Analyzing North Korean Malware​ (Patreon)

👨‍💻 North Korean Malware Analysis 🚨 ROKRAT KillChain 📡

🔥 Learn How North Korea infects victims 👨‍💻 Buy Our Courses: https://guidedhacking.com/register/ 🔗 Visit Checkpoint: https://research.checkpoint.com/2023/chain-reaction-rokrats-missing-link/ 💰 Donate on Patreon: https://patreon.com/guidedhacking ❤️ Follow us on Social Media: https://linktr.ee/guidedhacking 🔗 GH Article Link: https://guidedhacking.com/threads/north-korean-malware-analysis-rokrat-killchain.20349/ 📜 North Korean Malware Video Description: In this walkthrough, we will analyze a North Korean malware campaign targeting individuals in South Korea. This coverage was inspired by a blog recently released by Checkpoint Research they outline many of these different lures which then drops the ROKRAT malware which is a signature of North Korean attacks. Some of the different lures used by North Korea look to be political outlines of different plannings or statuses of laws. The infection lure that we'll be taking a look at in this video starts with a zip file. We will focus on the techniques used, from the initial ZIP file to the PowerShell stage. Upon opening the zip file, we find four files: two PDFs, one DOCX file, and a shortcut file (LNK file). These files are used to create graphical references to a file located in a different part of the user's computer. The LNK file can execute code depending on the added arguments. North Korean Malware Reverse Engineering When hovering over the LNK file, we find that it points towards the CMD.exe. As we continue our malware analysis, we notice that checking the properties of the LNK file changes its file size. Instead of manually relying on Windows to analyze the file, we use LECmd for the analysis. Our malware analysis with LECmd reveals a PowerShell command that decodes some data. This decoded data is then written into both a PDF file, which is opened, and a BAT file, which is executed. When the LNK file is executed, no window is shown, and the PDF opens while the BAT file runs in the background. The BAT file further decodes some text and executes it in PowerShell. This code downloads and executes the ROKRAT malware from a OneDrive link. North Korean APT. 📝 Timestamps: 0:00 Checkpoint Research 1:02 Analyzing the ZIP File 2:27 Analyzing the LNK File 3:36 Decoding the Arguments 4:37 Join GuidedHacking.com 5:04 Extracting & Analyzing BAT File 7:12 Decrypting Encoded Data 8:35 Loading Next Stage 9:01 Outro & Resources ✏️ Tags: North Korean Malware #malwareanalysis DPRK cyber #fr3dhk North Korean cyber #reverseengineering DPRK malware North Korean hacking