SEO-Poisoned KakaoTalk Installer Delivers Winos4.0 to More Than 5,000 PCs
Summary
ASEC reports that fake KakaoTalk download pages distributed an NSIS installer linked to Winos4.0, infecting about 5,000 PCs. The malware establishes persistence, adds Defender exclusions and can run additional payloads received from C2.
Key points
- ASEC reports approximately 5,000 or more PCs were infected; the fake installer was first distributed around March 9.
- SEO-poisoned pages mimicked KakaoTalk’s official download site and led users to a malicious installer.
- The NSIS installer carried an invalid NetEase signature, decrypted and dropped components including Verifier.exe and AutoRecoverDat.dll, and created a legitimate-looking KakaoTalk setup file.
- The installer added Windows Defender exclusion paths and established persistence through DLL registration and scheduled tasks.
- Verifier.exe and AutoRecoverDat.dll load shellcode containing an embedded DLL that executes in memory; ASEC identifies the malware as Winos4.0.
- Winos4.0 can capture screens, control files and processes, collect system information, and download additional malware; received C2 packets can be executed in memory.
- The selected shellcode determines the C2: 192.238.129.47:18852 or 119.28.70.225:443.
Article Details
- Attack Vectors
- SEO poisoning promoted fake KakaoTalk download pages in search results, leading users to a malicious NSIS installer.
- The installer decrypted and dropped Verifier.exe, AutoRecoverDat.dll, and Winos4.0 payload files, then created a legitimate-looking KakaoTalk_Setup.exe and shortcut.
- The malware added Windows Defender exclusion paths, registered a DLL, and created scheduled tasks for persistence.
- Winos4.0 communicated with different C2 servers depending on which payload file was loaded and could execute additional C2-delivered packets in memory.
- Defensive Notes
- Verify the official domain before downloading installation files; a high search-result ranking does not establish that a site is legitimate.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 119[.]28[.]70[.]225 | Winos4.0 C2 server used with GPUCache2.xml over port 443. |
| IPV4 | 192[.]238[.]129[.]47 | Winos4.0 C2 server used with GPUCache.xml over port 18852. |
| MD5 | 0ab84f52d043f7a7af54bd4df0331d64 | MD5 hash of a malicious installer sample distributed as a fake KakaoTalk installer. |
| MD5 | 108849450dd8410bf6217c9a7af82ab3 | MD5 hash of a malicious installer sample distributed as a fake KakaoTalk installer. |
| MD5 | 29152e0473edef5defc6752dabd0c53d | MD5 hash listed for a malicious installer sample. |
| MD5 | 56ad524a33e5bb1ae8fee88d41b33294 | MD5 hash listed for a malicious installer sample. |
| MD5 | 8cad997c53fa31274ef0f542535c83b3 | MD5 hash listed for a malicious installer sample. |
| URL | hxxps[:]//download[.]i96l6[.]top/KakaoTalk_Setup_patched[.]rar | Malicious download URL used to deliver the fake KakaoTalk installer. |
| URL | hxxps[:]//pc-kakaocorp[.]com/ | Fake KakaoTalk download page identified as attacker-created and used to distribute the malicious installer. |
| URL | hxxps[:]//xinjiapox[.]oss-ap-southeast-1[.]aliyuncs[.]com/KakaoTa2258[.]zip | Specific cloud-hosted ZIP URL identified as a redirect destination for downloading the malware. |
MITRE ATT&CK
T1036 · MasqueradingThe fake download page and installer imitated KakaoTalk branding and created a legitimate-looking KakaoTalk_Setup.exe.T1053.005 · Scheduled TaskThe malware created scheduled tasks under MicrosoftWindowsAppID to run Verifier.exe and rundll32 with AutoRecoverDat.dll.T1059.001 · PowerShellThe installer ran a PowerShell command to add Windows Defender exclusion paths.T1071.001 · Web ProtocolsWinos4.0 communicated with C2 servers over ports 443 and 18852 using web-protocol communication.T1105 · Ingress Tool TransferThe fake download flow delivered the installer and payload archives from attacker-used URLs.T1204.002 · Malicious FileUsers were lured by fake KakaoTalk download pages to download and run the malicious installer.T1218.011 · Rundll32The persistence task used rundll32.exe to invoke AutoRecoverDat.dll with DllRegisterServer.T1562.001 · Disable or Modify ToolsThe installer added Windows Defender exclusion paths using Add-MpPreference.T1620 · Reflective Code LoadingProfiler.json is described as a reflective DLL loader that loads an embedded DLL into memory.
Malware
Products
KakaoTalkThreat actors used SEO poisoning to place fake KakaoTalk download pages at the top of search results and distributed a malicious installer that infected over 5,000 PCs.Qihoo 360 Total Securitygiven that the targeted AV products checked by the threat actors are 360 Total Security and ZhuDongFangYu, which are predominantly utilized in China, it is likely that the malware was originally created for distributionWindows Defender(Verifier.exe, AutoRecoverDat.dll, GPUCache.xml/GPUCache2.xml) to establish persistence, add Windows Defender exclusions, and connect to C2 servers running Winos4.0.ZhuDongFangYugiven that the targeted AV products checked by the threat actors are 360 Total Security and ZhuDongFangYu, which are predominantly utilized in China, it is likely that the malware was originally created for distribution