Keypoints
- APT37 uses spear-phishing emails with ZIP-attached LNK shortcut files disguised as PDFs to initiate attacks against North Korea–related targets.
- The malicious LNK contains embedded PowerShell that locates a decoy PDF payload area and a separate encrypted shellcode region inside the LNK binary.
- PowerShell extracts the shellcode bytes, removes the LNK, and downloads a second-stage PowerShell script (e.g., ‘september.txt’) from Dropbox to perform in-memory execution.
- The downloaded script allocates memory (GlobalAlloc), changes protections (VirtualProtect), writes the shellcode, creates a thread (CreateThread), and runs the shellcode, which decrypts into an EXE in memory (fileless execution).
- RoKRAT variants are used for reconnaissance and data collection, leveraging cloud platforms such as pCloud and Dropbox for C2 and exfiltration; account tokens/email metadata (e.g., [email protected]) are observed.
- Genian EDR detects abnormal behaviors early (LNK creation on unzip, PowerShell network calls, pCloud connections) enabling rapid response to fileless RoKRAT activity.
MITRE Techniques
- [T1566.001] Spearphishing Attachment – Initial access via email with ZIP-attached LNK shortcuts disguised as documents (‘North Korea Survey (2011-2023).zip’ and ‘General view of North Korea 240226.lnk’).
- [T1204] User Execution – Victim interaction opens the decoy PDF or clicks the LNK, triggering embedded PowerShell (‘When the “2023 North Korea Top 10 News.pdf” document used as a bait document is run…’).
- [T1059.001] Command and Scripting Interpreter: PowerShell – LNK executes PowerShell commands to parse offsets, extract resources, and call remote scripts (‘PowerShell commands inside LNK…’).
- [T1105] Ingress Tool Transfer – The LNK/PowerShell downloads a second-stage script from Dropbox (e.g., ‘september.txt’ from ‘dl.dropboxusercontent.com/…/september.txt’).
- [T1055] Process Injection – The downloaded PowerShell allocates memory, writes shellcode, and creates a thread to execute code in-memory (GlobalAlloc / VirtualProtect / CreateThread) (‘the script allocates memory… starts a new thread…’).
- [T1036] Masquerading – LNK files are made to appear as PDF icons and use decoy PDF content to avoid suspicion (‘LNK malicious file disguised as a PDF document’).
- [T1027] Obfuscated Files or Information – PowerShell and shellcode are obfuscated/encrypted and executed in memory to evade signature detection (‘shellcodes in encrypted form that go through the decryption process’).
- [T1547.009] Shortcut Modification – Use of LNK shortcuts as an execution vector and potential persistence mechanism (‘LNK Shortcut-based attacks are by far the most prominent’).
- [T1102] Web Service – Use of legitimate cloud services (pCloud, Dropbox, OneDrive) for command-and-control and payload hosting (‘using pCloud… DropBox cloud storage…’).
- [T1005] Data from Local System – RoKRAT collects documents, recordings, and other local files for exfiltration (‘collects information such as [.XLS] [.DOC] [.PDF] and mobile phone recording files’).
- [T1041] Exfiltration Over C2 Channel – Collected data is exfiltrated to attacker-controlled cloud storage/C2 infrastructure (pCloud) (‘attempts to leak it to a command and control (C2) server… pCloud as its C2 infrastructure’).
Indicators of Compromise
- [MD5 hashes] samples observed – 7bce02dc0026e271615d4d0e441ca397, ad2761910997c801b3347bd3745dd2b9, and 6 more hashes
- [Email addresses] cloud/C2 accounts and registrant info – [email protected], [email protected]
- [File names] delivery and second-stage artifacts – ‘General view of North Korea 240226.lnk’, ‘North Korea Survey (2011-2023).zip’, ‘september.txt’ (Dropbox), ‘skype.apk’
- [Domains/URLs] hosting and C2 endpoints – dl.dropboxusercontent.com/(omitted)/september.txt, https://www.pcloud.com (pCloud API usage observed)
- [PDB path / build artifact] internal builder info – D:SourcesMainWorkGroup2017SampleReleaseDogCall.pdb
The attack chain begins with a spear-phishing email containing a ZIP attachment that includes a legitimate PDF and a malicious LNK shortcut disguised as a PDF icon. The LNK does not employ double extensions but embeds PowerShell commands that scan the LNK binary for a PDF marker (%PDF-1.4) and a separate shellcode marker (bytes starting 0x55 0x8B 0xEC 0x83), using hard-coded offsets and byte counts to identify and extract both the decoy PDF area and the encrypted shellcode region.
The embedded PowerShell then extracts the encrypted shellcode bytes from the LNK, removes the LNK file, and downloads a second-stage PowerShell payload from Dropbox (example: ‘september.txt’ on dl.dropboxusercontent.com). The downloaded script invokes Win32 APIs via Add-Type (GlobalAlloc, VirtualProtect, CreateThread, WaitForSingleObject), allocates RWX memory, writes the shellcode into that memory, flips protections to executable, and starts a new thread to run the shellcode in-memory; the shellcode implements decryption routines that reconstruct an EXE and execute it entirely in memory (fileless execution).
The in-memory payload is a RoKRAT variant that enumerates system info (SMBIOS), collects local documents and media, and uses legitimate cloud platforms (pCloud, Dropbox, OneDrive) for C2 and exfiltration; account metadata such as ‘[email protected]’ and the PDB artifact ‘DogCall.pdb’ are recurring identifiers across variants. Detection and response should focus on behavioral indicators: LNK creation on unzip, PowerShell network callbacks to cloud services, abnormal memory allocation/Win32 API usage, and pCloud/Dropbox token activity—Genian EDR successfully detected LNK decompression, PowerShell Dropbox calls, and pCloud connections in testing.
Read more: https://www.genians.co.kr/blog/threat_intelligence/rokrat