inicore_v2.3.30.dll

The malware inicore_v2.3.30.dll is a harmful program designed to exploit and damage computer systems, often infiltrating them via suspicious downloads, emails, or websites without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. This particular malware has been identified as a variant of Budworm’s SysUpdate backdoor, referred to as SysUpdate DLL inicore_v2.3.30.dll. This variant was leveraged in an attack described in an advisory published by our team. This malware was previously used in Emissary Panda attacks where it was sideloaded to run the SysUpdate tool. A code comparison between the PYTHON33.dll file uploaded to a webshell and the inicore_v2.3.30.dll file revealed similarities, indicating a possible link between the two. The comparison was illustrated in Figure 9, showing the PYTHON33.dll (right) and inicore_v2.3.30.dll (left), with SHA256: 4d65d371a789aabe1beadcc10b38da1f998cd3ec87d4cc1cfbf0af014b783822. The malware uses various keys, including 'Bin' for the payload file name, 'Dll' for the hijacked DLL used to run the payload, and 'OnlineHelp' which stores the Command & Control IP. Other keys include 'Console', 'Group', and 'MD5'. In the samples analyzed, the key values remained consistent, with 'sys.bin.url' for Bin, 'inicore_v2.3.30.dll' for Dll, and 'HjDWr6vsJqfYb89mxxxx' for MD5. These findings suggest that Budworm, also known as LuckyMouse, Emissary Panda, or APT27, has deployed this previously unseen variant of its SysUpdate backdoor.