AppleSeed

Through a phishing attack, the Kimsuky group accesses the webmail service by obtaining the information required for a webmail login... they obtained sensitive information such as administrator account and VPN connection and it was possible to enter the internal server.

There was a JavaScript code execution vulnerability on the webmail service. As a result, when the victim read the spear-phishing mail on the webmail interface, the JavaScript code in the body was executed and redirected to the phishing server.

Supply-Chain attack • Identified in late 2023. • Malware was delivered via a legitimate security product. • The attacker manipulated the software update mechanism somehow.

The group usually launches spear phishing attacks against national defense, defense industries, media, diplomacy, national organizations, and academic sectors.

AppleSeed is currently being distributed under the following filenames. Purchase order-**-2022****-001-National Tax Service additionally implementing security sensors in 5 regional tax offices_***.jse Request form(general manager ***).jse ... users should refrain from running attachments in emails sent from unknown sources.

The Kimsuky group sent spear-phishing emails to many engineering researchers... 3.1 Phishing: spear-phishing link

The threat actor used an account named 'Transitional Justice Mission' to send friend requests and direct messages... The malicious file was delivered as a password-protected EGG archive... The threat actor also attempted further contact by using the email address obtained through Facebook Messenger conversations... If the attacker obtained the target’s mobile number, they proceeded to contact them through Telegram.

On Windows Server, when the malware is executed, it self-replicates and is registered in the scheduler.

The additional VBS script that is downloaded and executed through the process steals information and registers 2 task schedulers.

On a Linux server... the web shell was downloaded from the outside using the CLI command... through the wget and curl commands, execution permission is granted (chmod) and it is executed.

The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'

%ProgramData%\qijWq.rSCKPC.bat (Batch file that decodes the qijWq.rSCKPC.b64 file)

In addition to JavaScript, Excel macro malware are also used to install AppleSeed.

The JSE (JScript Encoded File) file consists of JavaScript, and when it is run, it drops AppleSeed backdoor file

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.

The group usually distributes malware disguised as document files attached to emails. When users run these attachments, they may lose control over their system.

On Windows Server, when the malware is executed, it self-replicates and is registered in the scheduler.

The additional VBS script that is downloaded and executed through the process steals information and registers 2 task schedulers.

Through a phishing attack, the Kimsuky group accesses the webmail service by obtaining the information required for a webmail login... they obtained sensitive information such as administrator account and VPN connection and it was possible to enter the internal server.

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

multiple cases have been found recently where new users were added to infected systems, which were then used to gain access. Through this method, attackers can maintain persistence and access the infected system anytime.

On Windows Server, the attacker created the default account in the administrators group and created a tool after granting privileges.

On a Linux server, after uploading the web shell file to the administrator page using the previously hijacked administrator account, the malware executes additional commands and downloads and executes the reverse shell to maintain the authority to the server.

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder. | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce ... HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx ... reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"

On Windows Server, when the malware is executed, it self-replicates and is registered in the scheduler.

The additional VBS script that is downloaded and executed through the process steals information and registers 2 task schedulers.

the DLL file to be executed is injected into the normal process (rundll32.exe) and executed.

Through a phishing attack, the Kimsuky group accesses the webmail service by obtaining the information required for a webmail login... they obtained sensitive information such as administrator account and VPN connection and it was possible to enter the internal server.

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder. | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce ... HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx ... reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"

BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.

The malware is packed with VMProtector.

To hide the operation of the malware, it is disguised by using a legitimate file name such as that of Windows Update-related content or a driver name.

Akira has used legitimate names and locations for files to evade defenses.

the DLL file to be executed is injected into the normal process (rundll32.exe) and executed.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Through a phishing attack, the Kimsuky group accesses the webmail service by obtaining the information required for a webmail login... they obtained sensitive information such as administrator account and VPN connection and it was possible to enter the internal server.

various variables necessary for function calls and malicious code operation are encoded, and after the variables encoded by the double XOR decoding routine are decoded, they are called when the malicious code operates.

The file uses ... mshta.exe to download and run additional scripts

As one of the main characteristics of AppleSeed malware, when the malware (DLL) is executed by regsvr32, it is registered in the registry.

the code accesses the registry path 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to check the values of 'ConsentPromptBehaviorAdmin' and 'PromptOnSecureDesktop'. This checks whether UAC (User Account Control) is enabled.

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

After loading a page disguised as a normal webmail login page, the keylogging function is called and executed, and information is transmitted to the outside (ga.js).

최근에는 ... 구글 크롬 외에 마이크로소프트 엣지나 네이버 웨일 웹 브라우저에 저장되어 있는 계정 정보를 탈취하는 악성코드가 사용되고 있다.

User account credentials

List of running processes and services

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

Network information (IP address, routing table, port usage information, and ARP list)

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

The attacker used the following shell commands to search for files and directories on the internal server: ls, cd [DIRECTORY], vi ... etc.

Gathers user account information on the system by using ‘net user’

The Spy version gathers sensitive information such as documents, screenshots, keystrokes, and lists of USB drives.

The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".

the code accesses the registry path 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' to check the values of 'ConsentPromptBehaviorAdmin' and 'PromptOnSecureDesktop'. This checks whether UAC (User Account Control) is enabled.

Checks for installed anti-virus software on the system.

Depending on the operating system environment (Windows, Linux) of the attack target server, RDP and SSH connections were used to control the internal network server.

...while in the past the group typically used RDP to control the infected system after installing AppleSeed...

Accounts obtained through phishing attacks were abused to carry out further attacks targeting internal researchers and engineers.

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

AppleSeed can find and collect data from removable media devices. APT28 backdoor may collect the entire contents of an inserted USB device. Aria-body has the ability to collect data from USB devices. BADNEWS copies files with certain extensions from USB devices to a predefined directory.

After loading a page disguised as a normal webmail login page, the keylogging function is called and executed, and information is transmitted to the outside (ga.js).

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

When contents such as keylogging and screenshots were uploaded to the C&C server...

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.

감염자 정보를 식별하기 위한 uid 및 감염된 환경 정보, 감염 당시 시간을 Zlib를 통해 압축한 후 Base64로 인코딩한 데이터 메일 제목으로 사용하여 전송한다.

APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.

When infected with a malicious APK, it communicates with the C&C server using the HTTP/S protocol, receives commands, and performs malicious behaviors such as stealing information from the infected device.

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

9.2 Non-application layer & non-standard protocol... Reverse Shell - 27.102.114.63:3101 ... final execution shellcode is socket communication.

Malware and web shells were placed in the acquired and configured infrastructure and used for attacks... download and execute additional files (Webshell & Reverse Shell).

files were sent and received by disguising them as PDF headers... XOR Key: 16byte... Encoded Data

...while in the past the group typically used RDP to control the infected system after installing AppleSeed, they are often observed installing Chrome Remote Desktop in recent cases.

AppleSeed has divided files if the size is 0x1000000 bytes or more. APT28 has split archived exfiltration files into chunks smaller than 1MB. APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.

ADVSTORESHELL exfiltrates data over the same channel used for C2.

The attacker leaked compressed files (various source codes and research data, etc.) in the controlled server to an external C&C server using FTP protocol.

이후 로그인에 성공하면, 네이버 메일 서비스에 접근하여 정보 탈취 및 명령 전달을 수행한다.