{"id":110119,"date":"2023-06-28T10:00:24","date_gmt":"2023-06-28T10:00:24","guid":{"rendered":"https:\/\/kasperskycontenthub.com\/securelist\/?p=110119"},"modified":"2023-06-28T14:56:14","modified_gmt":"2023-06-28T14:56:14","slug":"lazarus-andariel-mistakes-and-easyrat","status":"publish","type":"post","link":"https:\/\/securelist.com\/lazarus-andariel-mistakes-and-easyrat\/110119\/","title":{"rendered":"Andariel’s silly mistakes and a new malware family"},"content":{"rendered":"
Andariel, a part of the notorious Lazarus group, is known for its use of the DTrack malware and <\/a>Maui ransomware<\/a> in mid-2022. During the same period, Andariel also actively exploited the Log4j vulnerability as reported by Talos<\/a> and Ahnlab<\/a>. Their campaign introduced several new malware families, such as YamaBot and MagicRat, but also updated versions of NukeSped and, of course, DTrack.<\/p>\n While on an unrelated investigation recently, we stumbled upon this campaign and decided to dig a little bit deeper. We discovered a previously undocumented malware family and an addition to Andariel’s set of TTPs.<\/p>\n Andariel infects machines by executing a Log4j exploit, which, in turn, downloads further malware from the C2 server. Unfortunately, we were unable to catch the first piece of malware they downloaded, but we did see that exploitation was closely followed by the DTrack backdoor being downloaded.<\/p>\n From this point on, things got rather interesting, as we were able to reproduce the commands the attackers executed. It quickly became clear that the commands were run by a human operator, and judging by the amount of mistakes and typos, likely an inexperienced one. For example:<\/p>\n <\/a><\/p>\n Note how “Program” is misspelled as “Prorgam” . Another funny moment was when the operators realized they were in a system that used the Portuguese locale. This took surprisingly long: they only learned after executing cmd.\u0435xe \/c net localgroup as you can see below:<\/p>\n <\/a><\/p>\n We were also able to identify the set of off-the-shelf tools Andariel that installed and ran during the command execution phase, and then used for further exploitation of the target. Below are some examples:<\/p>\n We first noticed a version of EarlyRat in one of the aforementioned Log4j cases and assumed it was downloaded via Log4j. However, when we started hunting for more samples, we found phishing documents that ultimately dropped EarlyRat. The phishing document itself is not that advanced as can be seen below:<\/p>\n <\/a><\/p>\n Once macros are enabled, the following command is executed:<\/p>\n <\/a><\/p>\n Oddly enough, the VBA code pings a server associated with the HolyGhost \/ Maui ransomware campaign.<\/p>\n EarlyRat, just like many other RATs (remote access Trojans), collects system information upon starting and sends it to the C2 using the following template:<\/p>\n <\/a><\/p>\n As can be seen above, there are two different parameters in the request: “id” and “query”. Next to those, the “rep0” and “page” parameters are also supported. They are used in the following cases:<\/p>\n In terms of functionality, EarlyRat is very simple. It is capable of executing commands, and that is about the most interesting thing it can do. There is a number of high-level similarities between EarlyRat and MagicRat. Both are written using a framework: QT is used for MagicRat and PureBasic, for EarlyRat. Also, the functionality of both RATs is very limited.<\/p>\n Despite being an APT group, Lazarus is known for performing typical cybercrime tasks, such as deploying ransomware, which makes the cybercrime landscape more complicated. Moreover, the group uses a wide variety of custom tools, constantly updating existing and developing new malware.<\/p>\n Focusing on TTPs as we did with Andariel helps to minimize attribution time and detect attacks in their early stages. This information can also help in taking proactive countermeasures to prevent incidents from happening.<\/p>\n Intelligence reports can help you to stay protected against these threats. If you want to keep up to date on the latest TTPs used by criminals, or if you have questions about our private reports, reach out to us at crimewareintel@kaspersky.com<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" In this crimeware report, Kaspersky researchers provide insights into Andariel\u2019s activity targeting organizations: clumsy commands executed manually, off-the-shelf tools and EasyRat malware.<\/p>\n","protected":false},"author":312,"featured_media":104667,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[919],"tags":[3623,4091,472,867,458,123,551],"banners":"","hreflang":[{"hreflang":"x-default","url":"https:\/\/securelist.com\/lazarus-andariel-mistakes-and-easyrat\/110119\/"},{"hreflang":"es","url":"https:\/\/securelist.lat\/lazarus-andariel-mistakes-and-easyrat\/98002\/"}],"_links":{"self":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/110119"}],"collection":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/users\/312"}],"replies":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/comments?post=110119"}],"version-history":[{"count":8,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/110119\/revisions"}],"predecessor-version":[{"id":110135,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/110119\/revisions\/110135"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media\/104667"}],"wp:attachment":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media?parent=110119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/categories?post=110119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/tags?post=110119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}From initial infection to fat fingers<\/h2>\n
\n
Meet EarlyRat<\/h2>\n
\n
Conclusion<\/h2>\n