Procedure examples

For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.

For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.

For Operation Spalax, the threat actors used XOR-encrypted payloads.

For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.

During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.

For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.

During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.

During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.

During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers.

During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.

During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.

During Operation Spalax, the threat actors sent phishing emails to victims that contained a malicious link.

For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure.

For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.

For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.

For Operation Spalax, the threat actors obtained packers such as CyaX.

For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.