A DETAILED ANALYSIS OF THE MENORAH MALWARE USED BY APT34

Summary from the TLDR InfoSec newsletter

In this blog post, the researchers describe a detailed analysis of the Menorah Malware, originally discovered by Trend Micro in August and used by APT34. The malware creates a mutex to ensure only one copy runs at a time and extracts the hostname and username to compute a hash that identifies the infected machine. It can perform commands such as creating new processes, listing files and subdirectories, exfiltrating files, and downloading files using a hard-coded C2 server.