MIXEDKEY

TELESHIM creates a scheduled task named shimgen that runs every 6 minutes and executes the binary from C:\programdata\shimgen_Data\shimgen.exe... the threat actor created a scheduled task named Feedback that runs every 10 minutes and launches the legitimate binary.

TELESHIM creates a scheduled task named shimgen that runs every 6 minutes and executes the binary from C:\programdata\shimgen_Data\shimgen.exe... the threat actor created a scheduled task named Feedback that runs every 10 minutes and launches the legitimate binary.

TELESHIM creates a scheduled task named shimgen that runs every 6 minutes and executes the binary from C:\programdata\shimgen_Data\shimgen.exe... the threat actor created a scheduled task named Feedback that runs every 10 minutes and launches the legitimate binary.

TELESHIM and MIXEDKEY used heavy code obfuscation techniques leveraging control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates to hinder reverse engineering.

The final payload is encrypted using two layers of XOR encryption... MIXEDKEY decrypts the payload and reflectively loads it.

The threat actor leveraged environmental keying by encrypting BINDCLOAK using a decryption key derived from the infected machine’s volume serial number.

MIXEDKEY is a Windows 64-bit DLL whose main purpose is to decrypt the contents of C99F29AC08454855B3D538960BB2F34F.PCPKEY, and reflectively load it.

Download and execute messages... uses document.file_id parsed from the JSON response to fetch the file via /bot<TOKEN>/getFile?file_id=<FILE_ID>. The downloaded file is decrypted... and scheduled tasks are used to launch the dropped binary.