Loading malware…
M2RAT, also called Map2RAT, is a Windows remote access trojan associated with the North Korean espionage group APT37, also known as RedEyes and ScarCruft. It has been used in targeted intelligence-collection operations against individuals in South Korea and is designed to minimize forensic visibility by relying on shared-memory sections for command handling and data transfer rather than leaving extensive local artifacts.
Observed intrusion chains delivered M2RAT through phishing lures that exploited CVE-2017-8291 in older Hangul Word Processor installations. In documented cases, exploit code retrieved a steganographically concealed payload from an image, decoded it, and used a loader to establish persistence and inject the backdoor into explorer.exe. Related RedEyes activity has also reused similar persistence tradecraft in malicious CHM-based campaigns.
M2RAT supports interactive remote control and espionage functions including command execution, process creation and termination, keylogging, screenshot capture, and theft of files from the compromised host. It also searches removable or connected portable devices for documents and audio recordings, stages collected data, compresses it into password-protected archives, and exfiltrates it to attacker-controlled infrastructure. Reporting indicates that keylogging data and screenshots can be transmitted directly, reducing residual evidence on disk. Additional behavior includes storing encoded victim and configuration data in the registry and using shared-memory sections dedicated to functions such as file collection, capture, process control, typing records, USB checking, and registry operations.
M2RAT is distinct from Chinotto despite overlap in operator ecosystem, chiefly because M2RAT uses shared-memory-based command and exfiltration workflows. Its tradecraft, delivery patterns, and persistence mechanisms align with APT37’s long-running focus on stealthy, custom malware for politically motivated cyber espionage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
ASEC(AhnLab Security Emergengy response Center) 분석팀은 지난 1월 RedEyes 공격 그룹(also known as APT37, ScarCruft)이 한글 EPS(Encapulated PostScript) 취약점(CVE-2017-8291)을 통해 악성코드를 유포하는 정황을 확인하였다. | ASEC 분석팀은 새롭게 확인된 악성코드에 대해 공유 메모리 섹션 이름을 인용하여 M2RAT(Map2RAT) 이라 명명하였다.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In February, AhnLab reported a new RAT named Map2RAT or M2RAT for short.
이번에도 RedEyes 그룹의 M2RAT 악성코드 공격 과정 중 “2.3. 지속성 유지 (Persistence)” 과정에서 사용된 명령어가 동일하게 확인되었다.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
The M2RAT backdoor acts as a basic remote access trojan that performs keylogging, data theft, command execution, and the taking of screenshots from the desktop.
등록된 레지스트리 키에 의해 시스템이 부팅할 때 마다 피해 호스트 PC에서는 파워쉘과 윈도우 정상 유틸리티인 mshta가 실행된다... JS 코드는 파워쉘 명령을 실행하며 공격자 서버로 부터 명령을 전달받아 실행하고, 결과를 전달하는 기능을 수행한다.
값 : c:\windows\system32\cmd.exe /c PowerShell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass ...
해당 URL 에는 JS(JavaScript) 코드가 포함되어 있으며, 해당 코드는 인코딩된 파워쉘 명령어를 실행하는 기능을 수행한다.
M2RAT의 경우 공유 메모리 섹션을 생성하여 공격자 서버로부터 원격 제어 명령을 실행한다... CMD 명령은 공유 메모리를 통해 전달이되며, 메모리 섹션의 이름 정보는 다음 [표 2]와 같다.
이미지 파일은 정상 JPEG 헤더와 PE 파일 디코딩에 필요한 메타 데이터(XOR 키, 파일 사이즈), 인코딩된 PE 파일로 이루어져 있다. PE 디코딩은 16바이트 xor 키를 이용하여 한 바이트씩 xor 한다.
공격자는 악성코드를 이미지에 포함하는 스테가노그래피 기법을 사용하였으며 이는 네트워크 탐지 회피를 위해 사용한 기법으로 추정된다.
디코딩된 파워쉘 명령어는 지속성을 위한 RUN 키 등록, 공격자 서버로부터 명령어 수신, 명령 실행 결과 전달의 기능을 수행하는 백도어 유형이다.
M2RAT의 C&C 통신 명령체계는 공격자 서버로부터 POST 메소드의 Body로 명령을 전달받으며... hxxps://www.*******elearning.or[.]kr/popup/handle/log.php? U=[컴퓨터이름]+[유저이름] ... R=[BASE64 인코딩]
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
M2RAT is malware used in targeted espionage attacks and is listed as part of ScarCruft's custom malware arsenal.
A backdoor/RAT associated with the RedEyes group. In this campaign, the observed CHM malware uses commands and persistence patterns similar to those seen in M2RAT attacks. The decoded PowerShell establishes persistence via a RUN key, receives commands from a C2 server, returns execution results, and can upload/download files, transmit file information, edit the registry, create scheduled tasks, unzip archives, rename files, and delete files.
A RAT reportedly used by APT37 that hides executables inside JPEG files using steganography to evade detection.
A newly identified backdoor/RAT used in the RedEyes (APT37/ScarCruft) campaign. It is injected into explorer.exe and supports command-and-control via POST body data and shared memory sections. Its capabilities include keylogging, screen capture, process execution/termination, file and document theft, USB/removable-media data theft, and exfiltration of phone data via an auxiliary module. It stores encoded victim MAC address and C2 information in the registry and is designed to minimize local forensic traces by sending captured data directly to the attacker server.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.