What indicators miss: geo-aware malware and two hidden backdoors

Executive summary

We examine this through two investigations. In both, the VMRay sandbox recorded the samples’ behaviour during execution. We also used manual reverse engineering to recover what the samples keep hidden.

The first investigation examines a lookup that is easy to misread. When malware asks an IP lookup service for its location, the request alone is often treated as sandbox evasion. It should not be. We studied 726 unique samples that made such a lookup. Only 58 then compared the returned country against an exclusion list and quit on a match. The other 668 looked up their location but did not follow those steps. That gives a gate rate of about 8% for this set of location-aware samples, using our own definition of a gate. A location lookup can mean different things in different samples. Only the behaviour around the request tells them apart.

The second investigation shows what a file hash hides. We examined fifteen files tied to the publicly reported UnsolicitedBooker activity and reverse engineered two backdoors from them: MarsSnake and LuciDoor. The sandbox recorded what they did during execution, but running the samples alone does not print the specific values a defender needs. MarsSnake keeps its configuration and keys encoded and only rebuilds them in memory. LuciDoor is packed inside the LuciLoad loader rather than provided as a separate file.

We wrote small unpackers and decoders to extract those values. Both LuciLoad samples yielded the same hidden LuciDoor DLL. From MarsSnake, we recovered its command-and-control addresses and ports, the key used to scramble its traffic, and the strings hidden from a plain file scan. Defenders need these exact values for precise rules. None appear in the file hash alone.

The regional context comes from public reporting. ESET documented MarsSnake against an international organisation in Saudi Arabia in January 2025 [1]. Positive Technologies later reported MarsSnake and LuciDoor against telecommunications organisations in Central Asia [2]. The location study uses a separate, much larger sample set, unconnected to these campaigns. We deliberately ran it alongside the backdoor work. Both investigations approach the same point from different directions: an indicator alone tells you little until you see what the sample does.

Both investigations lead to the same conclusion. An indicator tells you what to look for. The behaviour recorded by the sandbox, together with the code and data recovered through reverse engineering, explains what it means and what to do about it. Combining this evidence turns an indicator into a detection.

1. Introduction and method

A location-service request can appear in a threat feed without an explanation of the decision that follows it. A loader hash can identify a malicious file without revealing the backdoor inside it. Encoded configuration can contain useful addresses even when a strings scan shows none. Each indicator is real, but it lacks context. We recovered that context through VMRay sandbox runs, manual code analysis and extraction tools we built.

The research produced several useful results. We measured country gating across 726 unique location-aware samples, recovered the same LuciDoor payload from two loaders, and extracted MarsSnake’s C2 addresses and ports. We also reconstructed the key material MarsSnake uses to scramble its traffic and checked exact detection strings against public descriptions. For example, LuciLoad’s hidden window title is OneDriveLaucher in our samples, while public reporting gives it as OneDriveLauncher [2]. This difference matters when a rule relies on an exact match.

We combined two methods. VMRay’s sandbox uses hypervisor-based, agentless monitoring to observe behaviour from outside the virtual machine. We examined its function call and network logs, then manually reverse engineered the samples outside the sandbox. Reading the disassembled and decompiled code helped us explain the behaviour recorded by the sandbox. We also used the code to build our unpackers and decoders. An execution shows the path reached in that environment. Code analysis can reveal other paths and recover data without running every capability.

The geolocation study and the backdoor investigation use different datasets and answer different questions. We did not set out to link them, and nothing connects the geolocation samples to the reported MarsSnake or LuciDoor activity.

2. The measurement: profiling versus gating

We started with one question: “What does malware do with the response to a geolocation lookup?” The malware may then collect data, compare the response against a list of countries, or do nothing further. The lookup alone is not evasion. The action that follows, such as quitting after a country match, can point to evasion. Even then, evasion is not the only possible reason.

We started with 912 VMRay analyses and their recorded function calls and network activity. Of these, 908 contacted a geolocation or IP lookup service. The other four never reached one and were set aside. Removing duplicates left 726 unique samples.

We use two labels of our own for these samples. We call a sample a country gater only when its run showed all three steps:

1. A geolocation lookup returned country information.
2. The sample compared the result with at least three country codes.
3. A matching code led to an exit.

The comparisons used two-letter country codes such as DE, GB and US. We call every other location-aware sample a profiler: it contacted a lookup service but did not take all three steps. The label does not mean that a sample only sent its location to a C2 server or that it had no other checks. Figure 1 explains the distinction.

The public IP address seen by the service determines the returned location. Routing through a VPN or proxy can therefore change the answer. The gate compares the country code associated with that public IP address, not the machine’s physical location.

Of the 726 unique samples, 58 met the gating criteria and 668 did not. That is a gate rate of about 8%.

A conventional 95% Wilson interval for 58 of 726 is 6.23% to 10.19%. This binomial calculation does not correct for how the dataset was selected or which families it contains. The samples were not drawn at random from all malware, and related builds may not count as independent observations. The interval therefore does not establish a rate for malware as a whole. Figure 2 presents the counts and the dataset they describe.

Figure 3 follows one sample from its request to its exit, using its VMRay function log. The trace shows a request to ip-api.com and a response containing country code DE. The sample compares that code with its exclusion list and calls ExitProcess after a match. The request alone would not explain why execution stopped.

All 58 gaters were classified by VMRay as Twizt/Phorpiex. Our analysis recorded the same ten-country exclusion list in each sample. Table 1 lists its members alphabetically.

Table 1. Countries in the exclusion list used by Phorpiex.

The repeated list helps group these samples. It does not identify an operator or explain why those countries were selected. Avoiding analysis is one possible reason for a country restriction, but the observed comparisons do not settle that question.

Our criteria also limit the measurement. They require at least three country comparisons and an exit after a match. A one-country gate, a delayed decision or behaviour on a path not reached during analysis may fall outside the classification. The 668 remaining samples cannot be treated as a verified group of malware that only profiles victims.

Vendors and analysts should preserve this distinction. Report a lookup when one is observed. Report a country gate when the response controls an exit. Assign an evasion purpose only when further evidence supports it.

3. The UnsolicitedBooker toolset: MarsSnake and LuciDoor

We examined fifteen files associated with the publicly reported activity: three macro documents, one RAR archive, two MarsSnakeLoader builds, two LuciLoad builds and seven MarsSnake builds. We also examined the LuciDoor DLL recovered from both LuciLoad samples. The file indicators appear in Table 4.

ESET reported attacks against the same international organisation in Saudi Arabia in March 2023, March 2024 and January 2025. Its MarsSnake account covers the January 2025 campaign, which used a Saudia flight-ticket lure. The earlier attacks involved other backdoors [1]. Positive Technologies reported LuciDoor in Kyrgyzstan in September 2025, MarsSnake there in November, and LuciDoor in Tajikistan in January 2026 [2]. These were separate deployments covered by its investigation.

Figure 4 maps the reported delivery routes to the loader and backdoor each one delivers.

ESET describes UnsolicitedBooker as China-aligned. Positive Technologies describes activity resembling that group and discusses uncertainty about the wider attribution [1,2]. We use the campaign name to identify that reporting context. It is not an independent attribution based on our sample analysis.

Our files contain PE timestamps of 1 August, 6 November and 10 November 2025. These are build metadata, not verified attack dates. Figure 5 keeps the reported campaign dates separate from that metadata.

3.1 Delivery

The document route uses an embedded macro. Where macro execution is permitted, it checks the registry through Windows Management Instrumentation. It then rebuilds a payload from hex text containing xx padding and writes the result with ADODB.Stream.SaveToFile. It waits three seconds before launching the file. The delay alone does not establish an anti-analysis check.

The documents led to different loading chains. Positive Technologies reported LuciLoad in the September 2025 and January 2026 deployments. In November, the document dropped a legitimate, signed Microsoft Plasrv.exe next to a malicious PDH.DLL in a Microsoft\PlayReady folder. When Plasrv.exe ran, Windows loaded the attacker’s PDH.DLL from that folder instead of the genuine system library. This is DLL side-loading. It abuses the search order rather than a flaw in the program. The loaded DLL carried MarsSnakeLoader [2].

The archive route starts with a Chinese-language shortcut about water charges in Chongqing. In the archive we examined, additional files were hidden beneath .__init__ and nested .__MACOS__ directories. The shortcut invokes version.txt. Its ! shell escapes and final bye identify it as an FTP command script rather than an ordinary text document; public reporting describes the same file as a BAT script. The script moves help.log to c:\programdata\help.vbs and runs it. The VBS script then moves and renames plasrv.log to c:\programdata\Oracle\Java\installcache\plasrv.exe and launches it.

We matched plasrv.log to the MarsSnake hash beginning a3f22335, listed in full in Table 4. This route launches the backdoor directly, without a separate MarsSnakeLoader stage. Positive Technologies also describes direct delivery in this archive route [2].

Document metadata provides more clues for grouping files. Positive Technologies reported eastAsia="zh-CN" in Russian-language documents and Generated by Snipaste in embedded-image metadata [2]. Our review also recorded zh-TW in one document. These values may reflect authoring settings or reused templates. They do not prove the author’s location. The archive paths and script contents are stronger clues when combined with the resulting file and process activity.

3.2 The loaders

MarsSnakeLoader and LuciLoad both carry an encoded payload, but use different extraction routines. Recovering the payloads allowed us to inspect the backdoors directly and connect them to the loader files.

MarsSnakeLoader appears as a PDH.DLL proxy and as an executable. It decrypts an embedded block with RC4 and decompresses the result with zlib. In our files, the key is assembled from qio1239djk123sd. and a;13,, producing qio1239djk123sd.a;13,. The parts contain 16 and 5 ASCII bytes, respectively. The decrypted data starts with the zlib header 78 9C and expands into shellcode carrying the 64-bit MarsSnake payload.

The loader maps the payload into memory and prepares its configuration at the OOkupFunction*71N marker before transferring control. This affects extraction because the embedded backdoor’s initial configuration may differ from the one the loader writes. Our unpacker recovered the payload from both loader builds. We examined the configuration values supplied by the loaders as well as those stored in the backdoors. Figure 6 traces the decryption, decompression and configuration write.

Configuration can still be recovered from files on disk. Writing it at runtime does not mean the loader contains no C2 data or that every MarsSnake file lacks an encoded configuration. The direct-delivery build is another example of why both the loader and backdoor need inspection.

The PDH.DLL build forwards the genuine Windows library’s exported function names to C:\Windows\System32\pdh.dll. This lets the legitimate program keep using those functions while the malicious loader executes. A check for missing export names would not expose the proxy. Figure 7 distinguishes this side-loading route from the malicious plasrv.exe launched directly by help.vbs.

Our files contain two useful PDB paths: D:\project\MarsSnake\bin_shellcode\load_http_64.pdb and D:\project\MarsSnake\x64\http\MarsSnake.pdb. These help connect the loader and backdoor builds. ESET’s earlier samples used a different project-root spelling, D:\yu_project\MarsSnake\... [1].

LuciLoad is a 32-bit loader. It records the time with GetTickCount64, calls Sleep(15000), and checks how much time has passed. In our analysis, it exits if less than about 11.25 seconds has passed. This specifically tests whether the requested delay was shortened, which supports an anti-analysis interpretation. The effect depends on how the analysis environment handles sleep and time measurements.

LuciLoad then creates a hidden window through CreateWindowExW. Our samples use the title OneDriveLaucher, with that exact misspelling. Public reporting gives it as OneDriveLauncher [2]. We use the spelling from our own samples for detection, without assuming every variant matches it.

Our unpacker follows four steps:

1. Read bitmap resource type 2 (RT_BITMAP), ID 129. The payload size is at offset 40 and the encrypted payload starts at offset 44.
2. Decrypt the payload with RC4 and the key microsoft.
3. Read the first four decrypted bytes as the uncompressed output size.
4. Decompress the remaining bytes with LZNT1, reproducing the loader’s RtlDecompressBuffer call with argument 0x102.

The loader resolves the decompression function at runtime. Both samples produced the same 40,960-byte x86 DLL, with a valid PE structure. Its SHA-256 is c6f682eea8405a9bbb1454ac68a056a086b117fea611e7f8492f1f7c6b5c2cc7. We checked the extracted structure and output hash rather than relying on an MZ prefix alone. Figure 8 shows the elapsed-time check, the resource decrypt and the recovery of LuciDoor.

3.3 MarsSnake, the backdoor that hides its strings

We analysed seven 64-bit MarsSnake builds, each approximately 65 to 96 KB. Their C2 settings and protocol strings are encoded in the file. Six builds also reconstruct their traffic key material from constants during execution. One stores the full value as readable text, which allowed us to check the reconstruction.

The recovered value, rYB1oDHVMViTRnaGsFw1TbHJ1z1aZ, is a 29-character ASCII string. MarsSnake uses it to XOR the traffic sent to its C2 server and as the basis for its AES key.

MarsSnake rebuilds the 29-character value in memory from fixed numbers compiled into the code. One is the constant 0x4D2BE561B84C932E. In the six obfuscated builds, it is stored as two four-byte halves. A rule that expects all eight bytes together could miss those files. The value rebuilt in memory therefore differs from the pattern visible to a file scanner. Figure 9 shows the stored constants and a worked string-decoding example.

Other strings use a repeating eight-byte XOR key. The decoder selects bytes from the key in little-endian order:

plain[i] = enc[i] XOR ((key64 >> (8 * (i & 7))) & 0xFF)

Two keys recur across all seven builds. 0x2113E7E35DF5010D decodes the completion marker &@&DWJ@*&!@(@#&*(@$&^. 0x7DBD49499DF19131 decodes iphlpapi.dll. MarsSnake loads the library and resolves functions at runtime. Those dynamically resolved functions are therefore absent from its normal import table. The decoder exposes useful strings even when a recorded run has not reached the routines that use them.

The C2 configuration follows the 17-byte marker OOkupFunction*71N. The marker also supplies the repeating XOR key:

cfg[i] ^= marker[i % 17]

After decoding, the configuration fields contain plain-text IPv4 addresses and ports. Across the examined files, we recovered 81.70.28[.]71:8000, 93.157.106[.]75:80 and 5.181.1[.]153:80. Positive Technologies had already reported these addresses [2]. Our decode adds the associated ports and the exact configuration marker. Figure 10 works through the decode and lists the three recovered address and port pairs.

The marker, RC4 key and completion string we recovered also differ from the versions in public reports. We use the values from our own samples for literal matching. Such differences should be checked against the sample bytes before they are treated as errors.

After the handshake, MarsSnake uses a message-type byte at offset 4 to select the command handler. Our code analysis identified the eight commands described by Positive Technologies: single-command execution, a reverse shell, file transfer in both directions, drive enumeration, directory listing, heartbeat and connection termination [2]. The code uses threaded handlers. Message types 5, 6, 7, 9 and 10 reach a completion-marker check that determines whether the loop continues. Figure 11 lists the command identifiers and their functions.

The reverse shell connects a hidden cmd.exe to pipes using CreatePipe, PeekNamedPipe and CreateProcessW. It clears the console quick-edit flag, which can otherwise pause console interaction when text is selected. MarsSnake also derives a host identifier from the computer name, local IP and username, consistent with the method described publicly [2].

MarsSnake’s AES implementation is compiled into the program. The examined imports do not include CryptoAPI or BCrypt, and the communication routine uses WS2_32 sockets. It XORs the message body with the 29-character value, then encrypts the result with AES-128-ECB. The HTTP request is POST /eg.js?t=<unix>. HTTP headers remain outside TLS, while the application body is encrypted.

The client sends the handshake value dsalsjd89w21dcx9cwad@ and checks the response for asdas290e/cz/x213/.14. It decodes these strings for use during execution. Figure 12 shows this exchange separately from the message-protection steps.

3.4 LuciDoor, a separate backdoor that uses TLS

Recovering LuciDoor exposes strings hidden inside LuciLoad’s encrypted resource. The DLL contains readable request paths, proxy strings and OneDrive-related names. These can be used in file scans after unpacking, although they are not directly readable in the encrypted payload.

When its configuration enables persistence, LuciDoor creates a scheduled task that launches LuciLoad at logon. Positive Technologies reported the name OneDrive Launcher and author Microsoft [2]. Our analysis recorded the task under \Microsoft\, with a ten-second delay (PT10S). The executable is disguised as OneDriveLauncher.exe. Its destination depends on privileges, with %ProgramData%\Microsoft OneDrive\setup\ used in the administrator path. The task’s target and related process activity help distinguish it from legitimate software.

The C2 worker disables WoW64 file-system redirection and uses Schannel through the Windows Security Support Provider Interface. It loads Secur32.dll and obtains the interface through InitSecurityInterfaceA. It uses QueryContextAttributes to prepare TLS buffers. The backdoor’s networking code uses the TLS implementation provided by Windows.

LuciDoor first tries a direct connection. If that fails, it reads the configured Windows proxy and tries HTTP CONNECT, SOCKS5 and SOCKS4. If these attempts fail or no proxy is configured, it examines the host’s active TCP connections for possible proxy endpoints. It then repeats the proxy methods [2]. GetTcpTable retrieves the host’s IPv4 TCP table, not just LuciDoor’s own connections [3]. Figure 13 shows the connection selection and proxy fallback order.

The readable string Proxy-Authorization: Basic %s belongs to HTTP proxy authentication, not SOCKS. Proxy negotiation and the TLS-protected application exchange are separate stages. Once established, Schannel protects the application traffic. This does not mean that every earlier proxy-negotiation message is inside TLS.

The recovered configuration includes button.gdakdbysw[.]xyz:443. Positive Technologies reported using a PolarSSL-related TLS fingerprint to identify a compromised MikroTik router serving as C2 infrastructure [2]. This is historical reporting about the server. It does not mean that LuciDoor implements PolarSSL. The certificate description alone is also not a unique indicator.

LuciDoor sends requests to /sys/index.jsp with the User-Agent recorded in Table 6. Inside the TLS session, messages contain RandomSeed, MsgType, MsgMarker and Payload. The protocol uses chained XOR. It also derives a one-byte value from the encoded header to initialise payload encoding. This obfuscates the application data separately from TLS protection [2]. Figure 14 lists the commands and message-stage values.

The command set covers a shell session, staged file transfers and console setup. Command 61 selects Lucida Console and UTF-8 output. Positive Technologies states that this font setting inspired the name LuciDoor [2]. The backdoor also collects the username, computer name, system architecture, language and process integrity information. We identified these capabilities through code analysis.

3.5 How the two backdoors are linked and detected

The backdoors share reported infrastructure but differ in implementation. Positive Technologies connected a LuciDoor deployment to an IP previously used by MarsSnake [2]. Table 2 summarises the technical differences in the builds we examined.

Table 2. MarsSnake and LuciDoor in the analysed samples.

Table 3 summarises the tools we built and what each one recovered or verified.

Table 3. Tools developed during the research and recorded checks.

Figure 15 compares the two backdoors side by side.

The features that survive obfuscation make the best rules. These include MarsSnake’s configuration marker and recurring decoding keys, LuciLoad’s resource layout and exact window title, and LuciDoor’s readable request and task strings. Common strings such as microsoft or Lucida Console need additional conditions. A rule must also match the bytes as stored in the file, including split constants and encoded bytes. Section 6.4 gives the resulting rules.

We tested those rules against the analysed files and a clean corpus. Every sample matched the correct family rule, with no cross-family collisions. There were no matches across C:\Windows\System32, C:\Windows\SysWOW64 and C:\Program Files. This result is limited to that clean-software corpus. It is not a measured false-positive rate for every environment, so the rules still need tuning against local telemetry before deployment.

Behavioural detections should connect task creation, file paths and module loading. Event ID 4698 can record scheduled-task creation when the required auditing is enabled [4]. A task created through COM does not require a schtasks.exe process. For the archive route, inspect ftp.exe -s alongside the script file. Process command lines alone do not reveal the ! commands inside that file.

3.6 Diamond Model summary

Figure 16 summarises the reported actor, capabilities, infrastructure and victims. It combines several events and should be read as a campaign overview. ESET’s attribution and the vendors’ victim reporting remain explicitly sourced. The unrelated geolocation dataset is excluded from this model.

4. What this shows

Each part of the work added information that an indicator does not carry on its own. Following the country responses showed why some samples exit. Starting from a MarsSnake file hash, we recovered its hidden configuration and protocol values. These are the addresses, ports and keys a defender would otherwise have to capture live or miss. Unpacking two LuciLoad files produced the same LuciDoor DLL, which the loader’s own hash does not reveal. Figure 17 pairs each starting indicator with the evidence the analysis added.

Both methods mattered. A sandbox run showed that an exit occurred under a particular condition. A decoder recovered strings without running the whole backdoor. Keeping the trace, decoding method and extracted output with the indicator makes the finding easy to check and reuse.

5. Conclusion and defender guidance

The investigation recovered what the starting indicators left out. We explained why a sample exited after a location check and recovered MarsSnake’s hidden configuration and traffic values, along with the DLL that LuciLoad unpacks. The geolocation measurement also provides a separate lesson: a confirmed country gate is not the same as proof of evasion.

For Middle Eastern defenders, the Saudi MarsSnake campaign provides direct regional context [1]. The public sources place LuciDoor in Central Asia rather than the Middle East. Our technical findings do not establish regional targeting either way.

Investigations should preserve five kinds of evidence:

• The location request, returned country, comparison and resulting action.
• The relationship between the initial file, loader and extracted payload.
• Configuration fields and exact strings in their stored and decoded forms.
• Task creation, module loading and file activity tied to the responsible process.
• Network destinations interpreted alongside host evidence and protocol visibility.

MarsSnake’s HTTP metadata may expose the request path even though the body is encrypted. LuciDoor’s request path is inside TLS, so visibility depends on where it is inspected. A timeout or early exit also needs context. Record the last execution path reached and any unfinished delay or extraction stage before deciding whether to extend the run or continue manual analysis.

6. Indicators of compromise

The tables identify values recovered from samples and context from public reporting. Addresses are defanged. Complete hashes support exact matching. Strings, paths and partial hashes are investigation clues that need supporting evidence. The legitimate service ip-api.com appears in the separate geolocation study; it is not malicious infrastructure or evidence linking the datasets.

6.1 Files (SHA-256)

Table 4. The fifteen analysed files and the recovered LuciDoor DLL (SHA-256).

The partial hash 725d7c51 is only the beginning of a reported hash, so it cannot be used for an exact SHA-256 match.

6.2 Network

Table 5. Recovered endpoints and historical network indicators.

Our extractor recovered the MarsSnake address and port pairs during the research. The addresses were also reported by Positive Technologies [2]. The Saudi domain is historical context from ESET [1].

6.3 Host and behaviour

Table 6. Host, code and behaviour indicators.

Rules that search for readable strings can miss the encoded protocol values in these MarsSnake files. The configuration marker, decoding keys and related code patterns provide alternatives. Task and file-path matches should be checked against the responsible process and file identity.

6.4 Detection rules (YARA)

These rules cover the four backdoor and loader families and provide a hunting aid for the geolocation gaters. The detection patterns come from the obfuscation layer, configuration marker, hardcoded keys, misspelled window title and cleartext request paths. They do not rely on the runtime protocol strings that MarsSnake rebuilds only during execution.

Every analysed sample matched its family rule with no cross-family collisions. Recursive scans of a clean Windows and Program Files corpus produced no matches. LuciDoor ships packed inside LuciLoad, so its rule matches the unpacked payload or a memory image. The gater rules are for hunting rather than precise detection.

rule UnsolicitedBooker_MarsSnake_Backdoor
{
    strings:
        $marker = "OOkupFunction*71N" ascii
        $xor1 = { 0D 01 F5 5D E3 E7 13 21 }
        $xor2 = { 31 91 F1 9D 49 49 BD 7D }
    condition:
        uint16(0) == 0x5A4D and $marker and $xor1 and $xor2
}

rule UnsolicitedBooker_MarsSnakeLoader
{
    strings:
        $rc4 = "qio1239djk123sd." ascii
        $marker = "OOkupFunction*71N" ascii
    condition:
        uint16(0) == 0x5A4D and $rc4 and $marker
}

rule UnsolicitedBooker_LuciLoad
{
    strings:
        $misspell = "OneDriveLaucher" wide
        $rc4 = "microsoft" ascii
    condition:
        uint16(0) == 0x5A4D and $misspell and $rc4
}

rule UnsolicitedBooker_LuciDoor_Backdoor
{
    strings:
        $uri = "/sys/index.jsp" ascii
        $ua = "rv:72.0" ascii
        $task = "OneDrive Launcher" wide
        $exe = "OneDriveLauncher.exe" wide
        $font = "Lucida Console" wide
    condition:
        $uri and ($ua or 2 of ($task, $exe, $font))
}

rule UnsolicitedBooker_MarsSnake_ConfigMarker_Generic
{
    strings:
        $marker = "OOkupFunction*71N" ascii
    condition:
        $marker
}

rule geogate_ipapi_country_lookup
{
    strings:
        $ipapi   = "ip-api.com" ascii wide nocase
        $json    = "GET /json/" ascii wide nocase
        $cc      = "countryCode" ascii wide nocase
        $icanhaz = "icanhazip" ascii wide nocase
        $ipinfo  = "ipinfo.io" ascii wide nocase
    condition:
        $cc and (2 of ($ipapi, $json, $icanhaz, $ipinfo))
}

rule geogate_west_excluding_country_list
{
    strings:
        $geo1 = "ip-api" ascii wide nocase
        $geo2 = "countryCode" ascii wide nocase
        $geo3 = "icanhazip" ascii wide nocase
        $us = "\"US\"" ascii wide
        $se = "\"SE\"" ascii wide
        $ca = "\"CA\"" ascii wide
        $ch = "\"CH\"" ascii wide
        $gb = "\"GB\"" ascii wide
        $li = "\"LI\"" ascii wide
        $nl = "\"NL\"" ascii wide
        $lu = "\"LU\"" ascii wide
        $nz = "\"NZ\"" ascii wide
        $de = "\"DE\"" ascii wide
    condition:
        1 of ($geo*) and 6 of ($us, $se, $ca, $ch, $gb, $li, $nl, $lu, $nz, $de)
}

7. Abbreviations

• ADODB ActiveX Data Objects.
• AES Advanced Encryption Standard; ECB Electronic Codebook mode.
• C2 command and control.
• COM Component Object Model.
• DLL dynamic-link library; PE Portable Executable.
• FTP File Transfer Protocol; HTTP Hypertext Transfer Protocol.
• TLS Transport Layer Security.
• IOC indicator of compromise.
• LZNT1 a Windows compression format.
• MZ the signature at the start of a PE file.
• PDB program database containing debugging information.
• RC4 a stream cipher; XOR exclusive OR.
• Schannel Windows Secure Channel; SSPI Security Support Provider Interface.
• SHA-256 Secure Hash Algorithm, 256-bit.
• TCP Transmission Control Protocol.
• VBS VBScript.
• WoW64 Windows 32-bit on Windows 64-bit.
• YARA a pattern-matching tool.

8. References

1. ESET Research. ESET APT Activity Report Q4 2024 to Q1 2025, pages 8 and 9. Earlier Saudi intrusions and the January 2025 MarsSnake campaign. web-assets.esetstatic.com
2. Positive Technologies Expert Security Center. Poisonous Mars, or how LuciDoor knocks on the doors of the CIS. 24 February 2026. Campaign context, loader and backdoor analysis, and historical infrastructure.
3. Microsoft. GetTcpTable function. IPv4 TCP table scope.
4. Microsoft. Event 4698: A scheduled task was created. Task-creation auditing.