Check Point Blind Eagle MAR 2025

Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths. Remcos can also employ control flow flattening to hinder analysis.

HeartCrypt can pack malicious Windows x86 and .NET payloads in order to evade detection.

PureCrypter has used SmartAssembly and NET-Reactor for string encryption and control flow obfuscation.

PureCrypter can retrieve the username from targeted machines.

PureCrypter can maintain persistence with scheduled tasks.

PureCrypter can enumerate processes on compromised hosts.

PureCrypter can execute PowerShell commands to exclude files from EDR and to self-delete.

PureCrypter can enumerate a targeted system's SerialNumber and Version.

PureCrypter can download additional payloads for execution on the compromised host.

Remcos can serialize collected data with Protobuf.

PureCrypter can decrypt downloaded resources and parse internal files to determine its settings.

HeartCrypt can decrypt payloads prior to execution.

APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload. APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.

PureCrypter can identify installed antivirus solutions.

PureCrypter can set `ProcessWindowStyle.Hidden` to hide windows on victim machines.

Remcos can set `ProcessWindowStyle.Hidden` to hide windows.

APT-C-36 has sent emails containing a link that appear to lead to an urgent notification from a government institution, at times using URL shorteners like cort[.]as, acortaurl[.]com, and gtly[.]to.

Remcos has used dynamic DNS domains in C2 communications.

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.

PureCrypter can use AES to encrypt system information sent to the C2.

APT-C-36 has acquired domains to host malicious payloads.

APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.

APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.

APT-C-36 utilizes tools well known in crime communities and has obtained and used a modified variant of Imminent Monitor.