OceanLotus(APT32) Threat Actor Group Deliver KerrDown Malware Via Word Document and RAR Archive

OceanLotus group known for Multiple attack campaigns around the globe, the threat actor group targets private sectors across multiple industries, foreign governments, activists, and dissidents connected to Vietnam.

Palo Alto Networks’ Unit 42 division researchers observed a new custom malware family dubbed “KerrDown” used by the threat actor group since 2018. This ongoing campaign primarily targets individuals in Vietnam or Vietnamese speaking individuals.

Threat actors deliver the KerrDown downloader malware to targets in two methods

• Malicious Macro Enabled Word Document
• RAR archive

Malicious Word Document – KerrDown

Once the victim opens the malicious payload file, it asks victims to enable macros to see the contents of the file, the document contains an image file written in Vietnamese language and two base64 blobs inserted in the page.

In order to deceive the victims and to evade detection from automated tools, the attackers have changed the font size to 1.

Based on the victim’s machine architecture(32 bit/64 bit) the embedded KerrDown DLLs will be dropped in the victim machine.

“The DLL retrieves the payload from the URL, decrypts it by using the DES algorithm and execute it in the memory. Therefore, it is observed that only the KerrDown DLL downloader is saved in the system and the payload directly gets executed in the memory.”

At the time of analysis, researchers found that KerrDown was still active and they able to download the copy of the variant.

RAR Archives – KerrDown

With the RAR variant attackers modified the downloader code, added more stages and hiding each stage by compression and encryption. They also change the way in how the malicious code executes.

When victims open the malicious DLL file from the archive it loads the DLL file and the DLL file loads multiple stages to execute the final payload.

• Once the victim opens the document it runs wwlib[.]dll in the same directory.
• The DLL decodes the encoded base64 shellcode and executes.
• Then shell code decrypts the second shellcode.
• Second shell code decrypts Third shellcode with AES.
• Third shellcode retrieves the file from the remote location and executes it.
• Fourth shellcode loads the cobalt strike beacon and embedded that in the memory.

we have seen with the new KerrDown downloader being used in their recent campaigns, the group continues to build and employ new tools and techniques in their overall operations and playbooks,” the complete list of IoCs can be found in paloaltonetworks blog post.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Related Read

Hackers Offered IoT Botnet as Service “TheMoon” : Botnet-as-a-Service

Mac Malware Steals Cookies & saved Passwords when Users Visiting Crypto Exchange Service Websites