Kerrdown

VOICE and the two bloggers all received emails containing spyware between February 2018 and November 2020. These emails pretended to share an important document. They either contained spyware as an attachment or as a link.

These emails pretended to share an important document. They either contained spyware as an attachment or as a link.

The malicious document added a scheduled task that launched the MsMpEng.exe copy and sideloaded the malicious MpSvc.dll; another task launched malicious Word 2007 every 60 minutes.

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.

has used malicious files including VBS, LNK, and HTML for execution... has sent malicious files requiring direct victim interaction to execute... has used malicious .exe or .dll files disguised as documents or images.

The malicious document added a scheduled task that launched the MsMpEng.exe copy and sideloaded the malicious MpSvc.dll; another task launched malicious Word 2007 every 60 minutes.

The malicious document added a scheduled task that launched the MsMpEng.exe copy and sideloaded the malicious MpSvc.dll; another task launched malicious Word 2007 every 60 minutes.

Kerrdown is a dropper that uses several layers of shellcode to obfuscate the final payload. Each one of them decrypting and redirecting to the next layer

This malware uses custom base64 and AES algorithms to obfuscate all the strings, making it harder to analyse or build signatures

Expanding payloads with junk data is a technique, called “binary padding”, often used by malware to avoid detection

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

These emails pretended to share an important document... the spyware would then open a decoy document in line with what the email pretended to share to trick the victim in believing the file was benign.

Kerrdown is a dropper that uses several layers of shellcode to obfuscate the final payload. Each one of them decrypting and redirecting to the next layer

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

Examples in the content include 'DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules,' 'Molerats decompresses ZIP files once on the victim machine,' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."