Alexandre Dulaunoy - Florian Roth - Timo Steffens - Christophe Vandeplas
+Alexandre Dulaunoy - Florian Roth - Timo Steffens - Christophe Vandeplas - Dennis Rand
CORALDECK is an exfiltration tool that searches for specified files and exfiltrates them in password protected archives using hardcoded HTTP POST headers. CORALDECK has been observed dropping and using Winrar to exfiltrate data in password protected RAR files as well as WinImage and zip archives
+CORALDECK is also known as:
+APT.InfoStealer.Win.CORALDECK
+FE_APT_InfoStealer_Win_CORALDECK_1
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
DOGCALL is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex. DOGCALL was used to target South Korean Government and military organizations in March and April 2017. The malware is typically dropped using an HWP exploit in a lure document. The wiper tool, RUHAPPY, was found on some of the systems targeted by DOGCALL. While DOGCALL is primarily an espionage tool, RUHAPPY is a destructive wiper tool meant to render systems inoperable.
+DOGCALL is also known as:
+FE_APT_RAT_DOGCALL
+FE_APT_Backdoor_Win32_DOGCALL_1
+APT.Backdoor.Win.DOGCALL
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
GELCAPSULE is a downloader traditionally dropped or downloaded by an exploit document. GELCAPSULE has been observed downloading SLOWDRIFT to victim systems.
+GELCAPSULE is also known as:
+FE_APT_Downloader_Win32_GELCAPSULE_1
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
HAPPYWORK is a malicious downloader that can download and execute a second-stage payload, collect system information, and beacon it to the command and control domains. The collected system information includes: computer name, user name, system manufacturer via registry, IsDebuggerPresent state, and execution path. In November 2016, HAPPYWORK targeted government and financial targets in South Korea.
+HAPPYWORK is also known as:
+FE_APT_Downloader_HAPPYWORK
+FE_APT_Exploit_HWP_Happy
+Downloader.APT.HAPPYWORK
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
Karae backdoors are typically used as first-stage malware after an initial compromise. The backdoors can collect system information, upload and download files, and may be used to retrieve a second-stage payload. The malware uses public cloud-based storage providers for command and control. In March 2016, KARAE malware was distributed through torrent file-sharing websites for South Korean users. During this campaign, the malware used a YouTube video downloader application as a lure.
+KARAE is also known as:
+FE_APT_Backdoor_Karae_enc
+FE_APT_Backdoor_Karae
+Backdoor.APT.Karae
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
MILKDROP is a launcher that sets a persistence registry key and launches a backdoor.
+MILKDROP is also known as:
+FE_Trojan_Win32_MILKDROP_1
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
POORAIM malware is designed with basic backdoor functionality and leverages AOL Instant Messenger for command and control communications. POORAIM includes the following capabilities: System information enumeration, File browsing, manipulation and exfiltration, Process enumeration, Screen capture, File execution, Exfiltration of browser favorites, and battery status. Exfiltrated data is sent via files over AIM. POORAIM has been involved in campaigns against South Korean media organizations and sites relating to North Korean refugees and defectors since early 2014. Compromised sites have acted as watering holes to deliver newer variants of POORAIM.
+POORAIM is also known as:
+Backdoor.APT.POORAIM
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
RICECURRY is a Javascript based profiler used to fingerprint a victim’s web browser and deliver malicious code in return. Browser, operating system, and Adobe Flash version are detected by RICECURRY, which may be a modified version of PluginDetect.
+RICECURRY is also known as:
+Exploit.APT.RICECURRY
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
RUHAPPY is a destructive wiper tool seen on systems targeted by DOGCALL. It attempts to overwrite the MBR, causing the system not to boot. When victims' systems attempt to boot, the string 'Are you Happy?' is displayed. The malware is believed to be tied to the developers of DOGCALL and HAPPYWORK based on similar PDB paths in all three.
+RUHAPPY is also known as:
+FE_APT_Trojan_Win32_RUHAPPY_1
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
SHUTTERSPEED is a backdoor that can collect system information, acquire screenshots, and download/execute an arbitrary executable. SHUTTERSPEED typically requires an argument at runtime in order to execute fully. Observed arguments used by SHUTTERSPEED include: 'help', 'console', and 'sample'. The spear phishing email messages contained documents exploiting RTF vulnerability CVE-2017-0199. Many of the compromised domains in the command and control infrastructure are linked to South Korean companies. Most of these domains host a fake webpage pertinent to targets.
+SHUTTERSPEED is also known as:
+FE_APT_Backdoor_SHUTTERSPEED
+APT.Backdoor.SHUTTERSPEED
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
SLOWDRIFT is a launcher that communicates via cloud based infrastructure. It sends system information to the attacker command and control and then downloads and executes additional payloads.Lure documents distributing SLOWDRIFT were not tailored for specific victims, suggesting that TEMP.Reaper is attempting to widen its target base across multiple industries and in the private sector. SLOWDRIFT was seen being deployed against academic and strategic targets in South Korea using lure emails with documents leveraging the HWP exploit. Recent SLOWDRIFT samples were uncovered in June 2017 with lure documents pertaining to cyber crime prevention and news stories. These documents were last updated by the same actor who developed KARAE, POORAIM and ZUMKONG.
+SLOWDRIFT is also known as:
+FE_APT_Downloader_Win_SLOWDRIFT_1
+FE_APT_Downloader_Win_SLOWDRIFT_2
+APT.Downloader.SLOWDRIFT
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
SOUNDWAVE is a windows based audio capturing utility. Via command line it accepts the -l switch (for listen probably), captures microphone input for 100 minutes, writing the data out to a log file in this format: C:\Temp\HncDownload\YYYYMMDDHHMMSS.log.
+SOUNDWAVE is also known as:
+FE_APT_HackTool_Win32_SOUNDWAVE_1
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
ZUMKONG is a credential stealer capable of harvesting usernames and passwords stored by Internet Explorer and Chrome browsers. Stolen credentials are emailed to the attacker via HTTP POST requests to mail[.]zmail[.]ru.
+ZUMKONG is also known as:
+FE_APT_Trojan_Zumkong
+Trojan.APT.Zumkong
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+
WINERACK is backdoor whose primary features include user and host information gathering, process creation and termination, filesystem and registry manipulation, as well as the creation of a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands. Other capabilities include the enumeration of files, directories, services, active windows and processes.
+WINERACK is also known as:
+FE_APT_Backdoor_WINERACK
+Backdoor.APT.WINERACK
+Links |
+
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
+