APT36 Campaign Uses Linux .desktop Files to Deliver Malware via Google Drive

Summary

CloudSek details an APT36-attributed campaign that disguises a malicious Linux .desktop file as a PDF, downloads a Go payload from Google Drive, and uses persistence, anti-analysis checks, and WebSocket C2.

Key points

A phishing ZIP contains a PDF-named .desktop file that runs hidden commands when opened and displays a decoy PDF in Firefox.
The file downloads a hex-encoded payload from drive.google.com, decodes it, and executes a Go binary from /tmp.
The payload performs anti-debugging and anti-sandbox checks and attempts to establish persistence, including through desktop autostart.
The Go binary repeatedly attempts WebSocket C2 connections to seemysitelive[.]store on port 8080; the server returned “Welcome to Stealth Server.”
CloudSek links the infrastructure to APT36, also known as Transparent Tribe, and reports an associated C2 IP of 164.215.103.55.
Recommended actions include blocking the reported C2 infrastructure, searching Linux systems for suspicious .desktop files and payload hashes, and scanning for ZIP attachments containing .desktop files.

Article Details

Attack Vectors: A procurement-themed phishing ZIP attachment contains a .desktop file disguised as a PDF; execution downloads and runs a payload.
The payload is retrieved from Google Drive, while a decoy PDF is opened in Firefox.
The dropped payload attempts to establish persistence and communicate with C2 over WebSocket.
Defensive Notes: Block the reported C2 domain and IP, and monitor or block WebSocket connections on port 8080.
Search Linux systems for the reported file hashes, suspicious .desktop files, and files in /tmp matching the reported payload naming pattern.
Block ZIP attachments containing .desktop files and review procurement-themed email for similar attachments.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`seemysitelive[.]store`	Reported C2 domain used by the payload for WebSocket connections.
IPV4	`164[.]215[.]103[.]55`	Reported C2 server IP; the article identifies it as one of the campaign's C2 servers.
MD5	`566ddd4eb4ca8d4dd67b72ee7f944055`	MD5 of the dropped Go binary payload.
MD5	`6ac0fe0fa5d9af8193610d710a7da63c`	MD5 of the malicious ZIP archive containing the .desktop file.
MD5	`a484f85d132609a4a6b5ed65ece7d331`	MD5 of the malicious .desktop file.
SHA1	`1982f09bfab3a6688bb80249a079db1a759214b7`	SHA1 of the malicious .desktop file.
SHA1	`3e3169c513c02126028480421fb341a167cb9fcd`	SHA1 of the malicious ZIP archive containing the .desktop file.
SHA1	`df4db969a69efc1db59f4d3c596ed590ee059777`	SHA1 of the dropped Go binary payload.
SHA256	`34ad45374d5f5059cad65e7057ec0f3e468f00234be7c34de033093efc4dd83d`	SHA256 of the malicious ZIP archive containing the .desktop file.
SHA256	`6347f46d77a47b90789a1209b8f573b2529a6084f858a27d977bf23ee8a79113`	SHA256 of the malicious .desktop file.
SHA256	`7a946339439eb678316a124b8d700b21de919c81ee5bef33e8cb848b7183927b`	SHA256 of the dropped Go binary payload.
URL	`hxxps[:]//drive[.]google[.]com/uc?export=download&id=1VQQiTt78N3KpYJzVbE-95uILnO84Wz_-`	Specific Google Drive download URL used by the .desktop file to retrieve the payload.