Reverse-engineering DUBNIUM

This report analyzes the DUBNIUM (DarkHotel-linked) first-stage downloader, describing how the binary disguises itself as an SSH/OpenSSL tool, encodes and wipes strings from memory, performs extensive anti-analysis and geolocation/environment checks, and uses mshta.exe (after distribution via a Flash zero-day or spear-phishing LNK) to retrieve a second-stage payload; the report includes numerous SHA1 IoCs and implementation details useful for detection and reverse engineering.