More_eggs

The URLs link to a landing page that spoofs a real talent and staffing management company... The landing page initiates a download of a Microsoft Word file.

These campaigns demonstrated considerable variability... Completely benign emails without a malicious attachment or URL attempting to further establish rapport.

In other cases, this actor used an attached PDF with embedded URLs or other malicious attachments... some campaigns also used malicious attachments instead of URLs in the email.

once the recipient replies to the initial email, the actor was observed responding with a URL linking to an actor-controlled website posing as a candidate resume

Initially the actor uses a fraudulent, but legitimately created LinkedIn profile to initiate contact with individuals at the targeted company by sending invitations with a short message.

it attempts to create a new regsrv32 process to execute the DLL using Windows Management Instrumentation (WMI) ... Subsequently, it initiates the creation of the MSXSL process using the WMI service.

download and execute a scriptlet from a location stored in the "ie4uinit.inf" file

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

Figure 4: Example malicious Microsoft Word document that uses macros to download More_eggs.

In other cases, the landing page may initiate the download of a JScript loader instead, but this intermediate malware still ultimately results in the delivery of More_eggs... More_eggs is malware written in JScript.

If the recipient enables macros, the “More_eggs” payload will be downloaded and executed.

Persistence T1547.001 ... By modifying the registry, the threat actor achieves a permanent presence on the system.

The LNK, if executed, abuses legitimate software functions in "ie4uinit.exe" to download and execute a scriptlet from a location stored in the "ie4uinit.inf" file.

Persistence T1547.001 ... By modifying the registry, the threat actor achieves a permanent presence on the system.

The LNK, if executed, abuses legitimate software functions in "ie4uinit.exe" to download and execute a scriptlet from a location stored in the "ie4uinit.inf" file.

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

The LNK, if executed, abuses legitimate software functions in "ie4uinit.exe" to download and execute a scriptlet

it attempts to create a new regsrv32 process to execute the DLL using Windows Management Instrumentation (WMI)

The DLL employs anti-sandbox and anti-analysis techniques. It incorporates a loop specifically designed to retrieve the RC4 key necessary for deciphering the More_Eggs backdoor. This loop is strategically crafted to extend its execution time, enhancing its evasion capabilities within a sandbox environment.

the DLL employs multiple checks to determine if it is currently being debugged, utilizing the NtQueryInformationProcess function

The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

More_eggs periodically connects to a neutral website to determine whether the compromised system is connected to the internet or not.

During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

In addition to its ability to download additional payloads, More_eggs has extensive capabilities to profile the infected machine.

The DLL employs anti-sandbox and anti-analysis techniques. It incorporates a loop specifically designed to retrieve the RC4 key necessary for deciphering the More_Eggs backdoor. This loop is strategically crafted to extend its execution time, enhancing its evasion capabilities within a sandbox environment.

More_eggs looks for security program processes on the victim’s system, and sends that information to the threat agent’s server.

the DLL employs multiple checks to determine if it is currently being debugged, utilizing the NtQueryInformationProcess function

The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

If the recipient enables macros, the “More_eggs” payload will be downloaded and executed... More_eggs is often used as a downloader. In addition to its ability to download additional payloads...

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.