TELESHIM

TELESHIM creates a scheduled task named shimgen that runs every 6 minutes and executes the binary from C:\programdata\shimgen_Data\shimgen.exe.

If the decrypted message.text is not the string 13, it is parsed as a command and executed using cmd.exe /C by calling CreateProcessA.

When the host executable reaches that point in its startup, the trampoline fires and execution enters the implant's main payload. By redirecting execution via an installed hook, the code is executed in the context of the host executable to evade security tools.

TELESHIM creates a scheduled task named shimgen that runs every 6 minutes and executes the binary from C:\programdata\shimgen_Data\shimgen.exe.

TELESHIM creates a scheduled task named shimgen that runs every 6 minutes and executes the binary from C:\programdata\shimgen_Data\shimgen.exe.

TELESHIM and MIXEDKEY used heavy code obfuscation techniques leveraging control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates to hinder reverse engineering.

The final payload is encrypted using two layers of XOR encryption... MIXEDKEY decrypts the payload and reflectively loads it.

TELESHIM uses multiple anti-analysis techniques to evade automated analysis environments... checks bit 31 of the ECX register to detect the presence of a hypervisor... If bit 31 of ECX is set, execution terminates.

TELESHIM leverages Windows Management Instrumentation (WMI) to execute the following WMI query to check RAM speed. wmic memorychip get speed

When the host executable reaches that point in its startup, the trampoline fires and execution enters the implant's main payload. By redirecting execution via an installed hook, the code is executed in the context of the host executable to evade security tools.

Network reconnaissance ipconfig /all ipconfig /displaydns netstat -ano Discover information about the system's network configuration and active network connections.

System reconnaissance net user ... Discover information about current users

netstat -ano ... Discover information about the system’s network configuration and active network connections.

tasklist ... Discover information about current users, list of running processes, and the hostname of the infected machine.

hostname ... Discover information about current users, list of running processes, and the hostname of the infected machine.

File reconnaissance dir c:\Users dir c:\Users\ \desktop dir c:\Users\ \Downloads dir C:\ProgramData\Crypto\DSS\ dir C:\ProgramData\ dir C:\ProgramData\Lenovo dir C:\ProgramData\Intel

TELESHIM uses multiple anti-analysis techniques to evade automated analysis environments... checks bit 31 of the ECX register to detect the presence of a hypervisor... If bit 31 of ECX is set, execution terminates.

TELESHIM leverages Windows Management Instrumentation (WMI) to execute the following WMI query to check RAM speed. wmic memorychip get speed

TELESHIM abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic.

In the next phase, TELESHIM enters a polling loop by sending HTTP GET requests to the following URL to fetch updates: https://api.telegram.org/bot /getUpdates?offset=

TELESHIM abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic.

Download and execute messages... uses document.file_id parsed from the JSON response to fetch the file via /bot<TOKEN>/getFile?file_id=<FILE_ID>. The downloaded file is decrypted... and scheduled tasks are used to launch the dropped binary.