SYMBOLCOMMON_NAMEaka. SYNONYMS
win.wagenttea (Back to overview)

wAgentTea

aka: wAgent

Actor(s): Lazarus Group

wAgentTea is an HTTP(S) downloader.

It was deployed mostly against South Korean targets like a pharmaceutical company (Q4 2020) or semiconductor industry (Q2 2023). In several cases, the initial access was obtained via exploitation of South Korean software like Initech's INISAFE CrossWeb EX or Dream Security’s MagicLine4NX.

It uses AES-128 for encryption and decryption of its network traffic, and for decryption of its binary configuration.

There is a hard-coded list of parameter names used in its HTTP POST request:
identy;tname;blogdata;content;thesis;method;bbs;level;maincode;tab;idx;tb;isbn;entry;doc;
category;articles;portal

It contains a specific RTTI symbol ".?AVCHttp_socket@@".

References
2025-07-28 ⋅ Wiz.io ⋅ Merav Bar
TraderTraitor: Deep Dive
GolangGhost Manuscrypt RN Stealer DRATzarus GolangGhost PostNapTea Volgmer wAgentTea
2025-04-24 ⋅ Kaspersky ⋅ Sojun Ryu, Vasily Berdnikov
Operation SyncHole: Lazarus APT goes back to the well
Bankshot DRATzarus PostNapTea wAgentTea
2023-10-17 ⋅ ⋅ AhnLab ⋅ ASEC Analysis Team
Lazarus Group’s Operation Dream Magic
LazarDoor wAgentTea
2023-10-04 ⋅ Virus Bulletin ⋅ Peter Kálnai
Lazarus Campaigns and Backdoors in 2022-23
SimpleTea POOLRAT 3CX Backdoor BLINDINGCAN CLOUDBURST DRATzarus ForestTiger ImprudentCook LambLoad LightlessCan miniBlindingCan PostNapTea SecondHandTea SnatchCrypto wAgentTea WebbyTea WinInetLoader
2022-04-26 ⋅ AhnLab ⋅ ASEC Analysis Team
New Malware of Lazarus Threat Actor Group Exploiting INITECH Process
Racket Downloader wAgentTea
2020-12-23 ⋅ Kaspersky Labs ⋅ Seongsu Park
Lazarus covets COVID-19-related intelligence
BookCodes RAT wAgentTea

There is no Yara-Signature yet.