Hackers Mimic Popular VPN Download page to Deliver Malware

As per experiences, possibility actors contain been the exhaust of domestic VPN installation recordsdata for distributing SparkRAT malware which ends in MeshAgent an infection on the victim systems. The distinction between outdated incidents and the most fresh one is that previously Sliver C2 was as a alternative of SparkRAT.

Further investigations published that every undoubtedly one of many VPN programs contain been developed by the identical developer. Menace actors contain spoofed the certificates of the corresponding developer for distributing the malware.

It was concluded that possibility actors had attacked the developer of this system for these malware file distributions. These form of attacks contain been ongoing since the primary half of of 2023.

SparkRAT – Technical Analysis

SparkRAT is a distant derive admission to trojan that’s readily accessible initiate-provide and written in the Slide language. It is in a position to controlling the contaminated draw with expose execution, knowledge stealing, and regulate processes.

The initial phases of assault for this possibility vector involve the installation of a malicious VPN file that was developed in .NET, which executes the installation of the VPN and the SparkRAT malware.

Previously, possibility actors feeble droppers for inserting in malicious codes, that are truly replaced by downloader and injector malware. The malicious codes are obfuscated to evade possibility detection tool.

Noteworthy Utilization of Slide Language

Apart from to this info, it was also found that the SparkRAT, injector, downloader malware, and the expose and regulate server Sliver C2 contain been all developed in the Slide language. The possibility actor selected Slide language for creating malware as a alternative of different programming languages.

Throughout the installation, the malware communicates with the C2 server to receive the encrypted settings knowledge, which consists of the must haves for downloading the Sliver C2. As soon as the must haves are met, Sliver C2 is downloaded from the settings server “hxxps://characteristic.devq[.]workers.dev/”.

Other malicious installation recordsdata also verify for the presently operating processes which is in contrast with the checklist of processes mentioned in the malware for additional exploitation. The possibility actor place in SparkRAT, Sliver C2, and MeshAgent in say to possess regulate of the contaminated draw and produce varied actions.

A total file has been published by AhnLab Security Emergency Response Center (ASEC) which mentions the initial infiltration, exploitation, and expose and regulate of this malware and the possibility actor.

Indicators of Compromise and C2 Servers

The servers from which Sliver was downloaded are as follows,

• Sliver C2 receive address : hxxps://config.v6[.]navy/sans.woff2
• Sliver C2 Title : PRETTY_BLADDER
• C&C address of Sliver C2 : hxxps://panda.sect[.]kr
• C&C address of MeshAgent : drag.ableoil[.]derive:443

File Analysis

– Trojan/Ranking.MeshAgent.C5457071 (2023.07.18.03)

– Trojan/Ranking.MeshAgent.C5459839 (2023.07.24.03)

– Downloader/Ranking.Agent.C5459845 (2023.07.24.03)

– Downloader/Ranking.Agent.C545985 1 (2023.07.24.03)

– Data/BIN.EncPe (2023.07.25.00)

Behavioural Analysis

– Persistence/MDP.RunKey.M1038

MD5 Hashes

– e84750393483bbb32a46ca5a6a9d253c : 악성 인스톨러
– eefbc5ec539282ad47af52c81979edb3 : 악성 인스톨러 (31254396_hzczvmfw_….vpn1.1.1.exe)
– 10298c1ddae73915eb904312d2c6007d : 악성 인스톨러 (31254396_LO38iuSd_….Setup1.2.1.exe)
– b4481eef767661e9c9524d94d808dcb6 : 악성 인스톨러 (31254396_a7z34P10_….Install2.1.7.exe)
– 70257b502f6db70e0c75f03e750dca64 : 악성 인스톨러 (167775112_v17MGr85_167775039_EvimzM59_….VPNSetup1.0.4.4.exe)
– 1906bf1a2c96e49bd8eba29cf430435f : 악성 인스톨러 (167774990_A5TinsS6_….VPNInstaller1.0.4_230710.exe)
– 499f0d42d5e7e121d9a751b3aac2e3f8 : 악성 인스톨러 (31254396_ORZNvfG9_….Fax1.0.0.exe)
– b66f351c35212c7a265272d27aa09656 : 악성 VPN 프로그램
– ea20d797c0046441c8f8e76be665e882: 악성 VPN 프로그램
– 73f83322fce3ef38b816bef8fa28d37b : Encrypted Sliver C2 (sans.font2)
– 5eb6821057c28fd53b277bc7c6a17465 : MeshAgent (preMicrosoft.exe)
– 95dac8965620e69e51a1dbdf7ebbf53a : MeshAgent ( Microsoft.exe)
– 23f72ee555afcd235c0c8639f282f3c6 : MeshAgent (registrys.exe)
– 27a24461bd082ec60596abbad23e59f2 : Webcam snatch malware (m.exe)

Salvage address

– hxxps://characteristic.devq[.]workers.dev/ : Configuration knowledge
– hxxps://config.v6[.]navy/sans.woff2 : Encrypted Sliver C2

C&C address

– panda.sect[.]kr:443 : Sliver C2
– drag.ableoil[.]derive:443 : MeshAgent