A Bitter Downloader Stalls Before It Beacons, Then Gives Itself Away
A Windows downloader tied to the Bitter espionage group delays execution with debugger and sandbox checks before running its payload, fronted by a phishing site whose certificate impersonates an overdue Aliyun billing notice. Its outbound traffic ultimately trips a named IDS signature written specifically for Bitter check-ins, undercutting the anti-analysis effort.
A Windows downloader tracked to the Bitter espionage cluster spends its opening moments doing nothing that looks like malware at all — it waits, it checks the clock, it looks for a debugger, and only then does it drop and run its actual payload. That patience is the story. The file (90fd32f8f7b494331ab1429712b1735c3d864c8c8a2461a5ab67b05023821787), a 52KB Win32 executable masquerading under the internal name "Windows," pairs that stalling behavior with a phishing front built on two…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read