UBoatRAT Navigates East Asia
Unit 42 discovers UBoatRAT, a new custom RAT targeting South Korean and video-game industry personnel, delivered via Google Drive with GitHub-based C2 and BITS persistence.
Unit 42 identified UBoatRAT, a new custom remote access trojan first found in May 2017, whose initial version used a public Hong Kong blog service and a compromised Japanese web server for command and control. The latest variants target personnel or organizations related to South Korea or the video games industry, are delivered through Google Drive, and masquerade as Microsoft Word, Excel, or folder icons. The RAT checks for virtualization software and domain join, retrieves its C2 address from a Base64-encoded string in a GitHub-hosted file, uses a custom XOR-encrypted C2 protocol, and maintains persistence via Windows Background Intelligent Transfer Service (BITS) jobs that survive reboots.
- C2 address and port hidden Base64-encoded in a GitHub-hosted README file.
- Uses Windows BITS jobs with /SetNotifyCmdLine for reboot-surviving persistence.
- Masquerades as Word or Excel documents and folders; quits on virtual machines or non-domain systems.
- Custom XOR-encrypted C2 protocol uses static key 0x88 and a '488' marker.
- UAC bypass uses Eventvwr.exe and registry hijacking for process execution.
- ATT&CK
- T1102.001 Dead Drop ResolverT1197 BITS JobsT1036 MasqueradingT1548.002 Bypass User Account ControlT1497.001 System Checks
- Vendors
- Palo Alto Networks
- Malware
- UBoatRAT
- Organizations
- Palo Alto Networks
- Countries
- South KoreaJapanHong Kong
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | blogspot.hk | DME.md http://www.ak(masked)[.]jp/images/ http://elsakrblog.blogspot[.]hk/2017/03/test.html C2 115.68.49[.]179:80 115.68.49[.]179:4 |
| ipv4 | 115.68.49.179 | rld War II. In the case below, the string can be decoded to 115.68.49[.]179:80. [Rudeltaktik]MTE1LjY4LjQ5LjE3OTo4MA==! UBoatRAT uses |
| ipv4 | 115.68.49.180 | 115.68.49[.]179:443 60.248.190[.]36:443 115.68.52[.]66:443 115.68.49[.]180:443 122.147.187[.]173:443 124.150.140[.]131:443 File C:\p |
| ipv4 | 115.68.52.66 | 115.68.49[.]179:80 115.68.49[.]179:443 60.248.190[.]36:443 115.68.52[.]66:443 115.68.49[.]180:443 122.147.187[.]173:443 124.150.140 |
| ipv4 | 122.147.187.173 | 60.248.190[.]36:443 115.68.52[.]66:443 115.68.49[.]180:443 122.147.187[.]173:443 124.150.140[.]131:443 File C:\programdata\init.bat C: |
| ipv4 | 124.150.140.131 | 15.68.52[.]66:443 115.68.49[.]180:443 122.147.187[.]173:443 124.150.140[.]131:443 File C:\programdata\init.bat C:\programdata\svchost.e |
| ipv4 | 60.248.190.36 | 2017/03/test.html C2 115.68.49[.]179:80 115.68.49[.]179:443 60.248.190[.]36:443 115.68.52[.]66:443 115.68.49[.]180:443 122.147.187[.] |
| sha256 | 04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b | 401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1 04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b 42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b |
| sha256 | 42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac | dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b 42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac 7be6eaa3f9eb288de5606d02bc79e6c8e7fc63935894cd793bc1fab08c7 |
| sha256 | 452b1675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d496875 | 56bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e 452b1675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d496875 66c2baa370125448ddf3053d59085b3d6ab78659efee9f152b310e61d2e |
| sha256 | 460328fe57110fc01837d80c0519fb99ea4a35ea5b890785d1e88c91bea9ade5 | aa3f9eb288de5606d02bc79e6c8e7fc63935894cd793bc1fab08c7f86c7 460328fe57110fc01837d80c0519fb99ea4a35ea5b890785d1e88c91bea9ade5 55dd22448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81 |
| sha256 | 55dd22448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81aa6e7 | 8fe57110fc01837d80c0519fb99ea4a35ea5b890785d1e88c91bea9ade5 55dd22448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81aa6e7 9db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b |
| sha256 | 66c2baa370125448ddf3053d59085b3d6ab78659efee9f152b310e61d2e7edb5 | 675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d496875 66c2baa370125448ddf3053d59085b3d6ab78659efee9f152b310e61d2e7edb5 Downloader SHA256 f4c659238ffab95e87894d2c556f887774dce2431 |
| sha256 | 6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c | e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271 6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4 |
| sha256 | 7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1 | f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7 7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1 04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e2 |
| sha256 | 7be6eaa3f9eb288de5606d02bc79e6c8e7fc63935894cd793bc1fab08c7f86c7 | 84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac 7be6eaa3f9eb288de5606d02bc79e6c8e7fc63935894cd793bc1fab08c7f86c7 460328fe57110fc01837d80c0519fb99ea4a35ea5b890785d1e88c91bea |
| sha256 | 9db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 | 2448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81aa6e7 9db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595 |
| sha256 | bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271 | n this report using the UBoatRAT Indicators UBoatRAT SHA256 bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271 6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a8 |
| sha256 | cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7 | 9e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7 7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd |
| sha256 | e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 | 7138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff478 |
| sha256 | eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e | 66e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e 452b1675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d4 |
| sha256 | f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3 | d59085b3d6ab78659efee9f152b310e61d2e7edb5 Downloader SHA256 f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3 Web Access https://raw.githubusercontent[.]com/r1ng/news/ma |
From the original article
6 min read at unit42.paloaltonetworks.com
Palo Alto Networks Unit 42 has identified attacks with a new custom Remote Access Trojan (RAT) called UBoatRAT. The initial version of the RAT, found in May of 2017, was simple HTTP backdoor that uses a public blog service in Hong Kong and a compromised web server in Japan for command and control. The developer soon added various new features to the code and released an updated version in June.
By Kaoru Hayashi · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.