Exploring a New KimJongRAT Stealer Variant and Its PowerShell Implementation
Contents
Executive Summary
This article provides a comprehensive analysis of two new variants of the KimJongRAT stealer. We combine our new research findings with existing knowledge to provide a comprehensive resource for understanding and combating these new KimJongRAT variants.
The KimJongRAT stealer was first described in 2013 by the Malware.lu CERT [PDF]. We documented another variant of this family in 2019.
One of the new variants uses a Portable Executable (PE) file and the other uses a PowerShell implementation. The PE and PowerShell variants are both initiated by clicking a Windows shortcut (LNK) file that downloads a dropper file from an attacker-controlled content delivery network (CDN) account. The PE variant’s dropper deploys a loader, a decoy PDF and a text file. The dropper in the PowerShell variant deploys a decoy PDF file along with a ZIP archive.
The loader downloads more malicious files, including the stealer component for KimJongRAT.
The PowerShell variant's dropper file deploys a …
This article provides a comprehensive analysis of two new variants of the KimJongRAT stealer. We combine our new research findings with existing knowledge to provide a comprehensive resource for understanding and combating these new KimJongRAT variants.
The KimJongRAT stealer was first described in 2013 by the Malware.lu CERT [PDF]. We documented another variant of this family in 2019.
One of the new variants uses a Portable Executable (PE) file and the other uses a PowerShell implementation. The PE and PowerShell variants are both initiated by clicking a Windows shortcut (LNK) file that downloads a dropper file from an attacker-controlled content delivery network (CDN) account. The PE variant’s dropper deploys a loader, a decoy PDF and a text file. The dropper in the PowerShell variant deploys a decoy PDF file along with a ZIP archive.
The loader downloads more malicious files, including the stealer component for KimJongRAT.
The PowerShell variant's dropper file deploys a …
IoC
http://cdn.glitch.global/c97fe797-45c1-473b-a2f8-3c0c8bb431af/
http://cdn.glitch.global
http://srvdown.ddns.net/service3/
http://cdn.glitch.global/4ab4f138-6f66-4b39-a7dc-9d4843dcf34f/
http://131.153.13.235/sp/
http://cdn.glitch.global/2eefa6a0-44ff-4979-9a9c-689be652996d/
http://secservice.ddns.net/service2/
http://131.153.13.235/service/
http://cdn.glitch.global/17443dac-272c-421c-80ac-53a3695ede0e/
http://cdn.glitch.global/59e3786e-8284-4f16-8844-134b12e58b6f/
131.153.13.235
[email protected]
45980cc8afb4e1b3738130d0855bb608530eef6731c5116fd053ac6e04159725
9e4e45e8f12db94997767bd3899968b9bc147bf08c062d3caea7f0864a67ea2c
02783530bbd8416ebc82ab1eb5bbe81d5d87731d24c6ff6a8e12139a5fe33cee
96df4f9cb5d9cacd6e3b947c61af9b8317194b1285936ce103f155e082290381
ef0ce406fa722d30bfa094c660e81ed4a72ff8c75a629081293f4a86e0e587c2
2ba3397cba28af1a929403910035b78bf946acbafe9e186ac329b55086fe7703
d92b858d691c84b4e3752fdd46b5673fbd6b5af101a7111c1d8756c90271b732
8b0b62a31b348c5a2337ee69cfd3f68a427466539484f55f1cd2910237b59700
9c9136fc8a279ce395997dd42c075e265c6daec14b13bbe4237a4178769d270e
3c6476411d214d40d0cc43241f63e933f5a77991939de158df40d84d04b7aa78
3c2ea04090ad8c28116c42a9a2be5b240f135ac184e5a2c121b4eb311a7bf075
b103190c647ddd7d16766ee5af19e265f0e15d57e91a07b2a866f5b18178581c
eb68ed54e543c18070e5cc93a27db4a508d79016c09e28a47260ca080110328f
4b87b775cdb265ecd872a71be810d7816d0d8b54663b3c536862db098874f288
3589c871b56cf76ce28c6be914b206afe977ec13b0894f56e05c5772a3c7e495
a66c25b1f0dea6e06a4c9f8c5f6ebba0f6c21bd3b9cc326a56702db30418f189
b7dad38a099947612fcc42c50f4ba1708af969a3222b3345bdff35323a41974d
3b0a3bd5b790e5f130e7819550613b7e0194a3475f553285a1b7dc18ecca9d02
c356cd9fea07353a0ee4dfd4652bf79111b70790e7ed63df6b31d7ec2f5953d5
28f2fcece68822c38e72310c911ef007f8bd8fd711f2080844f666b7f371e9e1
8a000aa43c17250dd02f842bc2ab37e47dd8d68da0d59753943df8b37004b701
d7a61ab1b1eadd3b34386ec2a96324195ec25cd71fe4e5d9a8f993a6bd52eb92
9bfbf7618a2c5270d552f4deb69b56082cc7723433a1517678863363cb800161
accf50d769408253bf9a7da378228debce7c8f6d60fb76da48196fe42cacedf3
7a37e2d6dc941386d1f300bac48056030f37c950bcd441d83eca708d2beab939
4e45009f5b582ca404b197d28805e363a537856b55e39c5c806fcf05acd928ff
6347d70b73e1cabadf8af8602b22a8220ed5b7298dbc15f16eb7dd493d6c6a78
97d1bd607b4dc00c356dd873cd4ac309e98f2bb17ae9a6791fc0a88bc056195a
5a18a29791cfb18767a43bebb61f923e64be7988235213678514007174f60b3e
ab8862628584aa429fe7614d1c674bbdf324fa2668c4d3c94670cf6b6db597f6
85be5cc01f0e0127a26dceba76571a94335d00d490e5391ccef72e115c3301b3
f4d9547269e0cd7a0df97e394f688e0eb00b31965abd5e6ad67d373a7dc58f3b
f73164bd4d2a475f79fb7d0806cfc3ddb510015f9161e7dce537d90956c11393
be080777332ad1186fb8547a6a354b2beba62f2a24537eb7b79e849f084a95be
7a9f4ca13aed4d6d8ba430bc2b2f5ac2e4f9c7b5de2f5d2ba5aada211059da73
b90b2d992b41d146e70b775e2bc0430b9f7fb0ed0cd285c59daea92c2fc6af0b
bdb272189a7cdcf166fce130d58b794b242c582032f19369166b3d4cfdc0902c
5097553dff2a2da4f16b80a346fe543422b22d262e0c40e187b345afbcc7d41a
945e4f78196ef3a5548996a8d09e4220b779a2e78d40a86d64f233f7908550e6
bcdc99e0f17486aa5a5faa0b9e7d7ccbeaa5372626733433214bb722ba260234
http://cdn.glitch.global
http://srvdown.ddns.net/service3/
http://cdn.glitch.global/4ab4f138-6f66-4b39-a7dc-9d4843dcf34f/
http://131.153.13.235/sp/
http://cdn.glitch.global/2eefa6a0-44ff-4979-9a9c-689be652996d/
http://secservice.ddns.net/service2/
http://131.153.13.235/service/
http://cdn.glitch.global/17443dac-272c-421c-80ac-53a3695ede0e/
http://cdn.glitch.global/59e3786e-8284-4f16-8844-134b12e58b6f/
131.153.13.235
[email protected]
45980cc8afb4e1b3738130d0855bb608530eef6731c5116fd053ac6e04159725
9e4e45e8f12db94997767bd3899968b9bc147bf08c062d3caea7f0864a67ea2c
02783530bbd8416ebc82ab1eb5bbe81d5d87731d24c6ff6a8e12139a5fe33cee
96df4f9cb5d9cacd6e3b947c61af9b8317194b1285936ce103f155e082290381
ef0ce406fa722d30bfa094c660e81ed4a72ff8c75a629081293f4a86e0e587c2
2ba3397cba28af1a929403910035b78bf946acbafe9e186ac329b55086fe7703
d92b858d691c84b4e3752fdd46b5673fbd6b5af101a7111c1d8756c90271b732
8b0b62a31b348c5a2337ee69cfd3f68a427466539484f55f1cd2910237b59700
9c9136fc8a279ce395997dd42c075e265c6daec14b13bbe4237a4178769d270e
3c6476411d214d40d0cc43241f63e933f5a77991939de158df40d84d04b7aa78
3c2ea04090ad8c28116c42a9a2be5b240f135ac184e5a2c121b4eb311a7bf075
b103190c647ddd7d16766ee5af19e265f0e15d57e91a07b2a866f5b18178581c
eb68ed54e543c18070e5cc93a27db4a508d79016c09e28a47260ca080110328f
4b87b775cdb265ecd872a71be810d7816d0d8b54663b3c536862db098874f288
3589c871b56cf76ce28c6be914b206afe977ec13b0894f56e05c5772a3c7e495
a66c25b1f0dea6e06a4c9f8c5f6ebba0f6c21bd3b9cc326a56702db30418f189
b7dad38a099947612fcc42c50f4ba1708af969a3222b3345bdff35323a41974d
3b0a3bd5b790e5f130e7819550613b7e0194a3475f553285a1b7dc18ecca9d02
c356cd9fea07353a0ee4dfd4652bf79111b70790e7ed63df6b31d7ec2f5953d5
28f2fcece68822c38e72310c911ef007f8bd8fd711f2080844f666b7f371e9e1
8a000aa43c17250dd02f842bc2ab37e47dd8d68da0d59753943df8b37004b701
d7a61ab1b1eadd3b34386ec2a96324195ec25cd71fe4e5d9a8f993a6bd52eb92
9bfbf7618a2c5270d552f4deb69b56082cc7723433a1517678863363cb800161
accf50d769408253bf9a7da378228debce7c8f6d60fb76da48196fe42cacedf3
7a37e2d6dc941386d1f300bac48056030f37c950bcd441d83eca708d2beab939
4e45009f5b582ca404b197d28805e363a537856b55e39c5c806fcf05acd928ff
6347d70b73e1cabadf8af8602b22a8220ed5b7298dbc15f16eb7dd493d6c6a78
97d1bd607b4dc00c356dd873cd4ac309e98f2bb17ae9a6791fc0a88bc056195a
5a18a29791cfb18767a43bebb61f923e64be7988235213678514007174f60b3e
ab8862628584aa429fe7614d1c674bbdf324fa2668c4d3c94670cf6b6db597f6
85be5cc01f0e0127a26dceba76571a94335d00d490e5391ccef72e115c3301b3
f4d9547269e0cd7a0df97e394f688e0eb00b31965abd5e6ad67d373a7dc58f3b
f73164bd4d2a475f79fb7d0806cfc3ddb510015f9161e7dce537d90956c11393
be080777332ad1186fb8547a6a354b2beba62f2a24537eb7b79e849f084a95be
7a9f4ca13aed4d6d8ba430bc2b2f5ac2e4f9c7b5de2f5d2ba5aada211059da73
b90b2d992b41d146e70b775e2bc0430b9f7fb0ed0cd285c59daea92c2fc6af0b
bdb272189a7cdcf166fce130d58b794b242c582032f19369166b3d4cfdc0902c
5097553dff2a2da4f16b80a346fe543422b22d262e0c40e187b345afbcc7d41a
945e4f78196ef3a5548996a8d09e4220b779a2e78d40a86d64f233f7908550e6
bcdc99e0f17486aa5a5faa0b9e7d7ccbeaa5372626733433214bb722ba260234