Bisonal Malware Used in Attacks Against Russia and South Korea

Table 1. File hashes and paths targeting Russia The dropper then creates following registry entry to execute the Bisonal sample when the computer reboots: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez” Bisonal main module The DLL (pvcu.dll) is Bisonal malware but using a different cipher for C2 communication that other pub