[BreachExchange] BabyShark Malware Delivered through Malicious Excel Macro Documents

[Destry Winant]

https://gbhackers.com/babyshark-malware-phishing/

Threat actors distributing Visual Basic based BabyShark malware that
delivered through spear phishing emails. The emails sent from a public
email address disguised to be from nuclear security expert in the U.S.

Palo Alto Networks Unit 42 researchers first identified the campaign
in November 2018 and it is having connections with past North Korean
activities such as KimJongRAT and STOLEN PENCIL.

The infection starts with a spear-phishing email that contains a
malicious Excel macro document attached, “when executed the macro
loads new Microsoft Visual Basic (VB) script-based malware dubbed
BabyShark.

The first stage of HTA is downloaded from a remote location and it
sends out an HTTP GET request to another location on the same C2
server that decodes the BabyShark VB script.

Then the BabyShark VB script enables macros for Microsoft Word and
Excel and adds the registry keys and issues a sequence of commands to
find the user information, IP address, system name, running tasks and
the versions.

BabyShark collects the data and encodes them by using certutil.exe and
then uploaded to the C2 server. It adds the registry key to ensure
persistence and waits for commands from the C2 server.

“We identified additional malicious document samples delivering
BabyShark. The original file names and decoy contents of these samples
suggested that the threat actor might have interests in gathering
intelligence related to not only North Korea but possibly wider in the
Northeast Asia region,” researchers said.

BabyShark found to be associated with previous North Korean activities
such as KimJongRAT and STOLEN PENCIL. BabyShark uses the same file
path for storing collected information as like KimJongRAT and the same
codesigning certificate used in STOLEN PENCIL campaign.

The malware is being used in a limited spear phishing campaign which
started in November 2018 and is still ongoing. The threat actor behind
it has a clear focus on gathering intelligence related to Northeast
Asia’s national security issues.