Monday, December 4, 2023

OceanLotus(APT32) Threat Actor Group Deliver KerrDown Malware Via Word Document and RAR Archive

OceanLotus group known for Multiple attack campaigns around the globe, the threat actor group targets private sectors across multiple industries, foreign governments, activists, and dissidents connected to Vietnam.

Palo Alto Networks’ Unit 42 division researchers observed a new custom malware family dubbed “KerrDown” used by the threat actor group since 2018. This ongoing campaign primarily targets individuals in Vietnam or Vietnamese speaking individuals.

Threat actors deliver the KerrDown downloader malware to targets in two methods

  • Malicious Macro Enabled Word Document
  • RAR archive

Malicious Word Document – KerrDown

Once the victim opens the malicious payload file, it asks victims to enable macros to see the contents of the file, the document contains an image file written in Vietnamese language and two base64 blobs inserted in the page.

In order to deceive the victims and to evade detection from automated tools, the attackers have changed the font size to 1.


Based on the victim’s machine architecture(32 bit/64 bit) the embedded KerrDown DLLs will be dropped in the victim machine.

“The DLL retrieves the payload from the URL, decrypts it by using the DES algorithm and execute it in the memory. Therefore, it is observed that only the KerrDown DLL downloader is saved in the system and the payload directly gets executed in the memory.”

At the time of analysis, researchers found that KerrDown was still active and they able to download the copy of the variant.

RAR Archives – KerrDown

With the RAR variant attackers modified the downloader code, added more stages and hiding each stage by compression and encryption. They also change the way in how the malicious code executes.

When victims open the malicious DLL file from the archive it loads the DLL file and the DLL file loads multiple stages to execute the final payload.

  • Once the victim opens the document it runs wwlib[.]dll in the same directory.
  • The DLL decodes the encoded base64 shellcode and executes.
  • Then shell code decrypts the second shellcode.
  • Second shell code decrypts Third shellcode with AES.
  • Third shellcode retrieves the file from the remote location and executes it.
  • Fourth shellcode loads the cobalt strike beacon and embedded that in the memory.

we have seen with the new KerrDown downloader being used in their recent campaigns, the group continues to build and employ new tools and techniques in their overall operations and playbooks,” the complete list of IoCs can be found in paloaltonetworks blog post.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Hackers Offered IoT Botnet as Service “TheMoon” : Botnet-as-a-Service

Mac Malware Steals Cookies & saved Passwords when Users Visiting Crypto Exchange Service Websites


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles