Researchers Identify SparkRAT Infrastructure and macOS Activity in Suspected DPRK Campaign

Jan 28, 2025 · Original article ↗

Summary

Researchers found three additional servers linked to suspected SparkRAT activity, including macOS implants delivered through exposed directories. They describe C2 detection fingerprints, persistence behavior, infrastructure, and related indicators.

Key points

SparkRAT communicates with its C2 over WebSocket and checks for updates through an HTTP POST; its default C2 port is 8000.
Potential server fingerprints include a Basic Authentication challenge with sparse response headers and a JSON error response to a POST at /api/client/update.
Researchers identified three additional servers associated with suspected DPRK-linked activity, including two with exposed directories containing SparkRAT implants.
Two macOS shell scripts downloaded and executed a SparkRAT client; one analyzed binary created a launch plist for execution every 10 minutes.
The analyzed macOS samples attempted TCP connections to the same C2 server on port 8000.
A Vietnamese-language gaming site hosted an Android APK that connected to a WebSocket endpoint; researchers noted Cloudflare headers that could obscure the hosting IP.
The article provides related IP addresses, domains, filenames, and SHA-256 hashes as indicators of compromise.

Article Details

Attack Vectors: SparkRAT is delivered through exposed directories containing client.bin and shell scripts that download and execute the implant.
The scripts use curl to download client.bin from http://updatetiker[.]site/dev/client.bin, save it as /Users/shared/pull.bin, set permissions with chmod 777, and execute it in the background.
A suspicious Android APK hosted on a webpage mimicking a Vietnamese online gaming platform connects to http://one68[.]top/client and upgrades to a WebSocket connection.
SparkRAT communicates with its C2 server using WebSocket and subsequently makes an HTTP POST request to check for updates.
Defensive Notes: Look for suspected SparkRAT panels on port 8000 returning HTTP 401 with a Basic authentication challenge while omitting Server, Content-Type, and Connection headers.
A POST request to /api/client/update can return HTTP 400 with the JSON body {"code":-1,"msg":"${i18n|COMMON.INVALID_PARAMETER}"}; the article describes this alongside the header pattern as a detection starting point.
Monitor for SparkRAT client.bin downloads, the /Users/shared/pull.bin file path, and the com.second.startup.plist persistence artifact in /Users/run.
Monitor the reported C2 and delivery infrastructure, including the listed IP addresses, domains, and file hashes.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`ggnmcomas[.]site`	Domain associated with the reported SparkRAT campaign infrastructure.
DOMAIN	`gmcomamz[.]site`	Domain hosting an exposed directory containing a SparkRAT client.
DOMAIN	`gmnormails[.]site`	Domain associated with the reported SparkRAT campaign infrastructure.
DOMAIN	`gmoocsoom[.]site`	Domain associated with the reported SparkRAT campaign infrastructure.
DOMAIN	`gmoonsom[.]site`	Domain associated with the reported SparkRAT campaign infrastructure.
DOMAIN	`gmoosomnoem[.]site`	Domain associated with the reported SparkRAT campaign infrastructure.
DOMAIN	`gnmoommle[.]space`	Domain resolving from infrastructure the article says remains part of the threat actors' infrastructure.
DOMAIN	`gomncomow[.]site`	Domain resolving from infrastructure the article says remains part of the threat actors' infrastructure.
DOMAIN	`gooczmmnc[.]site`	Domain resolving from infrastructure the article says remains part of the threat actors' infrastructure.
DOMAIN	`gsoonmann[.]site`	Domain associated with the reported SparkRAT campaign infrastructure.
DOMAIN	`henho247[.]net`	Additional domain hosted on the reported SparkRAT C2 server.
DOMAIN	`mncomgom[.]site`	Domain associated with the reported SparkRAT campaign infrastructure.
DOMAIN	`namerowem[.]site`	Domain associated with the reported SparkRAT campaign infrastructure.
DOMAIN	`nasanecesoi[.]site`	Domain associated with the reported SparkRAT campaign infrastructure.
DOMAIN	`one68[.]top`	Domain serving a suspicious APK associated with a webpage mimicking a Vietnamese online gaming platform.
DOMAIN	`remote[.]henh247[.]net`	Domain listed as associated with the reported campaign infrastructure.
DOMAIN	`remote[.]henho247[.]net`	Additional domain hosted on the reported SparkRAT C2 server.
DOMAIN	`updatetiker[.]net`	Domain listed as associated with the reported campaign infrastructure.
IPV4	`118[.]194[.]249[.]38`	Reported as part of the campaign infrastructure and resolving to associated domains.
IPV4	`15[.]235[.]130[.]160`	Active SparkRAT C2 server on port 8000 and host of an exposed directory containing implant files.
IPV4	`152[.]32[.]138[.]108`	Host serving SparkRAT implants and associated with the reported campaign.
IPV4	`51[.]79[.]218[.]159`	SparkRAT sample attempted TCP connections to this host on port 8000.
SHA256	`52277d43d2f5e8fa8c856e1c098a1ff260a956f0598e16c8fb1b38e3a9374d15`	Hash of a SparkRAT client.bin implant found on an exposed directory.
SHA256	`cd313c9b706c2ba9f50d338305c456ad3392572efe387a83093b09d2cb6f1b56`	Hash of the SparkRAT client.bin implant found on an exposed directory.
SHA256	`ffe4cfde23a1ef557f7dc56f53b3713d8faa9e47ae6562b61ffa1887e5d2d56e`	Hash of the suspicious Android APK downloadable from one68[.]top.
URL	`hxxp[:]//updatetiker[.]site/dev/client[.]bin`	Payload-download URL used by the scripts to retrieve SparkRAT.
URL	`hxxps[:]//gmcomamz[.]site`	URL of the exposed directory hosting a SparkRAT client.