Loading malware…
Bookworm is a modular Windows Trojan/remote access Trojan (RAT) first observed in 2015 and tracked by Palo Alto Networks Unit 42. It was initially identified in campaigns primarily targeting Thailand, including Thai government entities, and later linked with high confidence to the Chinese threat actor Stately Taurus, also referred to in the content as Mustang Panda. More recent reporting describes Bookworm activity targeting organizations in Southeast Asia, including ASEAN-affiliated entities.
Bookworm is delivered via spear-phishing and decoy files, including legitimate Adobe Flash Player installers and Flash slideshow executables themed around Thai current events. It uses DLL side-loading for execution, including abuse of legitimate signed binaries such as Microsoft Malware Protection MsMpEng.exe and Kaspersky Anti-Virus ushata.exe. In one newer campaign, a legitimate executable signed by an automation organization loaded a malicious DLL named BrMod104.dll, a PubLoad stager used to retrieve a second shellcode-based payload. Early Bookworm chains used Smart Installer Maker and a self-extracting RAR to drop a legitimate executable, Loader.dll, and readme.txt; Loader.dll decrypted shellcode from readme.txt, which then manually loaded the main Bookworm component, Leader.dll. Recent variants replaced the older Loader.dll/readme.txt packaging with UUID-encoded shellcode decoded with UuidFromStringA and executed via callback functions such as EnumChildWindows, EnumSystemLanguageGroupsA, or EnumSystemLocalesA.
The malware has little malicious functionality built in beyond collection, but its modular architecture allows it to load additional modules directly from command-and-control (C2) infrastructure. Core documented capabilities include keylogging and clipboard theft through KBLogger.dll, which creates a hidden window and stores encrypted logs under %AllUsersProfile%\Application Data\Microsoft\Crypto\RSA\MachineKeys<crc32 hash>bk. Unit 42 also states Bookworm supports arbitrary command execution, file upload and download, data exfiltration, and persistent access. Embedded modules identified in memory include Resolver.dll, Mover.dll, Coder.dll, Digest.dll, AES.dll, Network.dll, HTTP.dll, WinINetwork.dll, and KBLogger.dll. Modules are loaded in memory and export ProgramStartup.
For persistence, Bookworm creates a Windows service named "Microsoft Windows DeviceSync Service" under HKLM\SYSTEM\CurrentControlSet\Services\DeviceSync\ and modifies related registry values, including ImagePath, to trigger execution at system start. It masquerades this service as legitimate. It also stages files under %AllUsersProfile%\Application Data\Microsoft\DeviceSync\ and uses HKLM\SOFTWARE\Microsoft\Internet Explorer\Registration\ProductID as RC4 key material for decrypting staged components and KBLogger data. Bookworm has also modified file timestamps from the export address table to hinder analysis, used valid legitimate digital signatures and certificates to evade detection, and modified HTTP POST requests to resemble legitimate communications. PubLoad- and Bookworm-related traffic has masqueraded as Microsoft Windows update traffic, including fake Windows Update-style URL paths.
Known C2 and infrastructure indicators mentioned in the content include bkmail.blogdns[.]com, debain.servehttp[.]com, linuxdns.sytes[.]net, news.nhknews[.]hk, sswmail.gotdns[.]com, sswwmail.gotdns[.]com, sysnc.sytes[.]net, systeminfothai[.]gotdns.ch, thailandbbs.ddns[.]net, ubuntudns.sytes[.]net, web12.nhknews[.]hk, www.fjke5oe[.]com, update.fjke5oe[.]com, and www.hbsanews[.]com, as well as IPs 123.253.32[.]15, 103.27.202[.]80, 103.27.202[.]68, 103.27.202[.]87, and 119.205.158.70. Specific hashes mentioned include BrMod104.dll SHA256 2a00d95b658e11ca71a8de532999dd33ddee7f80432653427eaa885b611ddd87 and a related ToneShell sample SHA256 b382cc85eee95a620fc11370309ff76de9a3bcaefb645790434d8251a3b9fce1. Unit 42 also identified overlap between Bookworm and ToneShell through shared debug path C:\Users\hack\Documents\WhiteFile\LTDIS13n\Release\LTDIS13n.pdb, shared infrastructure, and similar UUID-based shellcode loading techniques.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
First observed in 2015, Bookworm functions primarily as an advanced remote access Trojan (RAT), granting its operators extensive control over compromised systems.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
have access to compromised web servers that could facilitate strategic web compromise (SWC) as an attack vector in the future | We also speculate that these threat actors may use strategic web compromises (SWC) as an attack vector in future campaigns using their unauthorized access to webservers.
"BOOKWORM ... execution on the heap is initiated through callback function of legitimate API functions such as EnumChildWindows or EnumSystemLanguageGroupsA"; "CLAIMLOADER ... run its shellcode through the callback function"; "PUBLOAD stager leveraged Windows API functions with callback ... to bypass anti-virus monitoring"
The decoded shellcode decrypts and loads dynamic-link libraries (DLLs) that comprise the Bookworm malware... The Bookworm malware family consists of multiple modules, each of which support the main Leader.dll module by providing additional functionality.
The payloads shown in Table 1 are loaders that contain embedded shellcode... Creating a buffer on the heap using HeapCreate and HeapAlloc... Copying shellcode to buffer on the heap... Using a callback function of a legitimate API function, such as EnumChildWindows or EnumSystemLanguageGroupsA to execute the shellcode on the heap.
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.
The payloads shown in Table 1 are loaders that contain embedded shellcode... Creating a buffer on the heap using HeapCreate and HeapAlloc... Copying shellcode to buffer on the heap... Using a callback function of a legitimate API function, such as EnumChildWindows or EnumSystemLanguageGroupsA to execute the shellcode on the heap.
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
Using ASCII or decoded Base64 strings that represent UUID strings. Calling UuidFromStringA to convert the decoded UUIDs to binary data, each of which represents 16 bytes of shellcode.
The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.
The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.
Use of large command and control (C2) infrastructure, which heavily favors dynamic DNS domains for C2 servers.
This particular PubLoad payload communicates with its C2 server by directly connecting to the IP address 123.253.32[.]15. The payload then issues an HTTP request... The HTTP request includes www.asia.microsoft.com within the host field as an attempt to masquerade as a legitimate request associated with the Windows operating system.
109 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware referenced as part of China-linked activity targeting Asian telecom/ASEAN networks; no further details in excerpt.
... Theft of Operational Information ... BOOKWORM ... (v1.0) ...
BOOKWORM (v1.0)
Advanced modular RAT used by Mustang Panda since 2015 for command execution, file upload/download, data exfiltration, and persistence; uses legitimate-looking or compromised infrastructure for C2; delivered via DLL side-loading, with newer variants encoding shellcode as UUID strings that are decoded and executed; supports loading additional modules from C2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.