Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Inside TDrop2: Technical Analysis of new Dark Seoul Malware

Summary: Unit 42 identified a new campaign targeting the European transportation sector, tied to the 2013 Dark Seoul and Operation Troy campaigns, that embedded updated TDrop2 malware inside a legitimate video software package hosted on a software distributor's website. The malware checks for explorer.exe or cmd.exe as its parent process, uses process hollowing against randomly selected system32 executables, kills the AhnLab V3lite.exe process, and polls command-and-control servers every 30 minutes with encrypted, base64-encoded traffic disguised as .gif images.

Why it matters: The malware was delivered through a trusted distributor's own website to organizations relying on its security camera solution, and it re-sets its registry persistence keys every 60 seconds so manual deletion by an administrator does not remove it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related