CornFlake Propose Change

Actor(s): APT29

CornFlake is a Go-based Windows RAT attributed to Storm-2945, a subcluster of Midnight Blizzard. The implant communicates over TLS-wrapped TCP; inside the tunnel it performs a length-prefixed JSON hello/ack exchange (0xAB/0xAC), derives a per-session AES-256-GCM key from ephemeral P-256 ECDH and a built-in secret, and exchanges opcode-driven JSON/binary messages. Startup traffic includes system-information (0x5A) and persistence (0x9E) reports. An encrypted heartbeat (0xE7) with an empty payload is sent at a randomized 18–41-second interval, while commands and results are handled asynchronously.
Collection and exfiltration use a resumable upload state machine with optional gzip-compressed 64-KiB chunks, acknowledgements carrying resume offsets, and explicit completion messages. Runtime configuration supports server and collection-policy changes, hot reload, and DNS-based fallback. CornFlake maintains a machine identifier across reconnects and supports persistence, security-posture discovery, credential-hint collection, remote shell execution, keylogging, clipboard and USB monitoring, screenshots, audio/webcam capture, selective file collection, and encrypted uploads.

References

There is no Yara-Signature yet.