SYMBOLCOMMON_NAMEaka. SYNONYMS
win.navrat (Back to overview)

NavRAT

aka: JinhoSpy

Actor(s): Kimsuky


There is no description at this point.

References
2021-05-07TEAMT5Jhih-Lin Kuo, Zih-Cing Liao
@techreport{kuo:20210507:we:cd620c1, author = {Jhih-Lin Kuo and Zih-Cing Liao}, title = {{"We Are About to Land": How CloudDragon Turns a Nightmare Into Reality}}, date = {2021-05-07}, institution = {TEAMT5}, url = {https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf}, language = {English}, urldate = {2021-09-14} } "We Are About to Land": How CloudDragon Turns a Nightmare Into Reality
FlowerPower Appleseed BabyShark GoldDragon NavRAT
2020-02-19LexfoLexfo
@techreport{lexfo:20200219:lazarus:f293c37, author = {Lexfo}, title = {{The Lazarus Constellation A study on North Korean malware}}, date = {2020-02-19}, institution = {Lexfo}, url = {https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf}, language = {English}, urldate = {2020-03-11} } The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor
2019-02-25One Night in NorfolkKevin Perlow
@online{perlow:20190225:how:d4a68d6, author = {Kevin Perlow}, title = {{How To: Analyzing a Malicious Hangul Word Processor Document from a DPRK Threat Actor Group}}, date = {2019-02-25}, organization = {One Night in Norfolk}, url = {https://norfolkinfosec.com/how-to-analyzing-a-malicious-hangul-word-processor-document-from-a-dprk-threat-actor-group/}, language = {English}, urldate = {2020-05-19} } How To: Analyzing a Malicious Hangul Word Processor Document from a DPRK Threat Actor Group
NavRAT
2018-05-31Cisco TalosWarren Mercer, Paul Rascagnères, Jungsoo An
@online{mercer:20180531:navrat:bf68765, author = {Warren Mercer and Paul Rascagnères and Jungsoo An}, title = {{NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea}}, date = {2018-05-31}, organization = {Cisco Talos}, url = {https://blog.talosintelligence.com/2018/05/navrat.html?m=1}, language = {English}, urldate = {2020-01-08} } NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea
NavRAT
Yara Rules
[TLP:WHITE] win_navrat_auto (20230407 | Detects win.navrat.)
rule win_navrat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.navrat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.navrat"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b7608 83461c02 5f 5e }
            // n = 4, score = 300
            //   8b7608               | mov                 esi, dword ptr [esi + 8]
            //   83461c02             | add                 dword ptr [esi + 0x1c], 2
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_1 = { 50 57 a3???????? ff15???????? 57 ff15???????? }
            // n = 6, score = 300
            //   50                   | push                eax
            //   57                   | push                edi
            //   a3????????           |                     
            //   ff15????????         |                     
            //   57                   | push                edi
            //   ff15????????         |                     

        $sequence_2 = { c647033d 85f6 7407 8b7608 83461c02 5f 5e }
            // n = 7, score = 300
            //   c647033d             | mov                 byte ptr [edi + 3], 0x3d
            //   85f6                 | test                esi, esi
            //   7407                 | je                  9
            //   8b7608               | mov                 esi, dword ptr [esi + 8]
            //   83461c02             | add                 dword ptr [esi + 0x1c], 2
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_3 = { 8bf0 f7de 1bf6 f7de 56 68???????? }
            // n = 6, score = 300
            //   8bf0                 | mov                 esi, eax
            //   f7de                 | neg                 esi
            //   1bf6                 | sbb                 esi, esi
            //   f7de                 | neg                 esi
            //   56                   | push                esi
            //   68????????           |                     

        $sequence_4 = { 0fbec0 83e847 c3 8d48d0 80f909 7707 0fbec0 }
            // n = 7, score = 300
            //   0fbec0               | movsx               eax, al
            //   83e847               | sub                 eax, 0x47
            //   c3                   | ret                 
            //   8d48d0               | lea                 ecx, [eax - 0x30]
            //   80f909               | cmp                 cl, 9
            //   7707                 | ja                  9
            //   0fbec0               | movsx               eax, al

        $sequence_5 = { 7503 884702 85f6 7407 8b7608 }
            // n = 5, score = 300
            //   7503                 | jne                 5
            //   884702               | mov                 byte ptr [edi + 2], al
            //   85f6                 | test                esi, esi
            //   7407                 | je                  9
            //   8b7608               | mov                 esi, dword ptr [esi + 8]

        $sequence_6 = { 50 8d85f0feffff 8bf1 50 }
            // n = 4, score = 300
            //   50                   | push                eax
            //   8d85f0feffff         | lea                 eax, [ebp - 0x110]
            //   8bf1                 | mov                 esi, ecx
            //   50                   | push                eax

        $sequence_7 = { 7503 884702 85f6 7407 8b7608 83461804 }
            // n = 6, score = 300
            //   7503                 | jne                 5
            //   884702               | mov                 byte ptr [edi + 2], al
            //   85f6                 | test                esi, esi
            //   7407                 | je                  9
            //   8b7608               | mov                 esi, dword ptr [esi + 8]
            //   83461804             | add                 dword ptr [esi + 0x18], 4

        $sequence_8 = { c745d0536f6674 c745d477617265 c745d85c4d6963 c745dc726f736f c745e066745c57 c745e4696e646f }
            // n = 6, score = 300
            //   c745d0536f6674       | mov                 dword ptr [ebp - 0x30], 0x74666f53
            //   c745d477617265       | mov                 dword ptr [ebp - 0x2c], 0x65726177
            //   c745d85c4d6963       | mov                 dword ptr [ebp - 0x28], 0x63694d5c
            //   c745dc726f736f       | mov                 dword ptr [ebp - 0x24], 0x6f736f72
            //   c745e066745c57       | mov                 dword ptr [ebp - 0x20], 0x575c7466
            //   c745e4696e646f       | mov                 dword ptr [ebp - 0x1c], 0x6f646e69

        $sequence_9 = { 0fbec0 83e847 c3 8d48d0 }
            // n = 4, score = 300
            //   0fbec0               | movsx               eax, al
            //   83e847               | sub                 eax, 0x47
            //   c3                   | ret                 
            //   8d48d0               | lea                 ecx, [eax - 0x30]

    condition:
        7 of them and filesize < 352256
}
Download all Yara Rules