Threats Tagged 'lnk-obfuscation'

NarwhalRAT is a sophisticated Python-based remote access trojan (RAT) used by the APT37 threat actor targeting Korean users. It is delivered via spear phishing emails disguised as Microsoft security alerts, using LNK files in ZIP archives and BAT-based obfuscation. The malware supports keylogging, screen capture, microphone recording, and USB data collection. It uses a dual command-and-control (C2) infrastructure combining Korean relay servers and the pCloud API as a dead-drop resolver. NarwhalRAT employs anti-VM techniques, encrypted configuration files, persistence via scheduled tasks, and in-memory execution to evade detection. It is manually controlled with selective function activation through C2 commands. No affected software versions or patches are specified.