Microsoft Word - ASERT Threat Intelligence Brief 2014-07 Illuminating Etumbot APT.docx

ASERT's brief analyzes the Etumbot backdoor (linked to Numbered Panda/IXESHE), detailing its two-stage installer/dropper and backdoor components, spearphishing delivery (often .7z/.rar with RTLO and password protection), persistence mechanisms, RC4-encrypted HTTP C2 protocol and commands (execute, upload, download, sleep, uninstall), use of HTran bouncers, associated file artifacts and numerous MD5s and C2 IPs/domains. The report includes campaign timelines (2011–2014), decoy documents targeting Taiwanese/Japanese interests, detection artifacts (byte-string/string-stacking), and actionable IoCs for network and host-based detection.