APT41__2019__LOWKEY_Hunting_for_the_Missing_Volume_Serial_ID.pdf

FireEye analyzes DEADEYE droppers and the LOWKEY passive backdoor used by APT41, detailing a multi-stage infection chain that employs RC5/RC4 encrypted payloads, a reflective loader, and a user-mode rootkit (NetAgent) to enable covert activation (passive TCP/HTTP listeners), named-pipe communications, remote shell, file operations, and TCP relay; the report includes technical TTPs and numerous indicators (MD5s, derived volume-serial keys, C2 artifacts) and demonstrates methods used to brute-force volume-derived RC5 keys to recover payloads.