Skip to content
MalwareWiki

Malware

GONEPOSTAL

aka Cordyceps · NOTDOOR

The malware consists of a dropper DLL and an obfuscated, password protected VbaProject.OTM file, which houses macros written for Microsoft Outlook.

GONEPOSTAL, also known as Cordyceps, NOTDOOR, is a Windows malware family operated by APT28.

Background

The malware is made up of a dropper DLL plus an obfuscated, password-protected VbaProject.OTM file containing macros built for Microsoft Outlook. It originated as a backdoor proof-of-concept named Cordyceps, authored by Greg Linares and showcased at Hushcon in 2017.

Source: Malpedia (Fraunhofer FKIE).