APT28__2018__20180713_CSE_APT28_X-Agent_Op-Roman_Holiday-Report_v6_1.pdf

This report analyzes a multi-stage malware campaign attributed to APT28 (X‑Agent), describing four Delphi-based droppers (two UPX-packed), a secondary payload upnphost.exe that embeds an AutoIt script and communicates via HTTPS to multiple C2 IPs (45.124.132.127, 46.183.218.37) and a Delphi DLL (sdbn.dll) resolving to marina-info.net; it documents persistence, network traffic, WHOIS data, VirusTotal detection results, extracted IOCs (hashes, domains, IPs), and YARA rules for detection.