Kimsuky LNK Campaign Adds Multi-Stage Scripts to Deliver Python Backdoor
Summary
ASEC reports that a Kimsuky-attributed LNK campaign adds XML, VBS, PowerShell and BAT stages, uses scheduled tasks and Dropbox, and delivers Python malware with a custom C2 protocol supporting remote commands and file operations.
Key points
- Recent LNK files start a chain of PowerShell, XML, VBS, PS1 and BAT stages before scheduled tasks launch Python malware.
- The BAT stage combines downloaded ZIP fragments containing a Python interpreter, scripts and XML Task Scheduler files.
- The Python backdoor uses a fixed-size 4096-byte protocol with magic bytes and supports shell commands, file transfers, deletion and execution of files.
- ASEC observed commands on an infected system including drive-capacity checks, ipconfig, tasklist and directory listing.
- The campaign uses Dropbox to transmit collected host information and retrieve additional scripts; ASEC also identified a separate downloader that runs without a console window and removes its temporary files.
- ASEC linked the activity to Kimsuky based on similarities in scheduled-task names, XML filenames and decoy files from earlier activity.
Article Details
- Attack Vectors
- Malicious LNK files disguised as document files launch PowerShell and a multi-stage XML, VBS, PS1, and BAT chain that downloads and executes Python payloads.
- BAT scripts retrieve ZIP fragments from attacker-controlled URLs, merge and extract them, then use XML Task Scheduler files to execute payloads.
- A Python backdoor communicates with a C2 server using a custom fixed-size protocol and supports remote shell commands, file transfer, deletion, and execution.
- The actor uses Dropbox to exfiltrate collected system information and retrieve additional scripts.
- Defensive Notes
- Users should be cautious about executing LNK files from unknown sources, even when they appear to be document files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | qugesr[.]online | Attacker-used domain hosting BAT, ZIP-fragment, and other payload-download resources. |
| DOMAIN | racswera[.]online | Listed by the report as a domain hosting payloads or fragments in the campaign. |
| DOMAIN | whaincloud[.]store | Attacker-used domain hosting payload and fragment URLs listed in the report. |
| DOMAIN | zoommet[.]site | Listed by the report as a domain hosting payloads or fragments in the campaign. |
| IPV4 | 45[.]95[.]186[.]232 | C2 server contacted by the Python backdoor on port 8080. |
| MD5 | 059bb6c439ffedc61d9168c23552202c | MD5 hash listed in the report among malware sample indicators. |
| MD5 | 0633d5f93a5f08a909c039a3f7e90830 | MD5 hash listed in the report among malware sample indicators. |
| MD5 | 063faa06c63e4091ff8df4acffeb10be | MD5 hash listed in the report among malware sample indicators. |
| MD5 | 130ce31e1fe7c0aa5fae32d96afff4c6 | MD5 hash listed in the report among malware sample indicators. |
| MD5 | 2052261efb1e9d486997fc1795d7d489 | MD5 hash listed in the report among malware sample indicators. |
| URL | hxxp[:]//whaincloud[.]store/kk/cc/p-index[.]php?au=b | Listed as an attacker-used payload or fragment URL. |
| URL | hxxp[:]//whaincloud[.]store/kk/cc/p-index[.]php?au=v | Listed as an attacker-used payload or fragment URL. |
| URL | hxxp[:]//whaincloud[.]store/kk/view/view[.]php?in=comm | Listed as an attacker-used payload or fragment URL. |
| URL | hxxp[:]//zoommet[.]site/man/logo[.]php?au=beauty | Listed as an attacker-used payload or fragment URL. |
| URL | hxxps[:]//qugesr[.]online/cuckoo_cc/p-index[.]php?au=baatt | Listed as an attacker-used payload or fragment URL. |
| URL | hxxps[:]//qugesr[.]online/dwparts_view/view.php?in=comm.part000 | Attacker-used URL serving a ZIP fragment for payload delivery. |
| URL | hxxps[:]//qugesr[.]online/dwparts_view/view.php?in=comm.part001 | Attacker-used URL serving a ZIP fragment for payload delivery. |
| URL | hxxps[:]//qugesr[.]online/dwparts_view/view.php?in=normal | Attacker-used URL serving a decoy file in the distribution chain. |
| URL | hxxps[:]//qugesr[.]online/m/bDw | Attacker-controlled URL used to download a malicious BAT file. |
| URL | hxxps[:]//quickcon[.]store/man/logo.php?au=beauty.part000 | Attacker-used URL serving a ZIP fragment containing the backdoor distribution. |
| URL | hxxps[:]//quickcon[.]store/man/logo.php?au=beauty.part001 | Attacker-used URL serving a ZIP fragment containing the backdoor distribution. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelCollected host information is uploaded through the C2 channel in files named with an _info.ini format.T1053.005 · Scheduled TaskXML files register scheduled tasks that repeatedly execute VBS, PowerShell, or Python payloads.T1059.001 · PowerShellPowerShell scripts launched by LNK files create folders and files and start subsequent stages.T1059.003 · Windows Command ShellBAT files download and combine ZIP fragments and are executed through cmd.exe.T1059.005 · Visual BasicVBS scripts run through wscript.exe to invoke subsequent components.T1059.006 · PythonPython scripts are used as downloader and backdoor payloads, including beauty.py.T1070.004 · File DeletionThe downloader deletes its temporary VBS and BAT files after a 180-second wait to remove traces.T1071 · Application Layer ProtocolThe Python backdoor exchanges commands and data with its C2 server using a custom fixed-size application-layer protocol.T1102 · Web ServiceDropbox is used as a C2 channel to upload collected information and retrieve additional scripts.T1105 · Ingress Tool TransferScripts download ZIP fragments, interpreters, decoys, and additional payloads from attacker-used URLs.T1204.002 · Malicious FileLNK files disguised as documents are used to prompt users to launch the malicious execution chain.T1564.001 · Hidden Files and DirectoriesThe LNK-created folder is given hidden and system file attributes to conceal it during normal browsing.