Malwarebytes researcher have come across a new malware campaign targeting Russia with multiple documents with Konni RAT. The malware which was found was first identified in the wild from 2014 and was possibly connected with the APT37 and Thallium in North Korea. At the end of July 2021, scientists discovered a continuous spear campaign,which uses two documents written in Russian and armed with the same malicious macro. After enabling the macro, the infection chain begins to install a new severely obfuscated Konni RAT.
The major differences between the current and previous campaign are alos observed by the researcher which are listed below:
- The macros are different. In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content.
- In the new campaign JavaScript files have been used to execute batch and PowerShell files.
- The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file.
- The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique.
- In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. Also, its configuration is encrypted and is not base64 encoded anymore. It also does not use FTP for exfiltration.
The diagram below shows the overall flow of victims used by this actor. A document executing a macro and a chain of activities, which finally deploys the Konni Rat, is behind this malicious activity.
“We found two lures used by Konni APT. The first document “Economic relations.doc” contains a 12 page article that seems to have been published in 2010 with the title: “The regional economic contacts of Far East Russia with Korean States (2010s)“. The second document is the outline of a meeting happening in Russia in 2021: “23th meeting of the intergovernmental Russian-Mongolian commission on Trade, Economic, scientific and technical operation“
“These malicious documents used by Konni APT have been weaponized with the same simple but clever macro. It just uses a Shell function to execute a one-liner cmd command. This one liner command gets the current active document as input and looks for the "^var" string using findstr and then writes the content of the line staring from “var” into y.js. At the end it calls WscriptShell function to executes the Java Script file (y.js).”reads the blogpost.
One of the interesting technique used by the threat actor is that hiding the malicious JS at the end of the document and not using it directly inside the macro to bypass the AV’s detection capabilities.
CyberWorkx news readers can checkout the IOC’s for the identified malware campaign from below:
| name | Sha256 |
| N/A | fccad2fea7371ad24a1256b78165bceffc5d01a850f6e2ff576a2d8801ef94fa |
| economics relations.doc | d283a0d5cfed4d212cd76497920cf820472c5f138fd061f25e3cddf65190283f |
| y.js | 7f82540a6b3fc81d581450dbdf7dec7ad45d2984d3799084b29150ba91c004fd |
| yy.js | 7a8f0690cb0eb7cbe72ddc9715b1527f33cec7497dcd2a1010def69e75c46586 |
| y.ps1 | 617f733c05b42048c0399ceea50d6e342a4935344bad85bba2f8215937bc0b83 |
| tmpBD2B.tmp | 10109e69d1fb2fe8f801c3588f829e020f1f29c4638fad5394c1033bc298fd3f |
| check.bat | a7d5f7a14e36920413e743932f26e624573bbb0f431c594fb71d87a252c8d90d |
| install.bat | 4876a41ca8919c4ff58ffb4b4df54202d82804fd85d0010669c7cb4f369c12c3 |
| xwtpui.dll | 062aa6a968090cf6fd98e1ac8612dd4985bf9b29e13d60eba8f24e5a706f8311 |
| xmlprov.dll | f702dfddbc5b4f1d5a5a9db0a2c013900d30515e69a09420a7c3f6eaac901b12 |
| xmlprov.dll | 80641207b659931d5e3cad7ad5e3e653a27162c66b35b9ae9019d5e19e092362 |
| xmlprov.ini | 491ed46847e30b9765a7ec5ff08d9acb8601698019002be0b38becce477e12f6 |
Domains:
takemetoyouheart[.]c1[.]biz
taketodjnfnei898[.]ueuo[.]com
taketodjnfnei898[.]c1[.]biz
romanovawillkillyou[.]c1[.]biz
–-For more Cyber security news in crisp content . Please follow our site via twitter handle @cyberworkx1, Linkedin handle @linkedin.