Andariel Group Exploiting Korean Asset Management Solutions (MeshAgent)
Contents
AhnLab SEcurity intelligence Center (ASEC) recently discovered the Andariel group’s continuous attacks on Korean companies. It is notable that installations of MeshAgent were found in some cases. Threat actors often exploit MeshAgent along with other similar remote management tools because it offers diverse remote control features.
The Andariel group exploited Korean asset management solutions to install malware such as AndarLoader and ModeLoader, which are the malware used in the previous cases. Starting with Innorix Agent in the past, the group has been continually exploiting Korean asset management solutions to distribute their malware during the lateral movement phase [1] [2].
1. AndarLoader
The ASEC team previously introduced AndarLoader in the past blog article, “Analysis of Andariel’s New Attack Activities” [3]. AndarLoader looks similar to Andardoor found in attack cases that exploited Innorix Agent, but unlike Andardoor which has most of the backdoor features (executing commands received from the C&C server) implemented in binary, AndarLoader …
The Andariel group exploited Korean asset management solutions to install malware such as AndarLoader and ModeLoader, which are the malware used in the previous cases. Starting with Innorix Agent in the past, the group has been continually exploiting Korean asset management solutions to distribute their malware during the lateral movement phase [1] [2].
1. AndarLoader
The ASEC team previously introduced AndarLoader in the past blog article, “Analysis of Andariel’s New Attack Activities” [3]. AndarLoader looks similar to Andardoor found in attack cases that exploited Innorix Agent, but unlike Andardoor which has most of the backdoor features (executing commands received from the C&C server) implemented in binary, AndarLoader …
IoC
29efd64dd3c7fe1e2b022b7ad73a1ba5
2c69c4786ce663e58a3cc093c6d5b530
4f1b1124e34894398aa423200a8ab894
84.38.129.21
a714b928bbc7cd480fed85e379966f95
http://84.38.129.21
http://panda.ourhome.o-r.kr/modeRead.php
http://panda.ourhome.o-r.kr/modeView.php
http://panda.ourhome.o-r.kr/view.php
http://privacy.hopto.org:443
http://privatemake.bounceme.net:443
http://www.ipservice.kro.kr/index.php
http://www.ipservice.kro.kr/modeRead.php
http://www.ipservice.kro.kr/view.php
http://www.mssrv.kro.kr/modeRead.php
http://www.mssrv.kro.kr/modeView.php
http://www.mssrv.kro.kr/modeWrite.php
http://www.mssrv.kro.kr/view.php
2c69c4786ce663e58a3cc093c6d5b530
4f1b1124e34894398aa423200a8ab894
84.38.129.21
a714b928bbc7cd480fed85e379966f95
http://84.38.129.21
http://panda.ourhome.o-r.kr/modeRead.php
http://panda.ourhome.o-r.kr/modeView.php
http://panda.ourhome.o-r.kr/view.php
http://privacy.hopto.org:443
http://privatemake.bounceme.net:443
http://www.ipservice.kro.kr/index.php
http://www.ipservice.kro.kr/modeRead.php
http://www.ipservice.kro.kr/view.php
http://www.mssrv.kro.kr/modeRead.php
http://www.mssrv.kro.kr/modeView.php
http://www.mssrv.kro.kr/modeWrite.php
http://www.mssrv.kro.kr/view.php