APT31__2021__APT31_new_dropper._Target_destinations_Mongolia_Russia_the_U.S._and_elsewhere.pdf

Positive Technologies' PT ESC analyzed dropper and RAT samples attributed to APT31 (Judgment Panda), detailing how droppers create C:\ProgramData\Apache (and variants), sideload a malicious MSVCR100.dll, download and decrypt payloads from unencrypted C2 servers, achieve persistence via registry Run keys, and implement a command set for reconnaissance, file operations, process creation and exfiltration; the report includes IOCs (file hashes, domains, IPs), network diagrams, MITRE technique mappings, and notes stolen code-signing and multi-country targeting (Mongolia, Russia, US, etc.).