Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
AlphaSeed is a malware developed in Golang and supports similar features to AppleSeed such as command execution and infostealing.
On 17 May 2023, we disclosed information about AlphaSeed, a new Go-based malware from the SeedpuNK group.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
The group usually launches spear phishing attacks against national defense, defense industries, media, diplomacy, national organizations, and academic sectors.
HappyDoor in this case is also being distributed via an email attachment just like the previous method of distribution. This attachment file contains a compressed file, and the latter carries a JScript or a dropper (executable file). Once that is run, HappyDoor is created and executed along with normal bait files.
AppleSeed is a backdoor that can receive the threat actor’s commands from the C&C server and execute the received commands.
The discovered JSE file drops two additional pieces of malware encoded in Base64 and executes them through PowerShell commands.
Like in past attack cases, AppleSeed is frequently distributed via a JavaScript dropper.
The group usually distributes malware disguised as document files attached to emails. When users run these attachments, they may lose control over their system.
이후 부팅 시 항상 자동으로 악성코드가 실행되도록 “MS_SecSvc” 라는 이름으로 레지스트리에 등록한다. Registry Path: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
이후 부팅 시 항상 자동으로 악성코드가 실행되도록 “MS_SecSvc” 라는 이름으로 레지스트리에 등록한다. Registry Path: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
The malware is packed with VMProtector.
The specific folder and file name are disguised to look like a legitimate program or file such as Antivirus, Chrome, and Adobe.
AppleSeed, which is in DLL format, is installed via the Regsvr32 process, during which the “/i” option is used to pass an argument.
goKeylog 함수에서는 감염된 시스템에 입력되는 키 입력 데이터를 작업 디렉토리 하위에 cache_w.db 파일로 저장한다. 이후, 파일을 암호화하고, 네이버 메일을 통해 전송한다.
Specifically steals cookie information from Chromium and Firefox-based browsers on the system.
Uses the systeminfo command to gather system information.
...stealing information by collecting files from the user system and sending them.
goKeylog 함수에서는 감염된 시스템에 입력되는 키 입력 데이터를 작업 디렉토리 하위에 cache_w.db 파일로 저장한다. 이후, 파일을 암호화하고, 네이버 메일을 통해 전송한다.
goSshot에서는 감염된 시스템의 현재 데스크탑 화면을 캡쳐하여 파일로 저장한다.
감염자 정보를 식별하기 위한 uid 및 감염된 환경 정보, 감염 당시 시간을 Zlib를 통해 압축한 후 Base64로 인코딩한 데이터 메일 제목으로 사용하여 전송한다.
When receiving commands from the threat actor or stealing collected information, AppleSeed generally used the HTTP protocol or email (SMTP and IMAPS). AlphaSeed also uses email protocols to communicate with the C&C...
이후 로그인에 성공하면, 네이버 메일 서비스에 접근하여 정보 탈취 및 명령 전달을 수행한다.
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.