This article analyzes a sophisticated multi-stage malware campaign likely attributed to the North Korean Konni APT group, utilizing social engineering tactics centered on a malicious ZIP containing a disguised .lnk file. The campaign employs various techniques for persistence and data exfiltration while utilizing familiar South Korean elements to increase victim engagement. Affected: South Korean financial institutions, government, and defense sectors.
Keypoints :
- The malware campaign utilizes a ZIP file containing a malicious .lnk file disguised as a Korean proposal PDF.
- The Konni APT group, active since 2014, is believed to be behind the campaign, targeting South Korean entities.
- The initial payload triggers an obfuscated PowerShell script that executes multiple batch scripts.
- The decoy PDF is crafted to appear legitimate while the real malware operates in the background.
- The campaign includes techniques for data collection and persistent execution to avoid detection.
- Indicators of compromise include specific file hashes, URLs, and file paths related to the malware operation.
MITRE Techniques :
- T1566.001 β Phishing: Spearphishing Attachment β Delivery of the initial payload via a ZIP file with a malicious .lnk file.
- T1059.001 β Command and Scripting Interpreter: PowerShell β Using an obfuscated PowerShell script to execute the next steps in the malware execution chain.
- T1059.003 β Command and Scripting Interpreter: Windows Command Shell β Multiple batch scripts are executed to move the operation forward.
- T1059.005 β Command and Scripting Interpreter: Visual Basic β A VBS script runs silently to execute further payloads.
- T1547.001 β Boot or Logon Autostart Execution: Registry Run Keys β Persistence is achieved by adding a key to the Windows Registry.
- T1027 β Obfuscated Files or Information β The PowerShell script employs random variable names to obfuscate its intentions.
- T1070.004 β Indicator Removal: File Deletion β Many files are deleted to cover tracks during the malware execution process.
- T1071.001 β Application Layer Protocol: Web Protocols β Data exfiltration via HTTPS POST requests to a C2 server.
- T1573.001 β Encrypted Channel: Symmetric Cryptography β Data is encrypted using a custom encryption method before exfiltration.
- T1005 β Data from Local System β Directory information and system information are collected and prepared for exfiltration.
- T1041 β Exfiltration Over C2 Channel β Data is uploaded to a compromised server for extraction.
Indicator of Compromise :
- [File Hash] SHA256: 627ee714b1e4f5bd692061e1c29783191f71c10c91f14c632e405fbe57d4dd3b
- [Filename] μ μμ.pdf.lnk
- [URL] https://ausbildungsbuddy[.]de/modules/mod_mail/inc/get.php?ra=iew&zw=lk0100
- [URL] https://ausbildungsbuddy[.]de/modules/mod_mail/src/upload.php
- [Filename] nearby.cab
Full Story: https://muff-in.github.io/blog/Malware-Campaign-Potentially-Linked-to-DPRK-Konni-Group/