Infostealer malware linked to Lazarus Group campaigns

TL;DR

These days I’ve been analyzing a highly malicious Python script containing heavily encoded Base64 strings and compressed using ZLIB. The script was cloned from a malicious Git repository, but its delivery method piqued my curiosity.

The Analysis

The code was designed to execute multiple repetition processes, where each obfuscation stage pointed to the previous one until the loop was completed, ultimately decrypting and revealing the actual malware code.

_ = lambda __: __import__('zlib').decompress(__import__('base64').b64decode(__[::-1])); exec((_))

• The code uses a lambda function (_):
• It reverses the provided string ([::-1]).
• Decodes the string using Base64 (base64.b64decode).
• Decompresses the result with zlib (zlib.decompress).
• The final output of the lambda function is passed to exec(), which executes the reconstructed Python code.

Obfuscated scripts commonly use methods such as:

• Base64 encoding
• Compression (zlib, gzip)
• String decoding

The action plan was to identify the final code with readable text by decoding and decompressing it. This is a multi-stage modular malware that attempts to adapt to different platforms such as Windows, macOS, and Linux.

Files analyzed

The following structure was observed, with which the main script communicated. It consisted of 2 folders and 5 files and install a malware called Tsunami.

Main file:

• script.py — This was identified as the main file, containing several instructions to call other script functions.

Folder “sysinfo”:

• .sysinfo — in sysinfo, it was possible to identify communication with the C2 server on port 1224, as well as multiple conditions for detecting the victim’s operating system, allowing the payload to be downloaded in the correct OS version.

Folder “n2”:

• n2/bow — the main script defines this word as “brow” and contains the instructions for the malware to perform the process of reading registry keys, which commonly contain information about the existence of Python on the device and, if present, the current version being used.
• n2/flist — the flist shows that its sole purpose is to temporarily store the collected information before sending it to the malicious server. The data is sent in the format http[:]//<C2_server>:1224/uploads to the targeted malicious server.
• n2/mlip — The file named mlip contains the instructions for installing libraries required for the proper functioning of pay. It includes information about an API address where all logs from Clipboard actions and keystrokes of the infected device are sent.
• n2/pay — The last file in the n2 folder is called pay, and it is responsible for collecting general information about the infected device:
  • System Information: UUID, operating system type, system version, device name, names of active user profiles.
  • Geolocation Information: IP address, ISP, country and city, timezone (regional time).

The backdoor is present in this file (pay), where an SSH connection can be opened, sending activity commands (kill, upload, start) and listening commands (listen, keep alive).

A connection will open to try to connect to the remote server and send data. After completing this step, the logs related to the connection are destroyed so as not to leave any traces on the network.

Other similar attack patterns

I decided to look for similar scenarios in information security reports and came across several malware campaigns being operated by Advanced Persistent Threat (APT) groups.

ClickFix

In July 2024, McAfee discovered a highly unusual method being used for malware delivery. This method was called “ClickFix.” It is a social engineering tactic where users are prompted to “Click” the indicated button and “Fix” the displayed error on a website or document.

The attack begins with users being lured into visiting seemingly legitimate but compromised websites.

The “ClickFix” infection is a highly sophisticated social engineering attack, leveraging an authentic appearance to manipulate users into executing malicious scripts.

The HTML file disguises itself as a Word document, displaying an error prompt to deceive users. This tactic is used to trick users into taking actions that may lead to the download and execution of malicious software.

The button’s code contained a script with instructions encoded in Base64:

What’s he hiding?

Here, we have a command being executed in PowerShell to launch the file “1.hta.” Before closing the session, the script runs the command Set-Clipboard -Value ' ' to clear the clipboard content. Out of sight, out of mind. Right?

Well, I won’t go into details here about what happens next in this attack, but I want you to pay attention to the similarity in the encoded code.

Many other campaigns started being observed more and more frequently using the same tactic. This one is bolder and even mocks you, as it makes the system’s own user execute the operation.

What’s he hiding?

It runs PowerShell, clears the DNS cache, and makes a web request to a remote URL stealthily, avoiding any alerts to the current user.

After executing this command to download the malware, a temporary folder is created with a randomly generated name containing a compressed file. The malware is then extracted and placed in the same folder, after which it is installed and begins communicating with the malicious server.

Contagious Interview

Lazarus APT, a North Korean group, is using the ClickFix social engineering technique.

Advanced Persistent Threat (APT) groups have been using encoding techniques for many years. In recent months, they have also been observed leveraging the same ClickFix social engineering tactic, but this time focusing on deceiving developers.

After all, if APT groups are interested in carrying out industrial and governmental espionage, why not target developers? They have access to project source code, connect to more permissive devices on the network, and, if lucky, store multiple saved passwords for critical applications that grant access to even more confidential information. Plenty of valuable cookies and documentation.

How does the attack work?

Fake recruiter profiles approach developers, inviting them to participate in an online interview.

How do you lure a developer? Join Discord or LinkedIn, represent a well-known company, make an offer, provide coffee, a good salary, and remote work. Bingo!

Here’s an example of a job description followed by a very well-crafted questionnaire. The last question requires a response via a video recording. Nothing unusual, right?

When clicking to grant camera access, a fake message appears, saying that permission couldn’t be granted, so the candidate has to do it manually. Here comes ClickFix! The instructions are given: just copy the code into the terminal, and that’s it! You now have a double dose of malware installed on the device.

As I researched, it became evident how many campaigns were using job interview preparations as a lure.

The victim is tricked into meeting some basic requirements, one of which is installing a malicious NPM package directly from the fake profile. Remember ClickFix? The victim always needs to download/execute something requested.

NPM makes it easier for cybercriminals to find ways to inject malicious code into legitimate NPM packages and distribute them via GitHub. The cloned NPM package contains an infostealer malware and a backdoor.

At a later stage, the data collected from victims was used to create fake identities and prepare study guides for interviews in another campaign called Wagemole.

Campaign comparison

Contagious Interview

• Attribution: Lazarus (Famous Chollima)
• Malware: BeaverTail (javascript) > loader; InvisibleFerret (python) > backdoor, infostealer
• Source: LinkedIn and GitHub
• Files: payload, brow, adc
• C2: http://<ip-server>:1224

Wagemole

• Attribution: Lazarus (APT38)
• Malware: BeaverTail (javascript) > loader; InvisibleFerret (python) > backdoor, infostealer
• Source: Upwork and Indeed
• C2: 91.92.120[.]132:80

Operation Dream Job

• Attribution: Lazarus
• Source: Indeed and LinkedIn
• Malware: Torisma > downloader, RAT

Nowadays

Operation99

• Attribution: Lazarus (APT43/Kimsuky)
• Malware: Tsunami > backdoor, RAT, infostealer
• Source: GitHub and LinkedIn
• Files: main, pay, brow, mclip
• C2: http://<ip-server>:1224

Woa! This campaign looks very similar to the code structure I was analyzing. The perfect match.

Conclusion

It is noticeable that all the campaigns mentioned here follow the same attack pattern using social engineering, where the evolution of the modus operandi can be observed, ultimately targeting software developers.

• Objective: Data theft, financial gain, espionage.
• Greater objective: Funding North Korean nuclear projects.
• Functions: fingerprinting, remote control, keylogging, browser stealing capabilities, data exfiltration.

MITRE ATT&CK TTPs

• T1027 — Obfuscated Files or Information
• T1027.002 — Obfuscated Files or Information: Software Packing
• T1204.002 — User Execution: Malicious File
• T1564.001 — Hide Artifacts: Hidden Files and Directories
• T1082 — System Information Discovery
• T1016 — System Network Configuration Discovery
• T1033 — System Owner/User Discovery
• T1555 — Credentials from Password Stores
• T1555.003 — Credentials from Web Browsers
• T1056.001 — Input Capture: Keylogging
• T1546.008 — Event Triggered Execution: Accessibility Features
• T1041 — Exfiltration Over C2 Channel

IoC

• IP: 5[.]253[.]43[.]122:1224
• IP: 41[.]208[.]185[.]235
• IP: 95[.]164[.]7[.]171:8637

Sources

1. ClickFix Deception: A Social Engineering Tactic to Deploy Malware
2. Inoculating Contagious Interview with Validin
3. Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape