Loading malware…
M2RAT, also known as Map2RAT, is a Windows remote-access trojan used by the North Korean espionage group APT37, also known as RedEyes and ScarCruft. Publicly identified in February 2023, it was deployed in a January 2023 campaign targeting individuals in South Korea for intelligence collection and data theft. The infection chain used phishing emails with malicious Hangul Word Processor attachments exploiting the EPS-processing vulnerability CVE-2017-8291. Exploit shellcode retrieved a JPEG containing a steganographically concealed, XOR-encoded loader, which downloaded M2RAT and injected it into a legitimate Windows process. The attack chain established persistence through a Windows Run key that invoked PowerShell and additional remotely hosted scripts.
M2RAT supports remote command execution, process creation and termination, keylogging, periodic desktop screenshots, and file theft. It uses shared-memory sections to coordinate command handling and data collection, and transmits keystrokes and screenshots directly to its command-and-control server to limit local artifacts. It stores victim-identification and server-configuration data in the registry using XOR encoding. The malware also searches connected portable devices, removable drives, and shared folders for documents and audio recordings, stages selected files on the compromised computer, and exfiltrates them in password-protected RAR archives. Its collection of connected-device data occurs through the infected Windows host rather than through a demonstrated native mobile variant.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
ASEC(AhnLab Security Emergengy response Center) 분석팀은 지난 1월 RedEyes 공격 그룹(also known as APT37, ScarCruft)이 한글 EPS(Encapulated PostScript) 취약점(CVE-2017-8291)을 통해 악성코드를 유포하는 정황을 확인하였다. | ASEC 분석팀은 새롭게 확인된 악성코드에 대해 공유 메모리 섹션 이름을 인용하여 M2RAT(Map2RAT) 이라 명명하였다.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
이번에도 RedEyes 그룹의 M2RAT 악성코드 공격 과정 중 “2.3. 지속성 유지 (Persistence)” 과정에서 사용된 명령어가 동일하게 확인되었다.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
The M2RAT backdoor acts as a basic remote access trojan that performs keylogging, data theft, command execution, and the taking of screenshots from the desktop.
등록된 레지스트리 키에 의해 시스템이 부팅할 때 마다 피해 호스트 PC에서는 파워쉘과 윈도우 정상 유틸리티인 mshta가 실행된다... JS 코드는 파워쉘 명령을 실행하며 공격자 서버로 부터 명령을 전달받아 실행하고, 결과를 전달하는 기능을 수행한다.
값 : c:\windows\system32\cmd.exe /c PowerShell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass ...
해당 URL 에는 JS(JavaScript) 코드가 포함되어 있으며, 해당 코드는 인코딩된 파워쉘 명령어를 실행하는 기능을 수행한다.
M2RAT의 경우 공유 메모리 섹션을 생성하여 공격자 서버로부터 원격 제어 명령을 실행한다... CMD 명령은 공유 메모리를 통해 전달이되며, 메모리 섹션의 이름 정보는 다음 [표 2]와 같다.
이미지 파일은 정상 JPEG 헤더와 PE 파일 디코딩에 필요한 메타 데이터(XOR 키, 파일 사이즈), 인코딩된 PE 파일로 이루어져 있다. PE 디코딩은 16바이트 xor 키를 이용하여 한 바이트씩 xor 한다.
공격자는 악성코드를 이미지에 포함하는 스테가노그래피 기법을 사용하였으며 이는 네트워크 탐지 회피를 위해 사용한 기법으로 추정된다.
디코딩된 파워쉘 명령어는 지속성을 위한 RUN 키 등록, 공격자 서버로부터 명령어 수신, 명령 실행 결과 전달의 기능을 수행하는 백도어 유형이다.
M2RAT의 C&C 통신 명령체계는 공격자 서버로부터 POST 메소드의 Body로 명령을 전달받으며... hxxps://www.*******elearning.or[.]kr/popup/handle/log.php? U=[컴퓨터이름]+[유저이름] ... R=[BASE64 인코딩]
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
M2RAT is malware used in targeted espionage attacks and is listed as part of ScarCruft's custom malware arsenal.
Listed as malware used by Group123; its capabilities are not described.
A backdoor/RAT associated with the RedEyes group. In this campaign, the observed CHM malware uses commands and persistence patterns similar to those seen in M2RAT attacks. The decoded PowerShell establishes persistence via a RUN key, receives commands from a C2 server, returns execution results, and can upload/download files, transmit file information, edit the registry, create scheduled tasks, unzip archives, rename files, and delete files.
A RAT reportedly used by APT37 that hides executables inside JPEG files using steganography to evade detection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.