Loading malware…
NarwhalRAT is a compiled Python-based remote access trojan used in spearphishing campaigns assessed to primarily target Korean users. It has been associated with activity attributed or similarity-linked to ScarCruft, also known as APT37, a North Korean state-sponsored threat actor. The malware is delivered through Microsoft-themed phishing lures that impersonate account security notifications and use archive attachments containing malicious Windows shortcut files to initiate a multi-stage infection chain.
The infection flow uses obfuscated command execution, PowerShell, batch scripts, and legitimate Windows utilities to retrieve additional stages, including an embedded Python runtime. Python bytecode payloads are disguised as catalog files, persistence is established through a scheduled task masquerading as a legitimate Microsoft component, and later stages decrypt and execute a Windows PE payload directly in memory through Python ctypes and Windows API calls. This design reduces visible artifacts on disk and complicates analysis.
NarwhalRAT provides broad surveillance and remote-control functionality. Reported capabilities include keylogging, screen capture, microphone recording, USB data collection, file upload and download, remote clicking, and remote command execution. It stores collected data in a hidden working directory named to resemble Naver Whale, a popular South Korean browser, and uses encrypted local configuration storage. The malware also performs anti-virtualization checks to evade sandboxing and analysis.
Its command-and-control architecture is multi-channel. In addition to web-based relay infrastructure, NarwhalRAT uses the pCloud API as a dead-drop resolver mechanism, allowing operators to update downstream control information without rebuilding the malware. Tradecraft overlaps with earlier Python-based phishing and backdoor activity linked to APT37, including LNK-based delivery, scheduled-task persistence, disguised Python bytecode stages, and cloud-assisted command-and-control.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA-RedAnt (APT37) used NarwhalRAT (a malware for information gathering and remote control) to perform keylogging, screen capture, and microphone recording.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
"MS 사칭 피싱과 Dead-drop C2 기반 APT37 NarwhalRAT 분석"
Initial access was performed through spear phishing disguised as messages from the Microsoft account team and cybersecurity advisories. Malicious LNK files were used to induce the installation of NarwhalRAT.
KHjWFcsE.bat는 후속 페이로드인 config.cat의 지속 실행을 위해 Windows 작업 스케줄러를 등록합니다.
It performed various information-stealing activities, including keylogging, screen capture, USB data collection, and remote command execution.
-ExecutionPolicy Bypass 옵션으로 PowerShell 실행 정책을 우회합니다.
This initiated a multi-stage infection flow that proceeds through PowerShell and Batch commands and ultimately installs the compiled Python-based NarwhalRAT.
정상 Windows 보안 카탈로그 파일이 아니라 Python 바이트코드(.pyc) 형식의 컴파일 파일로 확인되었습니다.
실제 첨부파일은 HWP 문서가 아닌 ZIP 압축파일이며, 내부에는 악성 LNK 파일이 포함되어 있었습니다.
KHjWFcsE.bat는 후속 페이로드인 config.cat의 지속 실행을 위해 Windows 작업 스케줄러를 등록합니다.
The post includes the hashtag "#LNK" alongside "Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2".
KHjWFcsE.bat는 후속 페이로드인 config.cat의 지속 실행을 위해 Windows 작업 스케줄러를 등록합니다.
The post includes the hashtag "#LNK" alongside "Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2".
CMD 환경변수 substring 치환을 이용해 실제 실행 명령을 은닉하는 형태로 구성되어 있습니다.
이 설정 데이터는 평문으로 저장되지 않고 Windows CryptoAPI 기반 AES-128 방식으로 암호화됩니다.
작업명은 MicrosoftUserInterfacePicturesUpdateTackMachine으로, 정상 Microsoft 사용자 인터페이스 또는 계정 이미지 관련 작업처럼 보이도록 위장한 형태입니다.
정상 Windows 기본 도구인 curl.exe를 복사해 사용하는 방식은 ... Living Off The Land Binaries(LoLBins) 형태의 기법으로 분류할 수 있습니다.
중복 실행 방지를 위한 Mutex를 생성합니다.
CPUID 기반 Hypervisor Vendor ID 문자열을 검사해 VMware, VirtualBox 및 기타 가상화 환경 여부를 판별합니다.
"VMwareVMware" 및 "VBoxVBoxVBox" 문자열과 함께 " lrpepyh vr" 문자열 비교가 확인됩니다.
생성된 폴더에 Hidden 및 System 속성을 부여해 은닉성을 강화합니다.
Once decryption is complete... it runs the decrypted payload directly in memory without saving it as a separate file. This technique is generally classified as fileless execution or in-memory execution.
After the environment check is complete, the malware creates a mutex to prevent duplicate execution. In the code, the string "i5zJH9FL10cVd3sSW9eyWWErPJ" is used as the mutex name.
TA-RedAnt (APT37) used NarwhalRAT ... to perform keylogging, screen capture, and microphone recording.
GetForegroundWindow(), GetWindowTextA(), GetWindowThreadProcessId(), GetWindowPlacement() API 호출 흐름이 확인되었습니다.
활성 창 및 실행 중인 윈도우 정보를 수집하는 기능이 구현되어 있었습니다.
The command system identified during analysis can be categorized into remote command execution, file upload and download... USB collection...
The Python-based malware is equipped to... gather data from USB media ...
CPUID 기반 Hypervisor Vendor ID 문자열을 검사해 VMware, VirtualBox 및 기타 가상화 환경 여부를 판별합니다.
"VMwareVMware" 및 "VBoxVBoxVBox" 문자열과 함께 " lrpepyh vr" 문자열 비교가 확인됩니다.
After the environment check is complete, the malware creates a mutex to prevent duplicate execution. In the code, the string "i5zJH9FL10cVd3sSW9eyWWErPJ" is used as the mutex name.
Kimsuky used malicious LNK files, the Dropbox API, GitHub Releases, and Google Drive for Information Theft and command execution.
Notably, the USB and removable storage device collection function is performed through the "usb2local:" command.
TA-RedAnt (APT37) used NarwhalRAT ... to perform keylogging, screen capture, and microphone recording.
수집 대상 경로를 C:\Users\Public\<random>\ 하위로 복사하기 위한 명령 문자열을 동적으로 생성합니다.
TA-RedAnt (APT37) used NarwhalRAT ... to perform keylogging, screen capture, and microphone recording.
TA-RedAnt (APT37) used NarwhalRAT ... to perform keylogging, screen capture, and microphone recording.
The malware organizes its current operating status... into a single configuration data block... This configuration data is not stored in plaintext but is encrypted using AES-128 based on Windows CryptoAPI.
The actor operated a dual C2 structure that used a Korean relay server and the pCloud API as a dead-drop Resolver.
The actor operated a dual C2 structure that used a Korean relay server and the pCloud API as a dead-drop Resolver.
This indicates that the malware was designed to use a legitimate cloud service as a secondary C2 channel in the form of a Dead-drop Resolver.
webhostingkorea[.]com 경유지에 ... 요청을 전송해 두 개의 파일을 순차적으로 다운로드합니다.
This payload was implemented not as a simple downloader, but as a multifunctional RAT (Remote Access Trojan) structure that integrates multiple information-stealing capabilities and remote control capabilities.
This structure appears to be intended to maintain command delivery and data exchange through a cloud-based route even if the primary communication channel is blocked.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.