By Vitali Kremez, Director of Research, Flashpoint
Flashpoint analysts believe that the recently disclosed intrusion suffered in December 2018 by Chilean interbank network Redbanc involved PowerRatankba, a malware toolkit with ties to North Korea-linked advanced persistent threat (APT) group Lazarus. Redbanc confirmed that the malware was installed on the company’s corporate network without triggering antivirus detection, however the threat has since been mitigated and did not impact company operations, services, or infrastructure.
This intrusion represents the latest known example of Lazarus-affiliated tools being deployed within financially motivated activity targeted toward financial institutions in Latin America.
Chilean Redbanc Intrusion: Reported Initial Attack Vector
According to recent reporting, the intrusion occurred due to malware delivered via a trusted Redbanc IT professional who clicked to apply to a job opening found through social media. The individual who appeared to have posted the open position then contacted the applicant from Redbanc to arrange a brief interview, which occurred shortly thereafter in Spanish via Skype. Having never expressed any doubts about the legitimacy of the open position, application, or interview process, the applicant was ultimately and unwittingly tricked into executing the payload.
Referenced Sample Leads to North-Korean Lazarus “PowerRatankba”
In the publicly referenced samples attributed to the Redbanc intrusion, Flashpoint analysts identified the dropper sample as being related to the Lazarus malware PowerRatankba. The dropper is a Microsoft Visual C#/ Basic .NET (v4.0.30319)-compiled executable that contains the logic to call the server and download a PowerRatankba PowerShell reconnaissance tool. The malware timestamp displays the possible compilation time of Wednesday, October 31, 2018, 00:07:53 UTC with the program database as F:\05.GenereatePDF\CardOffer\salary\salary\obj\Release\ApplicationPDF.pdb.
The dropper displays a fake job application form while downloading and executing PowerRatankba. The payload was not available from the server during the time of the analysis but was recovered from the sandbox at the time of analysis. This allowed analysts to create a likely scenario of how the malware chain worked.
