Malware
AppleChris
According to Unit 42, AppleChris is a custom Windows backdoor implemented as multiple Portable Executable (PE) binaries (EXEs and DLLs) that support flexible deployment, including DLL hijacking via th
AppleChris is a Windows malware family operated by CL-STA-1087.
Background
Per Unit 42, AppleChris is a bespoke Windows backdoor delivered as several Portable Executable (PE) binaries (EXEs and DLLs) that allow flexible deployment, including DLL hijacking through the Volume Shadow Copy Service. It offers full remote-access functionality, including drive and directory enumeration, file upload, download and deletion, process listing and creation, and interactive shell execution, all driven over HTTP with custom verbs and RSA/AES-encrypted C2 traffic. The backdoor follows a dead drop resolver model in which C2 IP addresses are fetched and decrypted at runtime, originally through a combined Dropbox plus Pastebin scheme (the Dropbox variant) and later through a Pastebin-only approach (the Tunneler variant). The newer Tunneler variant also adds a proxy tunneling command that builds reverse TCP tunnels for pivoting across the network, and it relies on delayed execution and mutex-based single-instance checks to dodge detection.
Source: Malpedia (Fraunhofer FKIE).