EARTH PRETA MIXES LEGITIMATE AND MALICIOUS COMPONENTS TO SIDESTEP DETECTION

Summary from the TLDR InfoSec newsletter

Trend Micro's Threat Hunting team analyzed a new technique from the Earth Preta APT group, Earth Preta, and found that its attack chain begins with the IRSetup.exe dropper, which drops a collection of legitimate decoy files and malicious components and opens a decoy PDF. In the background, the malware launches a legitimate EA Origin application to sideload a modified variant of the TONESHELL backdoor that injects shell code via Microsoft Application Virtualization Injector (MAVInject.exe) if ESET anti-malware is detected or directly into the processes if it is not.