RokRAT Malware Distributed Through LNK Files (*.lnk): RedEyes (ScarCruft) – ASEC BLOG

Keypoints

• The RedEyes/ScarCruft group has distributed RokRAT using LNK files, adding to prior CHM malware campaigns.
• The LNKs contain PowerShell commands that can perform malicious behavior by creating and executing a script file along with a normal file in the Temp folder. ‘The LNK files that were discovered this time contain PowerShell commands that can perform malicious behavior by creating and executing a script file along with a normal file in the temp folder.’
• The 230407Infosheet.lnk is disguised with a PDF icon and contains a malicious PowerShell command. ‘The 230407Infosheet.lnk file is disguised with a PDF icon and contains a malicious PowerShell command.’
• The LNK data includes normal PDF data plus malicious script codes and dummy bytes, used to camouflage the payload.
• The LNK reads and writes to the Temp folder, saving the payload as 230407Infosheet.pdf and 230412.bat, before executing them. ‘The LNK file is read up to 0x890F4 and is saved and executed with the filename “230407Infosheet.pdf” in the Temp folder while excluding the first 0x9AA…’”, “Then reads up to 0x89D9A and saves/exects 230412.bat in Temp.’
• RokRAT is decoded, injected into PowerShell, and used to collect credentials and download additional malware, with exfiltration to cloud storage. ‘The injected data is the RokRAT malware that is capable of collecting user credentials and downloading additional malware.’
• The final PowerShell command downloads encoded data from OneDrive shares, decodes it, and injects it into the PowerShell process to perform malicious behavior. ‘decodes it, and injects it into the PowerShell process to perform malicious behavior.’
• The attack exfiltrates data to cloud services (pcloud, Yandex) with a Googlebot-like UserAgent to disguise traffic. ‘The collected information is sent to the threat actor’s cloud server using cloud services such as pcloud and yandex. The UserAgent in the request header is disguised as Googlebot.’