Re:The Darkhotel APT
by tkmcc on Monday November 10, 2014 @03:39PM
(#8586213)
Interesting bits from the Technical Appendix:
- If the Information Stealer detects that the current system default codepage is 0412 (Korean) it terminates.
- Also regarding the Information Stealer: "If the server reply contains a keyword «minmei» it continues sending additional information. «Minmei» may be a reference to a popular Japanese anime and manga known as «The Super Dimension Fortress Macross»."
- The Enhanced Keylogger's debug info path was left compiled into the binary: "d:\KerKey\KerKey(일반)\KerKey\release\KerKey.pdb" (note 일반 means "General" in Korean).
I'm unsure whether this is intentional misdirection or simply due to bad OPSEC, but this kind of stuff sticks out because it indicates a fairly large-scale and international APT campaign may be coming out of somewhere in Asia besides China.
- If the Information Stealer detects that the current system default codepage is 0412 (Korean) it terminates.
- Also regarding the Information Stealer: "If the server reply contains a keyword «minmei» it continues sending additional information. «Minmei» may be a reference to a popular Japanese anime and manga known as «The Super Dimension Fortress Macross»."
- The Enhanced Keylogger's debug info path was left compiled into the binary: "d:\KerKey\KerKey(일반)\KerKey\release\KerKey.pdb" (note 일반 means "General" in Korean).
I'm unsure whether this is intentional misdirection or simply due to bad OPSEC, but this kind of stuff sticks out because it indicates a fairly large-scale and international APT campaign may be coming out of somewhere in Asia besides China.