Friday, May 24, 2024

OceanLotus(APT32) Threat Actor Group Deliver KerrDown Malware Via Word Document and RAR Archive

OceanLotus group known for Multiple attack campaigns around the globe, the threat actor group targets private sectors across multiple industries, foreign governments, activists, and dissidents connected to Vietnam.

Palo Alto Networks’ Unit 42 division researchers observed a new custom malware family dubbed “KerrDown” used by the threat actor group since 2018. This ongoing campaign primarily targets individuals in Vietnam or Vietnamese speaking individuals.

Threat actors deliver the KerrDown downloader malware to targets in two methods

  • Malicious Macro Enabled Word Document
  • RAR archive

Malicious Word Document – KerrDown

Once the victim opens the malicious payload file, it asks victims to enable macros to see the contents of the file, the document contains an image file written in Vietnamese language and two base64 blobs inserted in the page.

In order to deceive the victims and to evade detection from automated tools, the attackers have changed the font size to 1.


Based on the victim’s machine architecture(32 bit/64 bit) the embedded KerrDown DLLs will be dropped in the victim machine.

“The DLL retrieves the payload from the URL, decrypts it by using the DES algorithm and execute it in the memory. Therefore, it is observed that only the KerrDown DLL downloader is saved in the system and the payload directly gets executed in the memory.”

At the time of analysis, researchers found that KerrDown was still active and they able to download the copy of the variant.

RAR Archives – KerrDown

With the RAR variant attackers modified the downloader code, added more stages and hiding each stage by compression and encryption. They also change the way in how the malicious code executes.

When victims open the malicious DLL file from the archive it loads the DLL file and the DLL file loads multiple stages to execute the final payload.

  • Once the victim opens the document it runs wwlib[.]dll in the same directory.
  • The DLL decodes the encoded base64 shellcode and executes.
  • Then shell code decrypts the second shellcode.
  • Second shell code decrypts Third shellcode with AES.
  • Third shellcode retrieves the file from the remote location and executes it.
  • Fourth shellcode loads the cobalt strike beacon and embedded that in the memory.

we have seen with the new KerrDown downloader being used in their recent campaigns, the group continues to build and employ new tools and techniques in their overall operations and playbooks,” the complete list of IoCs can be found in paloaltonetworks blog post.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Hackers Offered IoT Botnet as Service “TheMoon” : Botnet-as-a-Service

Mac Malware Steals Cookies & saved Passwords when Users Visiting Crypto Exchange Service Websites


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles