Pierluigi Paganini May 13, 2020

The United States Cyber Command (USCYBERCOM) has uploaded five new North Korean malware samples to VirusTotal.

The United States Cyber Command (USCYBERCOM) has shared five new malware samples attributed to the North Korea-linked Lazarus APT, it has uploaded the malicious code to VirusTotal.

“On May 12, 2020, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD) released three Malware Analysis Reports (MARs) on malware variants used by the North Korean government.” reads the DHS CISA’s advisory.

• May 12, 2020: Malware Analysis Report (1028834-1.v1) – North Korean Remote Access Tool: COPPERHEDGE
• May 12, 2020: Malware Analysis Report (1028834-2.v1) – North Korean Trojan: TAINTEDSCRIBE
• May 12, 2020: Malware Analysis Report (1028834-3.v1) – North Korean Trojan: PEBBLEDASH

The information contained in the alerts and MARs listed above is the result of analytic efforts between the U.S. Department of Homeland Security, the U.S. Department of Defense, and the Federal Bureau of Investigation to provide technical details on the tools and infrastructure used by cyber actors of the North Korean government.”

Since November 2018, the USCYBERCOM’s Cyber National Mission Force (CNMF) is sharing the unclassified malware samples on the CYBERCOM_Malware_Alert VirusTotal account.

In February, the government experts released new and updated Malware Analysis Reports (MARs) related to new malware families involved in new attacks carried out by North Korea-linked HIDDEN COBRA group.

Now, USCYBERCOM shares five more samples, the older one dated 2017 while the rest has been created in 2018. 

The samples belong to the COPPERHEDGE, TAINTEDSCRIBE, and PEBBLEDASH malware families. 

COPPERHEDGE is a remote access trojan (RAT) that allows attackers to run arbitrary commands, perform system reconnaissance, and exfiltrate data. COPPERHEDGE, aka Manuscrypt, has been employed in attacks on cryptocurrency exchanges. USCYBERCOM experts discovered six distinct variants of the malware. 
TAINTEDSCRIBE is an implant that’s could execute the attacker’s commands on a compromised system.
PEBBLEDASH is an implant that has the capability to download, upload, delete, and execute files; the malicious code enables Windows CLI access, creates and terminates processes, and performs target system enumeration. The implant uses FakeTLS for session authentication and RC4 for network encoding. 

The Department of Homeland Security Cybersecurity and Infrastructure Security Agency (DHS CISA) published security advisories for the three malware on its website.

Pierluigi Paganini

(SecurityAffairs – North Korea, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]