Detailed Features of Apolon Loader (2023 Version)
1. Malware Delivery & Payload Execution
- Multi-Stage Loading: Uses a dropper to fetch and decrypt the final payload in memory (fileless execution).
- Wide Payload Support: Delivers RedLine Stealer, Vidar, Taurus Stealer, LockBit ransomware, and more.
- Dynamic Payload Fetching: Downloads malicious modules only when needed to evade static analysis.
2. Telegram-Based Command & Control (C2)
- Bot-Controlled Operations: Attackers manage infected bots via Telegram bots (secure, anonymous).
- Real-Time Logs: Sends victim data (IP, geolocation, system info) directly to Telegram.
- Remote Commands: Can execute file operations, screenshots, keylogging, and update payloads via bot messages.
3. Evasion & Anti-Analysis Techniques
- Process Injection: Injects into explorer.exe, svchost.exe to avoid detection.
- Polymorphic Code: Changes encryption keys per infection to bypass signature-based AV.
- Sandbox Detection: Checks for virtual machines (VM), debuggers, and analysis tools before executing.
4. Persistence & Stealth Mechanisms
- Registry Run Keys: Ensures malware restarts after reboot.
- Task Scheduler Abuse: Creates scheduled tasks for persistence.
- Rootkit-Like Hiding: Conceals files, processes, and network traffic from security tools.
5. Web-Based Admin Panel (Cybercriminal Dashboard)
- Real-Time Bot Monitoring: Tracks infected machines, geolocation, and stolen data.
- Payload Management: Allows attackers to push new malware variants on demand.
- Statistics & Analytics: Shows infection rates, success metrics, and payload effectiveness.
