A Quick Look at a New KONNI RAT Variant
Contents
FortiGuard Labs Threat Research
KONNI is a remote access Trojan (RAT) that was first reported in May of 2017, but is believed to have been in use for over 3 years. As Part of our daily threat monitoring, FortiGuard Labs came across a new variant of the KONNI RAT and decided to take a deeper look.
KONNI is known to be distributed via campaigns that are believed to be targeting North Korea. This new variant isn’t different from previous variants, as it is dropped by a DOC file containing text that was drawn from a CNN article entitled 12 things Trump should know about North Korea. The article was published on August 9, 2017, which indicates that this might be the latest campaign. Although KONNI campaigns use decoy documents containing articles about North Korea, it is hard to tell if the targets have something to do with matters involving North Korea.
Decoy document …
KONNI is a remote access Trojan (RAT) that was first reported in May of 2017, but is believed to have been in use for over 3 years. As Part of our daily threat monitoring, FortiGuard Labs came across a new variant of the KONNI RAT and decided to take a deeper look.
KONNI is known to be distributed via campaigns that are believed to be targeting North Korea. This new variant isn’t different from previous variants, as it is dropped by a DOC file containing text that was drawn from a CNN article entitled 12 things Trump should know about North Korea. The article was published on August 9, 2017, which indicates that this might be the latest campaign. Although KONNI campaigns use decoy documents containing articles about North Korea, it is hard to tell if the targets have something to do with matters involving North Korea.
Decoy document …
IoC
0914ef43125114162082a11722c4cfc3
38ead1e8ffd5b357e879d7cb8f467508
834d3b0ce76b3f62ff87b7d6f2f9cc9b
http://donkeydancehome.freeiz.com/weget/upload.php
http://seesionerrorwebmailattach.uphero.com/attach/download.php?file=12%20things%20Trump%20should%20know%20about%20North%20Korea.doc
38ead1e8ffd5b357e879d7cb8f467508
834d3b0ce76b3f62ff87b7d6f2f9cc9b
http://donkeydancehome.freeiz.com/weget/upload.php
http://seesionerrorwebmailattach.uphero.com/attach/download.php?file=12%20things%20Trump%20should%20know%20about%20North%20Korea.doc