[September | Malware Analysis Report] Document-Based Malware Disguised as a Value-Added Tax Filing Document (Konni APT Campaign)

The SANDS Lab Threat Analysis Team selects malware each month and prepares a report.

Through expert analysis, we share malware characteristics, threat trends, and related intelligence to help create a safer cyber environment.

More detailed information on malware is available through our cyber threat intelligence service, <CTX>.

The SANDS Lab Threat Analysis Team analyzed a Konni APT campaign targeting the value-added tax filing period, identifying the origin of the threat (the attacking country), the malware used, distribution routes, similar malicious files, and other information. We hope this report helps readers establish effective defenses against similar campaigns in the future.

[Contents]

1. Summary / Background

2. Malware Information

3. Malware Execution Flow

4. Detailed Analysis

5. Similar Malicious Files and Documents

6. Conclusion

7. Indicators of Compromise (IoCs)

1. Summary / Background

Image 1. Document-based malware targeting the value-added tax filing period

Document-based malware distributed to target the value-added tax filing period was recently identified.

The malware is associated with Konni, a type of attack that has been observed consistently since 2014. Value-added tax filing is a particularly sensitive period for institutions and businesses. Attackers exploited this by attaching a file disguised as guidance on amending a tax return and enticing users to execute it. * Value-added tax filing takes place on the 15th of each quarter.

Konni malware uses obfuscated PowerShell scripts and documents with titles designed to entice users to execute them, evading detection, collecting information from victims’ computers, and then installing additional malware. The shortcut (LNK) file analyzed here was designed to execute malware when clicked and uses a sequence of commands to exfiltrate system information or remotely control the system.

2. Malware Information

The SANDS Lab Threat Analysis Team determined that the malware used in this attack was “부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk,” distributed to victims in a ZIP archive of approximately 200KB.

Figure 2. Details of the malicious shortcut file

The malware was created as a shortcut file to execute its embedded scripts through the Windows command-line interface (cmd.exe). Clicking it runs a series of scripts through cmd.exe. Because the shortcut is configured to run minimized, the user does not see the CMD window launch.

Figure 3. Execution options for the malicious shortcut file

To evade security solutions, approximately 99.7% of the file consists of repeated dummy data (0x09 0x00), maximizing the ZIP compression ratio. Because the resulting archive is small, recipients are more likely to consider it legitimate and execute it.

Figure 4. Hex dump of the malicious shortcut file

The legitimate document used in the attack was created in February. Within approximately 1 second of executing the shortcut, the following document opens in the Hangul word processor.

Figure 5. Legitimate document used in the attack

3. Malware Execution Flow

Executing the malicious shortcut drops and executes the original value-added tax document and malicious script files.

Victims are unaware of the infection because it appears that they have opened a legitimate document. A sequence of subsequent steps exfiltrates file listings from the Desktop, Downloads, and Documents folders, along with hardware and software information obtained using the systeminfo command.

Figure 6. Execution flow of the malicious shortcut file

However, syntax errors in the attacker’s scripts and certificate issues indicate that the attack likely did not succeed. The scripts included in the document cannot download di372626.zip or gonHE.cab and operate only as far as collecting information from the infected system.

4. Detailed Analysis

4.1. 부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk

The file contains an obfuscated PowerShell script that extracts 2 files from specific positions in the shortcut file and decrypts them using XOR operations.

Figure 7. Obfuscated PowerShell script

Extracting the PowerShell script from the shortcut reveals logic that extracts files based on Offset and Length, along with key information for XOR decryption. When executed, it drops and opens the original document to appear as though a normal document has been launched. It then drops Byimtb.cab into C:\Users\Public\Documents, extracts it using expand, deletes itself, and executes start.vbs.

Figure 8. Information extraction and decryption logic for dropping files

4.2. Byimtb.cab

Byimtb.cab is an archive containing Batch files created by the attacker for individual malicious functions. This modular design appears intended to increase the likelihood of success at each stage of the attack.

Figure 9. Files archived in Byimtb.cab

The combination of multiple Batch files, start.vbs, and unzip.exe is a key indicator identifying the Konni attack toolkit. This toolkit uses such modular Batch files in APT attacks.

4.3. start.vbs

Written in Visual Basic, the script obtains a COM object that provides access to the Windows shell (new:9BA05972-F6A8-11CF-A442-00A0C90A8F39) and executes 32013754.bat. It passes 0 as the fifth argument to ShellExecute to hide the execution window.

Figure 10. start.vbs script that initiates malicious activity

Figure 11. Malware running as a child process of cmd.exe

4.4. 32013754.bat

This central script controls all malicious activity and maintains persistence by registering start.vbs as a service in the startup programs.

Figure 12. Malware running as a child process of cmd.exe

Figure 13. 32013754.bat script that controls all malicious activity

Figure 14. Service registered in the startup programs

A detailed analysis of the subsequent Batch-file execution (call) logic reveals the following sequence.

① Download a file from a compromised site (71728084.bat)

② Collect system information and exfiltrate it to a malicious domain (60646746.bat)

③ Download an additional file from a malicious domain (23877740.bat)

Communication with external systems is essential at each stage, allowing the attacker to continue carrying out the intended actions.

4.5. 71728084.bat

This script downloads a file named di3726.zip from a compromised site and attempts to extract it using unzip.exe, which was included in Byimtb.cab. If extraction succeeds and 1.bat exists, it executes that file and then deletes the archive.

Figure 15. 71728084.bat script that downloads a file from radionaranjalstereo.com

The radionaranjalstereo.com site is currently closed and inaccessible, preventing acquisition and analysis of di3726.zip. Publicly available information indicates that the domain was used by a broadcasting and media production company in Ecuador (EC).

(Left) Figure 16. Information related to radionaranjalstereo / (Right) Figure 17. Site availability check on isitdownrightnow.com

4.6. 60646746.bat

This script collects lists of files and folders in the victim’s Downloads, Documents, and Desktop folders, along with hardware and software information from the infected PC, and exfiltrates them to the attacker’s web server (sibbss.com).

Figure 18. 60646746.bat script that exfiltrates information

This script also contains key indicators of the Konni toolkit. It writes collected information to files with a txt extension and uploads them to upload.php under file names in the format %COMPUTERNAME%_정보특성.txt. The Konni toolkit uses consistent paths and file names like these in APT attacks.

The web server used in the attack was identified as Apache 2.4.52, a version released in 2021. This suggests that the server was set up 3 years earlier. The server’s IP address was also identified as being in Singapore.

Figure 19. Web server and operating system information for the attacker’s C&C server

Figure 20. Whois results identifying the IP address as being in Singapore

4.7. 23877740.bat

This script encrypts the current time (timestamp) and the victim’s computer name, sends them to the attacker’s web server, and downloads gonHE.cab. It appears that the server uses the victim’s system information sent by 60646746.bat in the preceding stage to return a malicious file suited to the target environment.

It also extracts gonHE.cab and executes temprun.bat. The attacker’s ultimate objective therefore appears likely to be identifiable from temprun.bat.

Figure 21. 23877740.bat script that downloads a malicious file tailored to the victim’s PC

At the time of analysis, however, the attacker’s server was not returning gonHE.cab. The attacker may have suspended the download to avoid revealing the actual intent or objective. As shown below, the HTTP response has no body, so any gonHE.cab file created contains no data and is 0 bytes in size.

Figure 22. The attacker’s server currently does not return gonHE.cab, which contains temprun.bat

4.8. 88079270.bat

This script is the core file-download module and is designed to conceal the attacker’s download activity. It sends a web request to the supplied link, creates a file from the response, and names the file using the second argument. Its behavior is divided into encrypted and plaintext transmission modes according to the third argument.

Figure 23. 88079270.bat script that provides the file-download module

The encrypted transmission mode can be explained using the invocation in 71728084.bat as follows.

Figure 24. Example of invoking the file-download module

The data to the left of the “?” character is the URL to request. The data on the right is the string to encrypt, and the current time value (timestamp) serves as the encryption key. Applying this to the example above produces the web request hxxps[:]//radionaranjalstereo.com/wp-content/themes/ai-news/js/inc/get.php?{timestamp}={encryptedString}. The request is sent and a file is created from the response.

A notable aspect of 88079270.bat is that it uses the “iwr” cmdlet for web requests. This command has been supported since PowerShell 3.0, which is installed by default starting with Windows 8. This indicates that the attacker targeted Windows 8 or later.

Some download functions were found not to work correctly because of script syntax errors and requests using an older TLS version. In particular, radionaranjalstereo.com, used as a C&C server, requires HTTPS (SSL), causing errors when the script sends web requests.

- Missing TLS 1.2 configuration: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;

4.9. 08874295.bat

This script is a module for uploading victim information to the attacker’s server. It encrypts the supplied file and sends it to the specified web path. If the HTTP status code is 200 (OK), it deletes the original input file and creates upok.txt. This 0-byte file signals to 32013754.bat, which controls malicious activity, that exfiltration has completed.

Figure 25. 08874295.bat script that provides the file-upload module

The encrypted data takes the following form, a key indicator identifying the Konni attack group. The group uses this structure and these variable names when communicating with C&C servers.

Figure 26. HTTP POST parameters observed in Konni toolkit exfiltration traffic

Figure 27. Actual HTTP exfiltration traffic

4.10. 46639707.bat

This unused Batch file retrieves the name of the first item (file or folder) in the path specified by the first argument and saves it to a file named by the second argument.

For example, executing 46639707.bat “C:\Users\Public\Documents\test.txt” “a.txt” saves the name of the first file or folder in “C:\Users\Public\Documents” to a file named “a.txt.”

Figure 28. 46639707.bat script, unused by the files available for analysis

4.11. unzip.exe

This is a legitimate archive extraction program that ports the Unix unzip command to a Windows executable as part of the Info-ZIP project. Other APT attacks by the Konni group have used an unzip.exe file with the same MD5 hash.

5. Similar Malicious Files and Documents

Figure 29. Similar malicious ZIP files

Numerous malicious files disguised as financial documents have been identified using similar attack techniques and behavior. Some examples are listed below.

● File name: 미신고 자금출처 소명자료 제출 요청안내.zip

- sha256: ef6bcf1657099879e990641d4c23d7fb670e510f85eb66cba4dcc297645a0202

- https://www.virustotal.com/gui/file/ef6bcf1657099879e990641d4c23d7fb670e510f85eb66cba4dcc297645a0202

● File name: 소명자료 목록(국세징수법 시행규칙).zip

- sha256: 9762d5c00cdc58e774676ab868a5928466664ba5dc1f063e14b11f302b777995

- https://www.virustotal.com/gui/file/9762d5c00cdc58e774676ab868a5928466664ba5dc1f063e14b11f302b777995

6. Conclusion

Figure 30. Konni APT campaign

From an analyst’s perspective, this appears to be an attack targeting financial personnel in public institutions for reconnaissance and establishing initial access. This pattern is found in various APT attacks involving the Konni toolkit and closely resembles campaigns continually carried out by the North Korean APT37 group.

From a malware analysis perspective, these scripts run correctly on Windows 8 or later. This aligns with the replacement of Windows 7 PCs in the public sector with newer versions beginning in 2020. North Korean groups such as APT37 continue using diverse techniques to evade detection and collect information. This attack illustrates carefully prepared, persistent attack activity, and organizations should remain alert to such threats.

One notable point, however, is that the attacker’s malware development process appears to have been imperfect. sibbss.com (176.97.64.174), used for at least 3 years, communicates over HTTP, allowing the attack stages to proceed without errors. In contrast, radionaranjalstereo.com (213.158.94.166), identified in this attack, uses HTTPS (SSL), resulting in certificate errors and failed downloads. This suggests that radionaranjalstereo.com was not sufficiently reviewed as a C&C server during attack planning.

7. Indicators of Compromise (IoCs)

7.1. Malware SHA256 Hashes

- 부가가치세 수정신고 안내(부가가치세사무처리규정).zip / e7a9da4f70299216d368b366a4544ff3b48fad057b3ec7758b6bc9c714ed0683

- 부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk / 6d901221cb5162c190cce720726889ccb1f8435f5d71fb05614672497425e931

- C:\Users\Public\Documents\start.vbs / 670892dc616431a25b6dfcf4d0223bd0b8f974fc533b421aa569a9c175a27625

- C:\Users\Public\Documents\08874295.bat / 8f164ca160b458af126d70f356ad47b6b07be2395dd6b55c8f4e8abddde0eb02

- C:\Users\Public\Documents\23877740.bat / df26abadb207e3e264f1910c5119ce3388f75244a511e86710cfd48584d95696

- C:\Users\Public\Documents\32013754.bat / f212e1414092d09ac103be3f2c48cb253db0b1862b1e20a0f787654dac7b9965

- C:\Users\Public\Documents\46639707.bat / c0b1ee982cc6a2b805ec3a2fa8a59fd8d73da4474f810abc5e1e7a639d777bfa

- C:\Users\Public\Documents\60646746.bat / d81713d1d8d462db8b6468b0a813e8a483c6c3cc5a58f005e0cc08d7786d3b8b

- C:\Users\Public\Documents\71728084.bat / 69f1458e75a5781335f2fb0d751a083791e9f7c3bf19fb7a6abfd04f80fda730

- C:\Users\Public\Documents\88079270.bat / 87e700c2707d58a18fbb9f0085b781794a5d4e302ab973cc20efde4f32f8d53f

- C:\Users\Public\Documents\unzip.exe / 8d9b5190aace52a1db1ac73a65ee9999c329157c8e88f61a772433323d6b7a4a

7.2. System Commands

- reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v startsvc1 /t REG_SZ /d "%~dp0start.vbs" /f > nul

7.3. Malicious Domains and Paths

- hxxps://radionaranjalstereo.com/wp-content/themes/ai-news/js/inc/get.php?ra=iew&zw=lk0100

- hxxp://sibbss.com/list.php

- hxxp://sibbss.com/post.php

7.4. Associated IP Addresses

- 176.97.64.174

- 213.158.94.166

Cyber threats can arise anytime, anywhere.

SANDS Lab continually shares reports on threat relationships and IoCs obtained through analysis of the latest malware, helping prevent cyber threats and build a safer digital society.