	Tokyo, Japan
139.28.232.90	California, United States
143.92.32.243	Hong Kong, China
143.92.56.224	Hong Kong, China
143.92.57.46	Hong Kong, China
143.92.61.121	Hong Kong, China
154.55.135.212	Hong Kong, China
154.91.84.174	Singapore
18.166.142.167	Hong Kong, China
18.167.137.104	Hong Kong, China
192.252.182.53	California, United States
192.253.225.162	California, United States
202.79.175.78	Seoul, South Korea
202.94.68.2	Hong Kong, China
27.124.41.140	Hong Kong, China
27.124.44.76	Hong Kong, China
27.124.45.181	Hong Kong, China
27.124.7.23	Hong Kong, China
43.154.170.196	Hong Kong, China
45.120.80.106	Hong Kong, China
45.145.73.105	Washington, United States
45.195.148.73	Manila, Philippines
8.210.94.213	Hong Kong, China
8.217.110.88	Hong Kong, China
8.217.69.130	Hong Kong, China
8.218.138.126	Hong Kong, China

Appendix B. IOC – Hashes

64B07B1C385CF94A3559E323009F7641
30917B5ABB991DF495827A9D7C7EBCBC
543023ACE4F10B736C4C4109E005F0EF
B591EE37860F35A788B10531A00BBBD2
3B4C845044154DD151796ECC9FEBF395
D1D9D197AF176CDB6570E6D348A789D7
9FE20B85E9F9F3D9EE075EE5764A7078
A9B75DCF502593A6F0EF47A3CEBB4822

Appendix C. IOC – URLs

hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/updat.txt
hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/updat.exe
hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/crashreport.dll
hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/updat.log
hxxps://yy-service[.]s3.ap-northeast-2.amazonaws.com/yy.txt
hxxps://yy-service[.]s3.ap-northeast-2.amazonaws.com/yyex.exe
hxxps://yy-service[.]s3.ap-northeast-2.amazonaws.com/crashreport.dll
hxxps://yy-service[.]s3.ap-northeast-2.amazonaws.com/yyex.log

Appendix D. MITRE ATT&CK mapping

Tactic	ATT&CK ID	Technique Name	Component	Description/Indicator
Initial Access	T1566.002	Phishing: Spearphishing Link	Link	Link uses `#` to trick users into thinking they are downloading an image file (`.jpg`), but it actually downloads a `.pif` file.
Initial Access	T1204.002	User Execution: Malicious File	Dropper	User executes the `.pif` file while believing they are opening an image file.
Defense Evasion	T1553.002	Subvert Trust Controls: Code Signing	Dropper, crashreport.dll	Uses the digital signature of “Portier Global Pty Ltd”.
Defense Evasion	T1564.003	Hide Artifacts: Hidden Window	Dropper	Hides the window via the `ShowWindow` API when no debugger is detected.
Defense Evasion	T1140	Deobfuscate/Decode Files or Information	Dropper	Base64 decodes to reveal the URL for downloading malicious files.
Defense Evasion	T1497	Virtualization/Sandbox Evasion	Dropper	Sleeps randomly within segments of the malicious code.
Defense Evasion	T1497.001	Virtualization/Sandbox Evasion: System Checks	APT Loader	Checks CPU core configuration and RAM before proceeding.
Defense Evasion	T1036.005	Masquerading: Match Legitimate Resource Name or Location	Dropper	Masquerades as a Windows Update file when downloading malware to `C:\Users\<user>\AppData\Local\Microsoft\WindowsUpdate\Cache\`.
Defense Evasion	T1564.001	Hide Artifacts: Hidden Files and Directories	Dropper	The malware download directory is configured with Hidden and NotContentIndexed attributes.
Defense Evasion	T1036.004	Masquerading: Masquerade Task or Service	APT Loader	Creates a service named “Windows Eventn”.
Defense Evasion	T1620	Reflective Code Loading	APT Loader	Loads the decoded DLL after loading `crashreport.dll`.
Defense Evasion	T1070.004	Indicator Removal: File Deletion	APT Loader	Deletes the file and terminates the program.
Defense Evasion	T1070.001	Indicator Removal: Clear Windows Event Logs	APT Loader	Clears Windows Event Logs.
Defense Evasion	T1070.010	Indicator Removal: Relocate Malware	APT Loader	Copies malicious files to `C:\Users\Admin\Videos\XXXXXXXX@27`.
Defense Evasion	T1070.009	Indicator Removal: Clear Persistence	Dropper	Deletes the `SystemOptimizer` key in the registry `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Dropper	Adds the `SystemOptimizer` key in the registry `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.
Persistence	T1574.001	Hijack Execution Flow: DLL	APT Loader	Loads `crashreport.dll`.
Persistence	T1543.003	Create or Modify System Process: Windows Service	APT Loader	Copies malicious files to another location and points the “Windows Eventn” service to them.
Execution	T1059	Command and Scripting Interpreter	APT Loader	Executes commands received from the C&C (Command & Control).
Privilege Escalation	T1548.002	Abuse Elevation Control Mechanism: Bypass User Account Control	APT Loader	Reruns the program with Admin privileges.
Command and Control	T1105	Ingress Tool Transfer	Dropper	Downloads additional files: `updat.exe`, `crashreport.dll`, `updat.log`.
Credential Access	T1555	Credentials from Password Stores	APT Loader	Deletes browser data for Chrome, Firefox, 360SE6, 360 Chrome, Sogou, and QQ.

Appendix E. List of Backdoor modules

Convention code	Function
5431	DllFile plugin
5477	DllScreen plugin
5452	DllScreenHide plugin
3214	Empty
5492	DllKeybo plugin
5513	DllShell plugin
5496, 5487	Empty
5511	DllMsgBox plugin
5497	DllSyste plugin
5548	Empty
3217	fnProxy plugin
2446	ConnSocks plugin
3216	Kill explorer.exe
3215	Re-run the programme with admin privileges
5527	DllSerSt plugin
5520, 5521, 5522	Write and execute file
3210	Download plugin from C2
2447	Download plugin from C2
5515	Remove traces and exit the programme
5514	Exit module
5525	Prepare registry
5512	ConnectGroup plugin
5516	Clear Windows Log
5519	Run specified process
5524	DllOpenURLSHOW plugin
5523	DllOpenURLHIDE plugin
3221	Kill specified process
3222	Delete all files in a specified folder
3225	Get the process file path
2448	Download plugin from C2
2449	onBootup plugin
3223	Run .bat file if cmd.exe does not exist
3224	Terminate cmd.exe if it exists
3227	Clear Internet Explorer history
3228	Clear Skype data
3229	Clear Chrome browser data
3230	Clear Firefox browser data
3231	Clear 360SE6 browser data
3232	Clear 360 Chrome browser data
3233	Clear Sogou browser data
3234	Clear QQ browser data

References

Thieu Ha, Duong Tran, Huy Nguyen from CyStack Security

About the author

Thieu HaMalware Researcher and Endpoint Defense

Malware Researcher and Endpoint Defense

Stay up to dateGet the latest threat intelligence, cybersecurity reports from CyStack delivered to your inbox

Comments (0)

"<!DOCTYPE html>\n<html>\n <head>\n <title>Sign in ・ Cloudflare Access</title>\n \n <meta charset=\"utf-8\" />\n <meta name=\"robots\" content=\"noindex\" />\n <meta name=\"viewport\" content=\"initial-scale=1, maximum-scale=1, user-scalable=no, width=device-width\" />\n <link rel=\"icon\" type=\"image/svg+xml\" href=\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 62 50'%3E %3Cstyle%3E path %7B fill: url(%23gradient-light); %7D @media (prefers-color-scheme: dark) %7B path %7B fill: url(%23gradient-dark); %7D %7D %3C/style%3E %3Cdefs%3E %3ClinearGradient id='gradient-light' x1='30.7' y1='0' x2='30.7' y2='49.8' gradientUnits='userSpaceOnUse'%3E %3Cstop stop-color='%23332CB3'/%3E %3Cstop offset='1' stop-color='%23456FDD'/%3E %3C/linearGradient%3E %3ClinearGradient id='gradient-dark' x1='30.7' y1='0' x2='30.7' y2='49.8' gradientUnits='userSpaceOnUse'%3E %3Cstop stop-color='%23FFFFFF'/%3E %3Cstop offset='1' stop-color='%23E0E0E0'/%3E %3C/linearGradient%3E %3C/defs%3E %3Cpath d='M21.3 15.6h-7.8C17.2 6.4 26.1 0 36.6 0c13.7 0 24.9 11.1 24.9 24.9 0 13.7-11.1 24.9-24.9 24.9-10.4 0-19.4-6.4-23.1-15.6h7.8c3.1 5.1 8.8 8.6 15.3 8.6 9.9 0 17.9-8 17.9-17.9 0-9.9-8-17.9-17.9-17.9-6.5 0-12.1 3.4-15.3 8.6zm-12 14l-3.1-3.1h36.7c1.4 0 2.1 1.7 1.1 2.7l-6.2 6.2-2.2-2.2 3.6-3.6H9.3zm23-12.9l2.2-2.2 6.2 6.2c1 1 .3 2.7-1.1 2.7H3.1L0 20.2h35.9l-3.6-3.5z'/%3E %3C/svg%3E \" />\n <article id=\"data\"\n data-auto-redirect-to-identity=\"false\"\n data-auto-redirect-url=\"\"\n data-message=\"\">\n </article>\n <style>@charset \"UTF-8\";:root{color-scheme:light;--color-kumo-canvas:oklch(98.75% 0 0);--color-kumo-elevated:oklch(98% 0 0);--color-kumo-recessed:oklch(96% 0 0);--color-kumo-base:#fff;--color-kumo-tint:oklch(97% 0 0);--color-kumo-control:#fff;--color-kumo-line:oklch(14.5% 0 0 / 0.1);--color-kumo-hairline:oklch(93.5% 0 0);--color-kumo-fill:oklch(92.2% 0 0);--color-kumo-brand:oklch(57.72% 0.2324 260);--color-kumo-danger:oklch(63.7% 0.237 25.331);--color-kumo-success:oklch(59.6% 0.145 163.225);--color-kumo-focus:oklch(15% 0 0);--color-interstitial-deny:oklch(62% 0.19 25.331);--color-interstitial-approve:oklch(62.7% 0.19 149.214);--text-color-kumo-default:oklch(21% 0.006 285.885);--text-color-kumo-subtle:oklch(55.6% 0 0);--text-color-kumo-placeholder:oklch(70.8% 0 0);--text-color-kumo-link:oklch(42.4% 0.199 265.638);--text-color-kumo-info:oklch(42.4% 0.199 265.638);--text-color-kumo-warning:oklch(47.6% 0.114 61.907);--text-color-kumo-danger:oklch(50.5% 0.213 27.518);--text-color-kumo-success:oklch(43.2% 0.095 166.913);--radius-sm:4px;--radius-md:6px;--radius-lg:8px;--spacing:4px;--content-width:460px;--content-width-wide:540px;--content-width-xl:680px;--page-bg-override:initial}*,::after,::before{-webkit-box-sizing:border-box;box-sizing:border-box}body,html{margin:0;padding:0;min-height:100vh;min-height:100dvh}html{text-rendering:optimizeLegibility;word-wrap:break-word}.Content,body{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}body,html{background:var(--page-bg-override, #003d7b)}body{font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#4f566b;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;padding:calc(var(--spacing)*8) calc(var(--spacing)*2);text-align:center}button{font-family:inherit}.Content{width:100%;max-width:var(--content-width);margin:0 auto;gap:calc(var(--spacing)*5)}.Content-is-wide{max-width:var(--content-width-wide)}.Content-is-xl{max-width:var(--content-width-xl)}.base_AccessLogo{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.Content::after{content:\"\";display:block;height:41px;-ms-flex-negative:0;flex-shrink:0}.base_AccessLogo svg{width:280px;max-width:100%;height:auto;display:block}.AuthBox{width:100%;background:var(--color-kumo-base);border:1px solid var(--color-kumo-hairline);border-radius:var(--radius-lg);overflow:hidden;text-align:left}.AuthBox-body{padding:calc(var(--spacing)*8);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;gap:calc(var(--spacing)*4)}.AuthBox-body-is-centered,.OrgAvatarLink{-webkit-box-align:center;-ms-flex-align:center;align-items:center}.AuthBox-body-is-centered{text-align:center}.OrgAvatarLink{display:-webkit-box;display:-ms-flexbox;display:flex;gap:calc(var(--spacing)*3);text-decoration:none;color:inherit}.OrgAvatarLink-logo{-ms-flex-negative:0;flex-shrink:0;height:36px}.OrgAvatarLink-logo:has(img[src=\"\"]){display:none}.OrgAvatarLink-logo img{display:block;height:36px;width:auto;border-radius:var(--radius-sm)}.OrgAvatarLink-title{font-size:14px;line-height:20px;font-weight:500;color:var(--text-color-kumo-subtle)}.AuthBox-App{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;gap:var(--spacing)}.Card-title{margin:0;font-size:24px;line-height:32px;font-weight:600;color:var(--text-color-kumo-default)}.AuthBox-body p,.Card-subtitle,.Result p{margin:0;font-size:14px;line-height:20px;color:var(--text-color-kumo-default)}.Header-text{background:var(--color-kumo-tint);border:1px solid var(--color-kumo-hairline);border-radius:var(--radius-md);padding:calc(var(--spacing)*3) calc(var(--spacing)*4);font-size:13px;line-height:18px;color:var(--text-color-kumo-default)}.AuthBox-App>.Header-text{margin-top:calc(var(--spacing)*3)}.AuthBox-text,.InfoRow h3{font-size:14px;line-height:20px;font-weight:500;color:var(--text-color-kumo-default);margin:0 0 2px}.Result{gap:var(--spacing)}.Result p{color:var(--text-color-kumo-subtle)}.InfoList,.InfoRow,.Result{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.InfoList{gap:calc(var(--spacing)*5)}.InfoRow{gap:var(--spacing)}.InfoRow h3{margin:0;font-size:13px;line-height:18px;font-weight:600}.InfoRow p,.StandardInput{font-size:14px;color:var(--text-color-kumo-default)}.InfoRow p{margin:0;line-height:20px}.StandardInput{-moz-appearance:none;appearance:none;-webkit-appearance:none;display:block;width:100%;height:44px;padding:0 calc(var(--spacing)*3);font:inherit;background:var(--color-kumo-control);border:1px solid var(--color-kumo-line);border-radius:var(--radius-lg);-webkit-transition:background-color 120ms ease;transition:background-color 120ms ease}.StandardInput::-webkit-input-placeholder{color:var(--text-color-kumo-placeholder)}.StandardInput::-moz-placeholder{color:var(--text-color-kumo-placeholder)}.StandardInput:-ms-input-placeholder{color:var(--text-color-kumo-placeholder)}.StandardInput::-ms-input-placeholder{color:var(--text-color-kumo-placeholder)}.StandardInput::placeholder{color:var(--text-color-kumo-placeholder)}.AuthFormLogin,.AuthFormLogin-row{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.AuthFormLogin{gap:calc(var(--spacing)*3);margin:0}.AuthFormLogin-row{gap:var(--spacing)}.AuthFormLogin-row label,.Button{font-size:14px;line-height:20px;font-weight:500}.AuthFormLogin-row label{color:var(--text-color-kumo-default);margin-bottom:2px}.AuthFormLogin input[hidden]{display:none}.Button{-moz-appearance:none;appearance:none;-webkit-appearance:none;display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;gap:calc(var(--spacing)*2);height:44px;padding:0 calc(var(--spacing)*4);font-family:inherit;border-radius:var(--radius-lg);border:1px solid transparent;-webkit-box-shadow:0 1px 2px 0 rgba(0,0,0,.05);box-shadow:0 1px 2px 0 rgba(0,0,0,.05);cursor:pointer;text-decoration:none;white-space:nowrap;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;-webkit-transition:background-color 120ms ease,border-color 120ms ease,color 120ms ease,-webkit-box-shadow 120ms ease,-webkit-transform 60ms ease;transition:background-color 120ms ease,border-color 120ms ease,color 120ms ease,box-shadow 120ms ease,transform 60ms ease;transition:background-color 120ms ease,border-color 120ms ease,color 120ms ease,box-shadow 120ms ease,transform 60ms ease,-webkit-box-shadow 120ms ease,-webkit-transform 60ms ease}.Button:focus-visible{outline-offset:2px}.Button:active{-webkit-transform:translateY(.5px);-ms-transform:translateY(.5px);transform:translateY(.5px)}.Button:disabled{opacity:.5;cursor:not-allowed;-webkit-transform:none;-ms-transform:none;transform:none}.Button-is-block{width:100%}.Button-is-destructive,.Button-is-interstitial-approve,.Button-is-interstitial-deny,.Button-is-primary{background:-webkit-gradient(linear,left top,left bottom,from(color-mix(in oklch,var(--button-emphasis-color),white 15%)),to(var(--button-emphasis-color)));background:linear-gradient(to bottom,color-mix(in oklch,var(--button-emphasis-color),white 15%),var(--button-emphasis-color));color:#fff;border-color:color-mix(in oklch,var(--button-emphasis-color),black 10%)}.Button-is-destructive:hover:not(:disabled),.Button-is-interstitial-approve:hover:not(:disabled),.Button-is-interstitial-deny:hover:not(:disabled),.Button-is-primary:hover:not(:disabled){background:-webkit-gradient(linear,left top,left bottom,from(color-mix(in oklch,var(--button-emphasis-color),white 30%)),to(var(--button-emphasis-color)));background:linear-gradient(to bottom,color-mix(in oklch,var(--button-emphasis-color),white 30%),var(--button-emphasis-color))}.Button-is-primary{--button-emphasis-color:var(--color-kumo-brand)}.Button-is-destructive{--button-emphasis-color:var(--color-kumo-danger)}.Button-is-interstitial-deny{--button-emphasis-color:var(--color-interstitial-deny)}.Button-is-interstitial-approve{--button-emphasis-color:var(--color-interstitial-approve)}.Button-is-secondary{background:var(--color-kumo-base);color:var(--text-color-kumo-default);border-color:var(--color-kumo-hairline)}.Button-is-secondary:hover:not(:disabled){background:var(--color-kumo-tint)}.Button-is-secondary:active:not(:disabled){background:var(--color-kumo-fill)}.Button-is-auth{background:var(--color-kumo-base);color:var(--text-color-kumo-default);border-color:var(--color-kumo-hairline);-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start;padding:0 calc(var(--spacing)*4);gap:calc(var(--spacing)*3)}.Button-is-auth:hover:not(:disabled){background:var(--color-kumo-tint)}.Button-is-auth:active:not(:disabled){background:var(--color-kumo-fill)}.Button-is-small{height:26px;padding:0 calc(var(--spacing)*2);gap:calc(var(--spacing)*1);font-size:12px;line-height:16px;border-radius:var(--radius-md)}.Button-auth-service-icon{-ms-flex-negative:0;flex-shrink:0;width:20px;height:20px;display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.Button-auth-service-icon img,.Button-auth-service-icon svg{width:20px;height:20px;display:block}.AuthBoxRow--name{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:14px;font-weight:500}.CardActions{display:-webkit-box;display:-ms-flexbox;display:flex;gap:calc(var(--spacing)*3);margin:0}.CardActions .Button{-webkit-box-flex:1;-ms-flex:1;flex:1}.Footer-text{margin:calc(var(--spacing)*4) calc(var(--spacing)*-8) calc(var(--spacing)*-8);padding:calc(var(--spacing)*4) calc(var(--spacing)*8);background:var(--color-kumo-elevated);border-top:1px solid var(--color-kumo-hairline);font-size:12px;line-height:18px;color:var(--text-color-kumo-subtle);text-align:left}.Footer-text span{white-space:pre-line}.Message,.resend-confirmation{-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;gap:calc(var(--spacing)*3);padding:calc(var(--spacing)*3) calc(var(--spacing)*4);border:1px solid;border-radius:var(--radius-lg);font-size:14px;line-height:20px;text-align:left}.Message{display:-webkit-box;display:-ms-flexbox;display:flex}.Message svg{-ms-flex-negative:0;flex-shrink:0;width:16px;height:16px;margin-top:2px}.Message svg path{fill:currentColor}.Message-is-info{background:#f4f9ff;border-color:#5b9bd5;color:var(--text-color-kumo-info)}.Message-is-warning{background:#fffef6;border-color:#e6c84a;color:var(--text-color-kumo-warning)}.Message-is-error{background:#fffbfb;border-color:#fd959b;color:var(--text-color-kumo-danger)}.Message-is-success,.resend-confirmation{background:#f8fefb;border-color:#5cb87a;color:var(--text-color-kumo-success)}@media (max-width:480px){body{-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start;padding:calc(var(--spacing)*8) calc(var(--spacing)*4) calc(var(--spacing)*4)}.base_AccessLogo svg{width:220px}.Content::after{display:none}.AuthBox-body{padding:calc(var(--spacing)*5)}.Card-title{font-size:20px}.Footer-text{margin:calc(var(--spacing)*4) calc(var(--spacing)*-5) calc(var(--spacing)*-5);padding:calc(var(--spacing)*3) calc(var(--spacing)*5)}}@media (prefers-reduced-motion:reduce){*,::after,::before{-webkit-transition-duration:.01ms!important;transition-duration:.01ms!important;-webkit-animation-duration:.01ms!important;animation-duration:.01ms!important}}.AuthBox-AuthGroup,.AuthBox-Normal{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.AuthBox-Normal{display:-webkit-box;display:-ms-flexbox;display:flex;gap:calc(var(--spacing)*4)}.AuthBox-AuthGroup{gap:var(--spacing)}.AuthBox-AuthGroup,.AuthServiceLogin,.kumo-divider{display:-webkit-box;display:-ms-flexbox;display:flex}.AuthServiceLogin{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;gap:calc(var(--spacing)*2)}.kumo-divider{-webkit-box-align:center;-ms-flex-align:center;align-items:center;gap:calc(var(--spacing)*3);color:var(--text-color-kumo-subtle)}.kumo-divider::after,.kumo-divider::before{content:\"\";-webkit-box-flex:1;-ms-flex:1;flex:1;height:1px;background:var(--color-kumo-hairline)}.kumo-divider__label{font-size:13px;line-height:18px;font-weight:500}.AuthBox-RequestCode{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;gap:calc(var(--spacing)*2)}</style>\n\n \n <script>!function(e){\"use strict\";function t(t){return!!t&&(\"Symbol\"in e&&\"iterator\"in e.Symbol&&\"function\"==typeof t[Symbol.iterator]||!!Array.isArray(t))}function n(e){return\"from\"in Array?Array.from(e):Array.prototype.slice.call(e)}!function(){var r,a=e.URL;try{if(a){if(\"searchParams\"in(r=new e.URL(\"http://example.com\")))return;\"href\"in r||(r=void 0)}}catch(e){}function i(e){var t=\"\",n=!0;return e.forEach(function(e){var r=encodeURIComponent(e.name),a=encodeURIComponent(e.value);n||(t+=\"&\"),t+=r+\"=\"+a,n=!1}),t.replace(/%20/g,\"+\")}function o(e,t){var n=e.split(\"&\");t&&-1===n[0].indexOf(\"=\")&&(n[0]=\"=\"+n[0]);var r=[];n.forEach(function(e){if(0!==e.length){var t=e.indexOf(\"=\");if(-1!==t)var n=e.substring(0,t),a=e.substring(t+1);else n=e,a=\"\";n=n.replace(/\\+/g,\" \"),a=a.replace(/\\+/g,\" \"),r.push({name:n,value:a})}});var a=[];return r.forEach(function(e){a.push({name:decodeURIComponent(e.name),value:decodeURIComponent(e.value)})}),a}function u(e){var r=this;this._list=[],null==e||(e instanceof u?this._list=o(String(e)):\"object\"==typeof e&&t(e)?n(e).forEach(function(e){if(!t(e))throw TypeError();var a=n(e);if(2!==a.length)throw TypeError();r._list.push({name:String(a[0]),value:String(a[1])})}):\"object\"==typeof e&&e?Object.keys(e).forEach(function(t){r._list.push({name:String(t),value:String(e[t])})}):(\"?\"===(e=String(e)).substring(0,1)&&(e=e.substring(1)),this._list=o(e))),this._url_object=null,this._setList=function(e){a||(r._list=e)};var a=!1;this._update_steps=function(){a||(a=!0,r._url_object&&(\"about:\"===r._url_object.protocol&&-1!==r._url_object.pathname.indexOf(\"?\")&&(r._url_object.pathname=r._url_object.pathname.split(\"?\")[0]),r._url_object.search=i(r._list),a=!1))}}function l(e,t){var n=0;this.next=function(){if(n>=e.length)return{done:!0,value:void 0};var r=e[n++];return{done:!1,value:\"key\"===t?r.name:\"value\"===t?r.value:[r.name,r.value]}}}function c(t,n){if(!(this instanceof e.URL))throw new TypeError(\"Failed to construct 'URL': Please use the 'new' operator.\");n&&(t=function(){if(r)return new a(t,n).href;var e;try{var i;if(\"[object OperaMini]\"===Object.prototype.toString.call(window.operamini)?((e=document.createElement(\"iframe\")).style.display=\"none\",document.documentElement.appendChild(e),i=e.contentWindow.document):document.implementation&&document.implementation.createHTMLDocument?i=document.implementation.createHTMLDocument(\"\"):document.implementation&&document.implementation.createDocument?((i=document.implementation.createDocument(\"http://www.w3.org/1999/xhtml\",\"html\",null)).documentElement.appendChild(i.createElement(\"head\")),i.documentElement.appendChild(i.createElement(\"body\"))):window.ActiveXObject&&((i=new window.ActiveXObject(\"htmlfile\")).write(\"<head></head><body></body>\"),i.close()),!i)throw Error(\"base not supported\");var o=i.createElement(\"base\");o.href=n,i.getElementsByTagName(\"head\")[0].appendChild(o);var u=i.createElement(\"a\");return u.href=t,u.href}finally{e&&e.parentNode.removeChild(e)}}());var i=function(e){if(r)return new a(e);var t=document.createElement(\"a\");return t.href=e,t}(t||\"\"),l=function(){if(!(\"defineProperties\"in Object))return!1;try{var e={};return Object.defineProperties(e,{prop:{get:function(){return!0}}}),e.prop}catch(e){return!1}}()?this:document.createElement(\"a\"),c=new u(i.search?i.search.substring(1):null);function s(){var e=i.href.replace(/#$|\\?$|\\?(?=#)/g,\"\");i.href!==e&&(i.href=e)}function f(){c._setList(i.search?o(i.search.substring(1)):[]),c._update_steps()}return c._url_object=l,Object.defineProperties(l,{href:{get:function(){return i.href},set:function(e){i.href=e,s(),f()},enumerable:!0,configurable:!0},origin:{get:function(){return\"origin\"in i?i.origin:this.protocol+\"//\"+this.host},enumerable:!0,configurable:!0},protocol:{get:function(){return i.protocol},set:function(e){i.protocol=e},enumerable:!0,configurable:!0},username:{get:function(){return i.username},set:function(e){i.username=e},enumerable:!0,configurable:!0},password:{get:function(){return i.password},set:function(e){i.password=e},enumerable:!0,configurable:!0},host:{get:function(){var e={\"http:\":/:80$/,\"https:\":/:443$/,\"ftp:\":/:21$/}[i.protocol];return e?i.host.replace(e,\"\"):i.host},set:function(e){i.host=e},enumerable:!0,configurable:!0},hostname:{get:function(){return i.hostname},set:function(e){i.hostname=e},enumerable:!0,configurable:!0},port:{get:function(){return i.port},set:function(e){i.port=e},enumerable:!0,configurable:!0},pathname:{get:function(){return\"/\"!==i.pathname.charAt(0)?\"/\"+i.pathname:i.pathname},set:function(e){i.pathname=e},enumerable:!0,configurable:!0},search:{get:function(){return i.search},set:function(e){i.search!==e&&(i.search=e,s(),f())},enumerable:!0,configurable:!0},searchParams:{get:function(){return c},enumerable:!0,configurable:!0},hash:{get:function(){return i.hash},set:function(e){i.hash=e,s()},enumerable:!0,configurable:!0},toString:{value:function(){return i.toString()},enumerable:!1,configurable:!0},valueOf:{value:function(){return i.valueOf()},enumerable:!1,configurable:!0}}),l}if(Object.defineProperties(u.prototype,{append:{value:function(e,t){this._list.push({name:e,value:t}),this._update_steps()},writable:!0,enumerable:!0,configurable:!0},delete:{value:function(e){for(var t=0;t<this._list.length;)this._list[t].name===e?this._list.splice(t,1):++t;this._update_steps()},writable:!0,enumerable:!0,configurable:!0},get:{value:function(e){for(var t=0;t<this._list.length;++t)if(this._list[t].name===e)return this._list[t].value;return null},writable:!0,enumerable:!0,configurable:!0},getAll:{value:function(e){for(var t=[],n=0;n<this._list.length;++n)this._list[n].name===e&&t.push(this._list[n].value);return t},writable:!0,enumerable:!0,configurable:!0},has:{value:function(e){for(var t=0;t<this._list.length;++t)if(this._list[t].name===e)return!0;return!1},writable:!0,enumerable:!0,configurable:!0},set:{value:function(e,t){for(var n=!1,r=0;r<this._list.length;)this._list[r].name===e?n?this._list.splice(r,1):(this._list[r].value=t,n=!0,++r):++r;n||this._list.push({name:e,value:t}),this._update_steps()},writable:!0,enumerable:!0,configurable:!0},entries:{value:function(){return new l(this._list,\"key+value\")},writable:!0,enumerable:!0,configurable:!0},keys:{value:function(){return new l(this._list,\"key\")},writable:!0,enumerable:!0,configurable:!0},values:{value:function(){return new l(this._list,\"value\")},writable:!0,enumerable:!0,configurable:!0},forEach:{value:function(e){var t=arguments.length>1?arguments[1]:void 0;this._list.forEach(function(n,r){e.call(t,n.value,n.name)})},writable:!0,enumerable:!0,configurable:!0},toString:{value:function(){return i(this._list)},writable:!0,enumerable:!1,configurable:!0}}),\"Symbol\"in e&&\"iterator\"in e.Symbol&&(Object.defineProperty(u.prototype,e.Symbol.iterator,{value:u.prototype.entries,writable:!0,enumerable:!0,configurable:!0}),Object.defineProperty(l.prototype,e.Symbol.iterator,{value:function(){return this},writable:!0,enumerable:!0,configurable:!0})),a)for(var s in a)a.hasOwnProperty(s)&&\"function\"==typeof a[s]&&(c[s]=a[s]);e.URL=c,e.URLSearchParams=u}(),function(){if(\"1\"!==new e.URLSearchParams([[\"a\",1]]).get(\"a\")||\"1\"!==new e.URLSearchParams({a:1}).get(\"a\")){var r=e.URLSearchParams;e.URLSearchParams=function(e){if(e&&\"object\"==typeof e&&t(e)){var a=new r;return n(e).forEach(function(e){if(!t(e))throw TypeError();var r=n(e);if(2!==r.length)throw TypeError();a.append(r[0],r[1])}),a}return e&&\"object\"==typeof e?(a=new r,Object.keys(e).forEach(function(t){a.set(t,e[t])}),a):new r(e)}}}()}(self);</script>\n <script>\"use strict\";var get=function(t){return Array.prototype.slice.call(document.querySelectorAll(t))},addFragmentToURLState=function(t){if(!t)return t;var e=new URL(t);if(e&&\"\"!==fragment&&fragment.length<100){var a=window.btoa(JSON.stringify({fragment:\"#\"===fragment[0]?fragment:\"#\".concat(fragment)})),r=e.searchParams.get(\"state\"),n=e.searchParams.get(\"RelayState\");r?e.searchParams.set(\"state\",\"\".concat(r,\".\").concat(a)):n&&e.searchParams.set(\"RelayState\",\"\".concat(n,\".\").concat(a))}return e.toString()},fragment=window.location.hash||\"\",article=document.querySelector(\"#data\"),dset=article.dataset,autoRedirectToIdentity=\"true\"===dset.autoRedirectToIdentity,autoRedirectURL=addFragmentToURLState(dset.autoRedirectUrl),message=dset.message;autoRedirectURL&&autoRedirectToIdentity&&(message||(window.location=autoRedirectURL));</script>\n </head>\n\n <body>\n <div class=\"Content\">\n <div class=\"base_AccessLogo\">\n <svg width=\"339\" height=\"50\" fill=\"none\" viewBox=\"0 0 339 50\"><path d=\"M42.8 2.847A20.9 20.9 0 0 0 30.343 6.97a21.6 21.6 0 0 0-7.703 10.806l-.14.449h3.9l.09-.215a17.76 17.76 0 0 1 7.47-8.88 17.2 17.2 0 0 1 11.254-2.255 17.38 17.38 0 0 1 10.206 5.342 18.02 18.02 0 0 1 4.772 10.642c.374 3.993-.58 8-2.71 11.372a17.56 17.56 0 0 1-9.03 7.217 17.17 17.17 0 0 1-11.469-.038A17.57 17.57 0 0 1 28 34.133c-.1-.153-.19-.306-.28-.47l-.2-.357h-4.09l.24.5q.556 1.22 1.27 2.347a21.4 21.4 0 0 0 8.002 7.497 20.86 20.86 0 0 0 10.59 2.47 20.9 20.9 0 0 0 10.4-3.203 21.47 21.47 0 0 0 7.481-8.038 22 22 0 0 0 2.6-10.763 22 22 0 0 0-2.962-10.664 21.4 21.4 0 0 0-7.75-7.77A20.9 20.9 0 0 0 42.8 2.848\" fill=\"#fff\"/><path d=\"m43.79 21.52-7.43-7.581-2.47 2.52 4.32 4.419H6l2.08 3.56H42.6zM43.74 37.602l-2.47-2.52 4.32-4.419H11.7l-2.07-3.57h40.35l1.19 2.928zM327.359 19.158q1.95 1.248 2.239 4.295h-4.341q-.091-.837-.472-1.325-.717-.883-2.438-.883-1.416 0-2.026.441-.594.442-.594 1.036 0 .746.64 1.082.64.35 4.524 1.203 2.59.609 3.885 1.843 1.28 1.25 1.279 3.123 0 2.467-1.843 4.037-1.828 1.554-5.667 1.554-3.915 0-5.788-1.646-1.859-1.66-1.859-4.22h4.403q.137 1.159.594 1.646.807.868 2.986.868 1.28 0 2.025-.38.762-.381.762-1.143 0-.73-.609-1.112-.609-.38-4.524-1.31-2.818-.7-3.976-1.752-1.158-1.036-1.158-2.985 0-2.3 1.798-3.946 1.812-1.66 5.087-1.66 3.108 0 5.073 1.234M310.929 19.158q1.95 1.248 2.24 4.295h-4.342q-.091-.837-.472-1.325-.716-.883-2.437-.883-1.417 0-2.026.441-.594.442-.594 1.036 0 .746.639 1.082.64.35 4.525 1.203 2.59.609 3.884 1.843 1.28 1.25 1.28 3.123 0 2.467-1.844 4.037-1.827 1.554-5.666 1.554-3.915 0-5.789-1.646-1.858-1.66-1.858-4.22h4.402q.137 1.159.594 1.646.808.868 2.986.868 1.28 0 2.026-.38.761-.381.761-1.143 0-.73-.609-1.112-.609-.38-4.524-1.31-2.818-.7-3.976-1.752-1.158-1.036-1.158-2.985 0-2.3 1.798-3.946 1.812-1.66 5.088-1.66 3.107 0 5.072 1.234M297.272 30.125q-.167 1.478-1.538 3.001-2.133 2.422-5.971 2.422-3.169 0-5.591-2.041t-2.422-6.642q0-4.31 2.178-6.61 2.195-2.3 5.682-2.3 2.072 0 3.732.776 1.66.777 2.742 2.452.975 1.479 1.265 3.428.167 1.142.137 3.29h-11.364q.091 2.499 1.569 3.504.898.624 2.163.624 1.341 0 2.178-.761.457-.411.808-1.143zm-4.295-5.088q-.107-1.72-1.051-2.604-.93-.9-2.316-.9-1.507 0-2.346.945-.822.945-1.035 2.56zM280.997 24.352h-4.448a3.9 3.9 0 0 0-.625-1.675q-.73-1.006-2.27-1.006-2.193 0-3.001 2.178-.426 1.158-.426 3.078 0 1.827.426 2.94.777 2.07 2.925 2.071 1.524 0 2.163-.822.64-.823.777-2.133h4.433q-.153 1.98-1.432 3.747-2.042 2.85-6.047 2.849-4.006 0-5.896-2.376-1.888-2.377-1.888-6.17 0-4.28 2.086-6.657Q269.862 18 273.532 18q3.123 0 5.104 1.401 1.995 1.402 2.361 4.951M264.567 24.352h-4.448a3.85 3.85 0 0 0-.625-1.675q-.731-1.006-2.269-1.006-2.194 0-3.001 2.178-.427 1.158-.427 3.078 0 1.827.427 2.94.777 2.07 2.924 2.071 1.524 0 2.164-.822.64-.823.776-2.133h4.433q-.152 1.98-1.432 3.747-2.04 2.85-6.047 2.849t-5.895-2.376q-1.89-2.377-1.889-6.17 0-4.28 2.087-6.657Q253.431 18 257.103 18q3.123 0 5.103 1.401 1.995 1.402 2.361 4.951M242.09 30.384h-8.272L232.264 35h-4.905l8.013-22.454h5.301L248.625 35h-5.088zm-1.31-3.869-2.803-8.835-2.895 8.835zM219.788 30.125q-.168 1.478-1.539 3.001-2.132 2.422-5.971 2.422-3.168 0-5.59-2.041t-2.422-6.642q0-4.31 2.178-6.61 2.193-2.3 5.682-2.3 2.071 0 3.732.776 1.66.777 2.742 2.452.975 1.479 1.264 3.428.168 1.142.137 3.29h-11.364q.091 2.499 1.569 3.504.9.624 2.164.624 1.34 0 2.178-.761.457-.411.807-1.143zm-4.296-5.088q-.106-1.72-1.051-2.604-.929-.9-2.315-.9-1.508 0-2.346.945-.822.945-1.036 2.56zM202.702 22.402q-2.62 0-3.519 1.706-.503.96-.503 2.956V35h-4.371V18.396h4.143v2.894q1.005-1.66 1.752-2.27 1.218-1.02 3.168-1.02.121 0 .198.015.091 0 .381.015v4.448a12 12 0 0 0-1.249-.076M178.549 20.194q1.72-2.194 5.91-2.194 2.727 0 4.844 1.081 2.118 1.082 2.118 4.083v7.616q0 .792.03 1.92.045.853.259 1.157.213.306.64.503V35h-4.722a4.8 4.8 0 0 1-.275-.944 12 12 0 0 1-.122-1.006 9 9 0 0 1-2.071 1.66q-1.402.808-3.169.808-2.254 0-3.732-1.28-1.462-1.294-1.462-3.656 0-3.06 2.361-4.432 1.295-.747 3.808-1.067l1.478-.182q1.203-.153 1.721-.381.93-.396.929-1.234 0-1.02-.716-1.402-.7-.396-2.071-.396-1.539 0-2.179.762-.456.564-.609 1.523h-4.189q.137-2.178 1.219-3.58m3.229 11.668q.61.503 1.493.503 1.401 0 2.574-.823 1.189-.823 1.234-3v-1.616a5 5 0 0 1-.838.427 7.3 7.3 0 0 1-1.142.29l-.975.182q-1.371.244-1.965.594-1.005.594-1.005 1.843 0 1.113.624 1.6M167.682 12.41v3.534q-.306-.015-.595-.015-.288-.015-.7-.016-1.021 0-1.249.564-.23.564-.198 1.767v.305h2.848v3.061h-2.848V35h-4.327V21.61h-2.422V18.55h2.377v-1.067q0-2.65 1.173-3.945 1.05-1.218 4.28-1.219.396 0 .807.03.412.031.854.062m7.007.137V35h-4.326V12.547zM156.763 12.577V35h-4.219v-2.3q-.93 1.477-2.118 2.148-1.188.67-2.955.67-2.909 0-4.905-2.346-1.98-2.361-1.98-6.047 0-4.25 1.95-6.688Q144.501 18 147.776 18q1.508 0 2.681.67a5.2 5.2 0 0 1 1.904 1.828v-7.92zm-11.699 14.228q0 2.3.914 3.67.9 1.387 2.742 1.387t2.803-1.37q.96-1.372.96-3.55 0-3.046-1.539-4.357a3.3 3.3 0 0 0-2.193-.792q-1.905 0-2.803 1.447-.884 1.432-.884 3.565M134.164 32.654q-.06.075-.304.457a3 3 0 0 1-.579.67q-1.021.915-1.981 1.25-.944.334-2.224.334-3.685 0-4.966-2.65-.715-1.463-.715-4.31V18.395h4.448v10.008q0 1.417.335 2.133.594 1.264 2.33 1.264 2.225 0 3.047-1.797.426-.976.426-2.575v-9.033h4.403V35h-4.22zM119.227 20.498q2.102 2.636 2.102 6.23 0 3.657-2.102 6.261-2.102 2.59-6.383 2.59-4.28 0-6.382-2.59-2.103-2.604-2.103-6.26 0-3.596 2.103-6.23 2.101-2.636 6.382-2.636t6.383 2.635m-6.398 1.036q-1.905 0-2.94 1.356-1.02 1.34-1.021 3.838t1.021 3.854q1.035 1.356 2.94 1.356 1.903 0 2.925-1.356 1.02-1.356 1.02-3.854t-1.02-3.838q-1.022-1.356-2.925-1.356M97.727 12.546h4.341V35h-4.341zM92.22 33.324q-2.514 2.3-6.429 2.3-4.844 0-7.616-3.107-2.773-3.123-2.773-8.56 0-5.88 3.154-9.064 2.742-2.773 6.976-2.773 5.667 0 8.287 3.717 1.448 2.087 1.554 4.189H90.68q-.457-1.614-1.173-2.437-1.28-1.463-3.793-1.463-2.56 0-4.037 2.072-1.477 2.057-1.477 5.834 0 3.778 1.553 5.667 1.57 1.875 3.976 1.874 2.468 0 3.763-1.615.716-.868 1.188-2.605h4.646q-.609 3.671-3.108 5.971\" fill=\"#fff\"/></svg>\n </div>\n\n <div class=\"AuthBox\">\n <div class=\"AuthBox-body\">\n <a class=\"OrgAvatarLink\" href=''>\n <div class=\"OrgAvatarLink-logo\">\n <img src=\"https://s.cystack.net/resource/cystack/CyStack-Black.svg\" style=\"opacity:0;\" onload=\"this.style.opacity='1'\">\n </div>\n <div class=\"OrgAvatarLink-title\">\n CyStack\n </div>\n </a>\n <div class=\"AuthBox-App\">\n <h1 class=\"Card-title\">\n Log in to CyStack Blog\n </h1>\n\n </div>\n <div class=\"AuthBox-Normal\">\n <div class=\"AuthBox-AuthGroup\">\n <div class=\"AuthBox-text\">\n Sign in with:\n </div>\n <div class=\"AuthServiceLogin\">\n <div class=\"AuthServiceLogin-row AuthServiceLogin-row-is-only\">\n <a class=\"Button-is-block Button Button-is-auth js-idp\" data-idp=\"Google\" title=\"Google ・ CyStack\"\n href=\"https://accounts.google.com/o/oauth2/auth?client_id=306229843697-8ot9f4phmrpr35gahbe3cvf5agj6nhs6.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fcystack.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&state=d91027cc09acc6fcf0b3a208347b67ecf454c04671161489e68cc1a25bcdcaa2.JTdCJTIyaWF0JTIyJTNBMTc4Njg0Mzc3OCUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJjeXN0YWNrLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJibG9nLmN5c3RhY2sub3JnJTIyJTJDJTIycmVkaXJlY3RVUkwlMjIlM0ElMjIlMkZsYWJzJTJGd3AtanNvbiUyRndwJTJGcmFua21hdGglMkZ2MSUyRmdldEhlYWQlM0Z1cmwlM0RodHRwcyUzQSUyNTJGJTI1MkZibG9nLmN5c3RhY2sub3JnJTI1MkZsYWJzJTI1MkYyMDI2JTI1MkYwMiUyNTJGMDQlMjUyRm1hbHdhcmUtbGlua2VkLWFwdC1xLTI3JTI1MkYlMjIlMkMlMjJhdWQlMjIlM0ElMjJkMDhjYzMxMmQzNTgwMjY4ZGYzYWNhMjRjYjRmNGI3NDZhYTU1OGVkMGEzODRjYjRkNzNkZDc2OGViMDIwMWY3JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5wMFBiQ0FTc0FQY2t0QkRYJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI4OTM1NTNmNi0yMDVjLTRjY2MtOWMxZS1jMzA5NDhlN2Y4NWMlMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX3N0YXR1cyUyMiUzQWZhbHNlJTJDJTIyYXV0aF9zdGF0dXMlMjIlM0ElMjJOT05FJTIyJTJDJTIyaXNfd2FycCUyMiUzQWZhbHNlJTJDJTIyaXNfZ2F0ZXdheSUyMiUzQWZhbHNlJTJDJTIybXRsc19hdXRoJTIyJTNBJTdCJTIyY2VydF9pc3N1ZXJfZG4lMjIlM0ElMjIlMjIlMkMlMjJjZXJ0X3NlcmlhbCUyMiUzQSUyMiUyMiUyQyUyMmNlcnRfaXNzdWVyX3NraSUyMiUzQSUyMiUyMiUyQyUyMmNlcnRfcHJlc2VudGVkJTIyJTNBZmFsc2UlMkMlMjJjb21tb25fbmFtZSUyMiUzQSUyMiUyMiUyQyUyMmF1dGhfc3RhdHVzJTIyJTNBJTIyTk9ORSUyMiU3RCUyQyUyMmFwcFNlc3Npb25IYXNoJTIyJTNBJTIyNzM1OGNiNDEwM2JhMDE2NmFkNzMyZWZiMWI0MTNlODQ4NGEzNTI0NDZiOTRkYzNiM2ZkMTkyYTNiMGM1MzhiZCUyMiU3RA%253D%253D&scope=email+profile+openid\" accesskey=\"1\" id=\"idp1\">\n <div class=\"Button-auth-service-icon\"><svg viewBox=\"0 0 256 262\"><path d=\"M13.925 71.947C5.077 89.644 0 109.517 0 130.55s5.077 40.905 13.925 58.602C35.393 231.798 79.49 261.1 130.55 261.1c35.248 0 64.839-11.605 86.453-31.622 24.659-22.774 38.875-56.282 38.875-96.027 0-10.734-.871-18.567-2.756-26.69H130.55v48.448h71.947c-1.45 12.04-9.283 30.172-26.69 42.356-11.024 7.688-25.82 13.055-45.257 13.055-34.523 0-63.824-22.773-74.269-54.25-2.756-8.123-4.351-16.827-4.351-25.82 0-8.994 1.595-17.697 4.206-25.82 10.59-31.477 39.891-54.251 74.414-54.251 24.514 0 41.05 10.589 50.479 19.438l36.844-35.974C195.245 12.91 165.798 0 130.55 0 79.49 0 35.393 29.301 13.925 71.947z\"></path></svg></div>\n <div class=\"AuthBoxRow--name\">Google ・ CyStack</div>\n </a>\n </div>\n </div>\n </div>\n <div class=\"kumo-divider\" role=\"separator\" aria-orientation=\"horizontal\">\n <span class=\"kumo-divider__label\">or</span>\n </div>\n <div class=\"AuthBox-RequestCode AuthBox-RequestCode__idpsExist\">\n <form class=\"AuthFormLogin\" action='https://cystack.cloudflareaccess.com/cdn-cgi/access/verify-code/blog.cystack.org?kid=d08cc312d3580268df3aca24cb4f4b746aa558ed0a384cb4d73dd768eb0201f7&meta=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ijk5MWY5NGIwZTQ2NTZlZWU2NTM5ZjdkYTUwMDQ2NDIxMTkyZjQ3YzkzYmMxMDk5ZTNhZGQwMzQwMGQ1NjhlZTUifQ.eyJ0eXBlIjoibWV0YSIsImF1ZCI6ImQwOGNjMzEyZDM1ODAyNjhkZjNhY2EyNGNiNGY0Yjc0NmFhNTU4ZWQwYTM4NGNiNGQ3M2RkNzY4ZWIwMjAxZjciLCJob3N0bmFtZSI6ImJsb2cuY3lzdGFjay5vcmciLCJyZWRpcmVjdF91cmwiOiIvbGFicy93cC1qc29uL3dwL3JhbmttYXRoL3YxL2dldEhlYWQ_dXJsPWh0dHBzOiUyRiUyRmJsb2cuY3lzdGFjay5vcmclMkZsYWJzJTJGMjAyNiUyRjAyJTJGMDQlMkZtYWx3YXJlLWxpbmtlZC1hcHQtcS0yNyUyRiIsInNlcnZpY2VfdG9rZW5fc3RhdHVzIjpmYWxzZSwiaXNfd2FycCI6ZmFsc2UsImlzX2dhdGV3YXkiOmZhbHNlLCJleHAiOjE3ODY4NDQwNzcsIm5iZiI6MTc4Njg0Mzc3NywiaWF0IjoxNzg2ODQzNzc3LCJhdXRoX3N0YXR1cyI6Ik5PTkUiLCJtdGxzX2F1dGgiOnsiY2VydF9pc3N1ZXJfZG4iOiIiLCJjZXJ0X3NlcmlhbCI6IiIsImNlcnRfaXNzdWVyX3NraSI6IiIsImNlcnRfcHJlc2VudGVkIjpmYWxzZSwiY29tbW9uX25hbWUiOiIiLCJhdXRoX3N0YXR1cyI6Ik5PTkUifSwicmVhbF9jb3VudHJ5IjoiU0ciLCJhcHBfc2Vzc2lvbl9oYXNoIjoiNzM1OGNiNDEwM2JhMDE2NmFkNzMyZWZiMWI0MTNlODQ4NGEzNTI0NDZiOTRkYzNiM2ZkMTkyYTNiMGM1MzhiZCJ9.qRhq7jiELqLqjfVxEyZoK7BdZ2vKHOYzLV8rOixDOa62Q_sKeR7zty824pvnjE5ThLwfTikJ1UmI-GkLPmyhmrlDegGHE2A3QZgSKgFej6MskY6Fqu17l2T5NlPaCLBI87yif51ia9d53xyE_g5X955dBKk92taoCNySAlk8Snm9XJe4EnlLcReXpRDmrhy7YfDi40o0BfqtV8KmQ7bYECReuat1aX5aFqlkjzvtz4OlY8IiVM_Q3gxbuTaEkO-P9b3qOlbY0tNP9V4HesXEE-HWHiq0h1yLFRYEQZoigztr-mTc8D2JcwRsxQWTqbwaeR5IPWVJLpuBMBzETfpUNQ&redirect_url=%2Flabs%2Fwp-json%2Fwp%2Frankmath%2Fv1%2FgetHead%3Furl%3Dhttps%3A%252F%252Fblog.cystack.org%252Flabs%252F2026%252F02%252F04%252Fmalware-linked-apt-q-27%252F' method=\"post\" id=\"totp-form\">\n <div class=\"AuthFormLogin-row\">\n <label for=\"email\">Email</label>\n <input id=\"email\" class=\"StandardInput-is-block StandardInput EmailInput\" type=\"email\" required\n placeholder=\"example@email.com\" spellcheck=\"false\" autocomplete=\"off\" autocapitalize=\"none\"\n name=\"email\">\n <input hidden type=\"text\" name=\"client_id\" value=''>\n <input hidden type=\"text\" name=\"connector_id\" value=''>\n <input hidden type=\"text\" name=\"connector_type\" value=''>\n <input hidden type=\"text\" name=\"redirect_url\" value=''>\n </div>\n <div class=\"AuthFormLogin-row\">\n <button type=\"submit\" form=\"totp-form\" class=\"Button-is-block Button Button-is-primary\">\n Send login code\n </button>\n </div>\n </form>\n </div>\n\n </div>\n </div>\n </div>\n </div>\n\n <script>\"use strict\";if(document.addEventListener(\"keyup\",function(e){if(\"BODY\"===e.target.nodeName&&e.key>=1&&e.key<=10){var t=document.getElementById(\"idp\"+e.key);window.location=t.getAttribute(\"href\")}},!1),\"\"!==fragment&&fragment.length<100){var services=get(\".js-idp\")||[];services.map(function(e){return e.href=addFragmentToURLState(e.href),e})}</script>\n </body>\n\n</html>"

DragonBreath with three head of dragon with three filetype extension

Đọc bản tiếng Việt tại đây

Overview

Context

Scoping and Investigation

We then pivoted into artefact-led analysis across the affected host:

File system residues
Registry entries associated with logon/start-up behaviour
Windows service configuration
Process execution traces

Assessment

By the time the investigation concluded, we found no evidence that the malware had spread laterally to other systems in the same environment.

⚠️ Disclaimer:

Attack Chain Overview

👤	User – Customer Support Department Receives link via Zendesk. Downloads & executes file.
⬇️	Dropper (Downloaded File) Connects to cloud. Downloads component loaders.
⚡	Loader Decrypts payload. Executes entirely in memory.
⚙️	Backdoor Establishes persistence (service). Connects to C&C. Receives commands / downloads modules.
📡	Maintain Presence & Remote Control Active connection established.

Detailed Technical Analysis

Initial access stage

The initial access vector was a URL delivered to an employee via a Zendesk ticket: hxxps://storage[.]googleapis[.]com/iwantuu/photo202512.pif#image2025-12-29-14-53.jpg

At a glance, the URL is crafted to look like it delivers a JPG image, by appending .jpg after the # character.

The critical detail is how URL fragments work:

File dropper nguyên bản

Key characteristics of the Dropper:

.NET (C#)
Heavily packed/obfuscated
- Obfuscated function and variable names
- No critical strings stored as plaintext
- Runtime string decoding, mainly via:
  - Multi-layer Base64 for the FileList URI
  - Additional obfuscation of sensitive strings

Most notably, the Dropper was digitally signed and considered valid at the time it was distributed.

Chữ ký số giả mạo của dropper liên hệ đến DragonBreath

Signature heuristics shown that:

Certificate issued to Portier Global Pty Ltd
Hash algorithm: SHA‑256
Valid timestamp from a third-party timestamping service (SSL.com Timestamp)

Although the certificate was explicitly revoked by the time of analysis, the presence of a valid timestamp typically means:

Windows can still treat the signature as valid for the signing time
SmartScreen and several reputation checks are less likely to block the download at the time of delivery

Dropper execution

On execution, the Dropper creates an HTTP client with:

A User-Agent randomly selected from the following three:
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/120.0.0.0
Standard headers (Accept, Accept-Language, Cache-Control)
Language values including en-US and zh-CN, consistent with reuse across multiple regions

The Dropper does not embed the primary payload. Instead, it performs staged retrieval:

1. Decodes a Base64 string to obtain the FileList URI

Code screen after decoding Base64

hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/updat.txt

2. Issues a GET request to the FileList URL to retrieve the required components

A browser screen with text that matched the information

Filename	MD5	Notes
updat.exe	64B07B1C385CF94A3559E323009F7641	Clean file, acts as the Loader
crashreport.dll	30917B5ABB991DF495827A9D7C7EBCBC	Malicious DLL with a digital signature
updat.log	543023ACE4F10B736C4C4109E005F0EF	Blob containing the main payload (compressed/encrypted)
vcruntime140.dll	4113057339D9E4E376BDED9074D20C17	Clean file
image.jpg	4DE8079431D85D3A37FD77FB26E8328F	Decoy file to legitimize the folder
msvcp140.dll	7E8BDD2C2304E204B44A3BEC09D66062	Clean file

A screen of Windows Explorer with multiple files inside

4. Marks the Staging directory with both Hidden and NotContentIndexed, reducing its visibility in normal browsing and excluding it from Windows indexing

CyStack Blog Image

5. Establishes temporary persistence via a Run key:

HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
SystemOptimizer = "<path_to_updat.exe> /minimized"

CyStack Blog Image

The Dropper also includes options intended to remove traces, including the ability to delete the Run key above.

CyStack Blog Image

Loader execution

When crashreport.dll loads, execution passes through DllMain, which triggers the core loader logic:

The payload container name (updat.log) is not hardcoded. It is reconstructed at runtime using a simple XOR decode (0xAA) over a static byte array.
The loader opens updat.log, reads the full contents into memory, and decrypts the blob to recover the complete payload (shellcode plus PE data).
After decryption:

VirtualProtect is invoked to set the relevant memory region to PAGE_EXECUTE_READ
The payload entry point is called directly, transferring execution to the shellcode

Observed shellcode responsibilities:

Decompress the main payload into a PE image
Map the PE image into memory
Repair the import table
Dynamically resolve required APIs

Backdoor execution

Anti-analysis and environment checks

Immediately after loading, the Backdoor performs a series of defensive checks:

1. Single-instance enforcement / run marker

Creates a mutex via CreateMutexA().
If GetLastError() == 183, an instance already exists, and the malware typically exits or changes execution flow.

2. Anti-debug

Calls IsDebuggerPresent().
If a debugger is detected, it exits.

3. Resource checks (sandbox avoidance)

The CPUandRamCheck() routine calls:

GetSystemInfo() (CPU cores ≥ 3)
GlobalMemoryStatusEx() (RAM ≥ 3 GB)

If the host does not meet these thresholds, the malware terminates – behaviour commonly used to avoid low-resource VM/sandbox environments.

CyStack Blog Image

Runtime decryption of C2 list

The Backdoor stores its C2 list in encrypted form and decrypts it at runtime, reducing exposure to static string scanning.
Decryption uses an XOR routine (sub_1001F582, byte-wise XOR over byte_10046160[...]).
Decrypted entries are in the format: <ip>:15628

CyStack Blog Image

Privilege handling

The Backdoor checks the current execution context:

If not running as Administrator, it re-launches itself elevated via ShellExecuteExA.
If already elevated, it proceeds to establish persistence (service creation) before enabling the rest of its operational logic.

Persistence via Windows Service

It checks for a service named Windows EventN – a name chosen to blend in with legitimate Windows event-related services.

Persistence branches:

If the service does not exist:
- Creates a directory under the user profile: C:\\Users\\<User>\\Videos\\<random_string>@27
- Copies related executables into that location.
- Calls OpenSCManagerA() and CreateServiceA() to register a new service pointing to the deployed executable.
- Configures the service to start automatically.
If the service already exists:
- Checks service status and configuration.
- If auto-start is not set, updates configuration via ChangeServiceConfigA / ChangeServiceConfig2A.
- If the service exists but is stopped, restarts it and terminates the current process.

CyStack Blog Image

UAC policy changes

The Backdoor then attempts to reduce friction for future malicious activity by preventing UAC prompts.

It checks the OS version using GetVersionExA() and, if dwMajorVersion >= 6 (Windows Vista and later), modifies UAC-related policy keys:

HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System

Values modified including:

EnableLUA
ConsentPromptBehaviorAdmin
PromptOnSecureDesktop

The intended effect is to reduce or disable UAC prompts and allow follow-on processes/modules to execute in an elevated context without user interaction.

CyStack Blog Image

C2 communications and modular command handling

Only after persistence and privilege controls are in place does the Backdoor establish a connection to its C2 infrastructure.

On successful connection, it initialises a command dispatch table that maps command IDs to dedicated handlers/modules – consistent with a plugin-based architecture.

Observed modules include:

File operations
Screen capture / screen hiding
Keystroke logging
Shell execution
Placeholder modules awaiting later activation

This model allows attackers to switch capabilities on and off as needed and to extend functionality without replacing the main payload.

CyStack Blog Image

Relationship to Known Attack Campaigns

Similarities in C2 naming

Similarities in C&C infrastructure

Similarities in payload handling

Backdoor architecture

The plugin-based design – mapping C&C command IDs to independent functional modules – looks far more like a maintained backdoor framework than opportunistic malware.

Recommendations for Enterprises

Based on the findings in this case, CyStack recommends the following priorities:

Proactive endpoint threat hunting focused on behaviours that signatures often miss: DLL sideloading, in-memory execution, legitimate processes behaving abnormally, and suspicious or unknown Windows services.
Incident response readiness to rapidly scope affected hosts, collect forensic artefacts, and isolate systems before stable C&C connections are established or lateral movement becomes possible.
Behaviour-based endpoint protection, rather than relying only on signatures or file reputation. Solutions such as CyStack Endpoint can monitor process behaviour, flag abnormal persistence, and intervene against previously unseen samples.
Contextual threat intelligence (infrastructure, TTPs and campaign linkage) to improve early detection and avoid purely reactive IOC-by-IOC response.
Review of non-traditional attack surfaces, particularly customer support channels and ticketing workflows where sophisticated social engineering is increasingly effective.

Appendix

Appendix A. System compromise indicators (IOC) – Control servers

C&C	Country / Region
wk.goldeyeuu.io (185.135.79.200)	Tokyo, Japan
1.32.250.21	Hong Kong, China
1.32.250.227	Hong Kong, China
103.145.87.3	Hong Kong, China
103.145.87.143	Hong Kong, China
103.151.44.6	Noida, India
103.151.44.82	Noida, India
103.215.49.173	Guangdong, China
103.97.228.178	Iowa, United States
104.233.164.136	Tokyo, Japan
107.148.52.201	Hong Kong, China
134.122.190.220	Tokyo, Japan
134.122.205.97	Tokyo, Japan
139.28.232.90	California, United States
143.92.32.243	Hong Kong, China
143.92.56.224	Hong Kong, China
143.92.57.46	Hong Kong, China
143.92.61.121	Hong Kong, China
154.55.135.212	Hong Kong, China
154.91.84.174	Singapore
18.166.142.167	Hong Kong, China
18.167.137.104	Hong Kong, China
192.252.182.53	California, United States
192.253.225.162	California, United States
202.79.175.78	Seoul, South Korea
202.94.68.2	Hong Kong, China
27.124.41.140	Hong Kong, China
27.124.44.76	Hong Kong, China
27.124.45.181	Hong Kong, China
27.124.7.23	Hong Kong, China
43.154.170.196	Hong Kong, China
45.120.80.106	Hong Kong, China
45.145.73.105	Washington, United States
45.195.148.73	Manila, Philippines
8.210.94.213	Hong Kong, China
8.217.110.88	Hong Kong, China
8.217.69.130	Hong Kong, China
8.218.138.126	Hong Kong, China

Appendix B. IOC – Hashes

64B07B1C385CF94A3559E323009F7641
30917B5ABB991DF495827A9D7C7EBCBC
543023ACE4F10B736C4C4109E005F0EF
B591EE37860F35A788B10531A00BBBD2
3B4C845044154DD151796ECC9FEBF395
D1D9D197AF176CDB6570E6D348A789D7
9FE20B85E9F9F3D9EE075EE5764A7078
A9B75DCF502593A6F0EF47A3CEBB4822

Appendix C. IOC – URLs

hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/updat.txt
hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/updat.exe
hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/crashreport.dll
hxxps://yyupdats[.]s3.ap-southeast-1.amazonaws.com/updat.log
hxxps://yy-service[.]s3.ap-northeast-2.amazonaws.com/yy.txt
hxxps://yy-service[.]s3.ap-northeast-2.amazonaws.com/yyex.exe
hxxps://yy-service[.]s3.ap-northeast-2.amazonaws.com/crashreport.dll
hxxps://yy-service[.]s3.ap-northeast-2.amazonaws.com/yyex.log

Appendix D. MITRE ATT&CK mapping

Tactic	ATT&CK ID	Technique Name	Component	Description/Indicator
Initial Access	T1566.002	Phishing: Spearphishing Link	Link	Link uses `#` to trick users into thinking they are downloading an image file (`.jpg`), but it actually downloads a `.pif` file.
Initial Access	T1204.002	User Execution: Malicious File	Dropper	User executes the `.pif` file while believing they are opening an image file.
Defense Evasion	T1553.002	Subvert Trust Controls: Code Signing	Dropper, crashreport.dll	Uses the digital signature of “Portier Global Pty Ltd”.
Defense Evasion	T1564.003	Hide Artifacts: Hidden Window	Dropper	Hides the window via the `ShowWindow` API when no debugger is detected.
Defense Evasion	T1140	Deobfuscate/Decode Files or Information	Dropper	Base64 decodes to reveal the URL for downloading malicious files.
Defense Evasion	T1497	Virtualization/Sandbox Evasion	Dropper	Sleeps randomly within segments of the malicious code.
Defense Evasion	T1497.001	Virtualization/Sandbox Evasion: System Checks	APT Loader	Checks CPU core configuration and RAM before proceeding.
Defense Evasion	T1036.005	Masquerading: Match Legitimate Resource Name or Location	Dropper	Masquerades as a Windows Update file when downloading malware to `C:\Users\<user>\AppData\Local\Microsoft\WindowsUpdate\Cache\`.
Defense Evasion	T1564.001	Hide Artifacts: Hidden Files and Directories	Dropper	The malware download directory is configured with Hidden and NotContentIndexed attributes.
Defense Evasion	T1036.004	Masquerading: Masquerade Task or Service	APT Loader	Creates a service named “Windows Eventn”.
Defense Evasion	T1620	Reflective Code Loading	APT Loader	Loads the decoded DLL after loading `crashreport.dll`.
Defense Evasion	T1070.004	Indicator Removal: File Deletion	APT Loader	Deletes the file and terminates the program.
Defense Evasion	T1070.001	Indicator Removal: Clear Windows Event Logs	APT Loader	Clears Windows Event Logs.
Defense Evasion	T1070.010	Indicator Removal: Relocate Malware	APT Loader	Copies malicious files to `C:\Users\Admin\Videos\XXXXXXXX@27`.
Defense Evasion	T1070.009	Indicator Removal: Clear Persistence	Dropper	Deletes the `SystemOptimizer` key in the registry `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Dropper	Adds the `SystemOptimizer` key in the registry `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.
Persistence	T1574.001	Hijack Execution Flow: DLL	APT Loader	Loads `crashreport.dll`.
Persistence	T1543.003	Create or Modify System Process: Windows Service	APT Loader	Copies malicious files to another location and points the “Windows Eventn” service to them.
Execution	T1059	Command and Scripting Interpreter	APT Loader	Executes commands received from the C&C (Command & Control).
Privilege Escalation	T1548.002	Abuse Elevation Control Mechanism: Bypass User Account Control	APT Loader	Reruns the program with Admin privileges.
Command and Control	T1105	Ingress Tool Transfer	Dropper	Downloads additional files: `updat.exe`, `crashreport.dll`, `updat.log`.
Credential Access	T1555	Credentials from Password Stores	APT Loader	Deletes browser data for Chrome, Firefox, 360SE6, 360 Chrome, Sogou, and QQ.

Appendix E. List of Backdoor modules

Convention code	Function
5431	DllFile plugin
5477	DllScreen plugin
5452	DllScreenHide plugin
3214	Empty
5492	DllKeybo plugin
5513	DllShell plugin
5496, 5487	Empty
5511	DllMsgBox plugin
5497	DllSyste plugin
5548	Empty
3217	fnProxy plugin
2446	ConnSocks plugin
3216	Kill explorer.exe
3215	Re-run the programme with admin privileges
5527	DllSerSt plugin
5520, 5521, 5522	Write and execute file
3210	Download plugin from C2
2447	Download plugin from C2
5515	Remove traces and exit the programme
5514	Exit module
5525	Prepare registry
5512	ConnectGroup plugin
5516	Clear Windows Log
5519	Run specified process
5524	DllOpenURLSHOW plugin
5523	DllOpenURLHIDE plugin
3221	Kill specified process
3222	Delete all files in a specified folder
3225	Get the process file path
2448	Download plugin from C2
2449	onBootup plugin
3223	Run .bat file if cmd.exe does not exist
3224	Terminate cmd.exe if it exists
3227	Clear Internet Explorer history
3228	Clear Skype data
3229	Clear Chrome browser data
3230	Clear Firefox browser data
3231	Clear 360SE6 browser data
3232	Clear 360 Chrome browser data
3233	Clear Sogou browser data
3234	Clear QQ browser data

References

Thieu Ha, Duong Tran, Huy Nguyen from CyStack Security

Analysis of Suspected Malware Linked to APT-Q-27 Targeting Financial Institutions

Our Research

Our Research

Analysis of Suspected Malware Linked to APT-Q-27 Targeting Financial Institutions

Overview

Context

Scoping and Investigation

Assessment

Attack Chain Overview

Detailed Technical Analysis

Initial access stage

Dropper execution

Loader execution

Backdoor execution

Relationship to Known Attack Campaigns

Recommendations for Enterprises

Appendix

Appendix A. System compromise indicators (IOC) – Control servers

Appendix B. IOC – Hashes

Appendix C. IOC – URLs

Appendix D. MITRE ATT&CK mapping

Appendix E. List of Backdoor modules

References

About the author

Related posts

Overview

Context

Scoping and Investigation

Assessment

Attack Chain Overview

Detailed Technical Analysis

Initial access stage

Dropper execution

Loader execution

Backdoor execution

Relationship to Known Attack Campaigns

Recommendations for Enterprises

Appendix

Appendix A. System compromise indicators (IOC) – Control servers

Appendix B. IOC – Hashes

Appendix C. IOC – URLs

Appendix D. MITRE ATT&CK mapping

Appendix E. List of Backdoor modules

References