{
  "Event": {
    "analysis": "1",
    "date": "2026-06-15",
    "extends_uuid": "",
    "info": "[Threat Intel] Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2",
    "protected": false,
    "publish_timestamp": "1782230763",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782230763",
    "uuid": "24638e19-caf4-4253-8ead-b7f85dda8137",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Removable Media - T1025\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"APT37\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578856",
        "to_ids": false,
        "type": "link",
        "uuid": "69dc31a5-79e9-4592-8bd6-0bc3ad675997",
        "value": "https://www.genians.co.kr/en/blog/threat_intelligence/narwhalrat",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578856",
        "to_ids": false,
        "type": "text",
        "uuid": "7bd62a2a-26f5-4a3a-b3ff-1f76b4b17c41",
        "value": "A sophisticated Python-based RAT targeting Korean users through spear phishing emails disguised as Microsoft security alerts. The attack chain employs LNK files embedded in ZIP archives, BAT-based obfuscation, and multi-stage loaders culminating in NarwhalRAT deployment. This advanced malware features keylogging, screen capture, microphone recording, and USB data collection capabilities. It utilizes a dual C2 infrastructure combining Korean relay servers (daehoat.com, novel21.co.kr) with pCloud API as a dead-drop resolver. The malware creates encrypted configuration files, implements anti-VM techniques, and establishes persistence through scheduled tasks. It operates as a manually-controlled RAT with selective function activation via C2 commands, employing in-memory execution to evade file-based detection."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578856",
        "to_ids": false,
        "type": "text",
        "uuid": "7b1e65ae-257f-438d-8ff2-346a55cc39ef",
        "value": "Name: Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2\nAuthor: AlienVault\nAdversary: APT37\nTags: [\"anti-vm\", \"rokrat\", \"python-backdoor\", \"lnk-obfuscation\", \"dead-drop-resolver\", \"pcloud\", \"narwhalrat\", \"spear-phishing\", \"korean-targeting\"]\nTgtd countries: []\nMlwr families: [\"NarwhalRAT\", \"ROKRAT - S0240\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1056.001\", \"T1025\", \"T1204.002\", \"T1497.001\", \"T1566.001\", \"T1005\", \"T1140\", \"T1055\", \"T1112\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1059.003\", \"T1070.004\", \"T1071.001\", \"T1102.001\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097639",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "37295d91-b5bb-4355-9c42-9ea1c475cc7d",
        "value": "APT37",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"APT37\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107319",
        "to_ids": true,
        "type": "domain",
        "uuid": "74040ac1-fafc-437d-b897-6b629c7c9cba",
        "value": "crwellfood.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107340",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3f83e08e-5eca-4fef-804b-b0c722247e5a",
        "value": "211.239.157.126",
        "Tag": [
          {
            "colour": "#540719",
            "local": false,
            "name": "asn:asn=\"9952\"",
            "relationship_type": ""
          },
          {
            "colour": "#c029ab",
            "local": false,
            "name": "asn:as-owner=\"HOSTWAY-AS-KR Hostway IDC\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107361",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "62e5c532-48da-473b-af6f-11cb961d6259",
        "value": "218.150.78.198",
        "Tag": [
          {
            "colour": "#e44b9d",
            "local": false,
            "name": "asn:asn=\"4766\"",
            "relationship_type": ""
          },
          {
            "colour": "#dfa1b3",
            "local": false,
            "name": "asn:as-owner=\"KIXS-AS-KR Korea Telecom\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107382",
        "to_ids": true,
        "type": "domain",
        "uuid": "66b5e650-a072-4e53-b2be-f684fd453f0a",
        "value": "fe01.co.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:22/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782101867",
        "to_ids": true,
        "type": "md5",
        "uuid": "e169f5aa-261b-48e8-94bf-d5bfdc091c4f",
        "value": "3715092aa00f380cefe8b4d2eddb7d08",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:22/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782101869",
        "to_ids": true,
        "type": "md5",
        "uuid": "7952aca6-eb7b-41ee-a73c-a9d8ecc2558c",
        "value": "7cef19f9c4480adac0cd4702ff98f46c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:22/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782101870",
        "to_ids": true,
        "type": "md5",
        "uuid": "8af85688-d15f-49f1-a79e-e24d3df831fa",
        "value": "7eb9cee1f696727752169f25cf79a338",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:22/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782101870",
        "to_ids": true,
        "type": "md5",
        "uuid": "d6fb1257-0f59-4c6c-8078-9498fcc57f13",
        "value": "b6b0602310bb2d4360c52685119aac1b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107407",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1ea0c093-2e0e-4d0d-b17b-c74285681d8b",
        "value": "121.254.222.10",
        "Tag": [
          {
            "colour": "#27b855",
            "local": false,
            "name": "asn:asn=\"3786\"",
            "relationship_type": ""
          },
          {
            "colour": "#0613f3",
            "local": false,
            "name": "asn:as-owner=\"LGDACOM LG DACOM Corporation\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107428",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "70b4610f-7f48-43fb-b02c-4abf168b3e16",
        "value": "121.254.222.80",
        "Tag": [
          {
            "colour": "#27b855",
            "local": false,
            "name": "asn:asn=\"3786\"",
            "relationship_type": ""
          },
          {
            "colour": "#0613f3",
            "local": false,
            "name": "asn:as-owner=\"LGDACOM LG DACOM Corporation\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107449",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d34e88-ea64-49f1-8fe3-b0776bd8b9d2",
        "value": "218.150.78.231",
        "Tag": [
          {
            "colour": "#e44b9d",
            "local": false,
            "name": "asn:asn=\"4766\"",
            "relationship_type": ""
          },
          {
            "colour": "#dfa1b3",
            "local": false,
            "name": "asn:as-owner=\"KIXS-AS-KR Korea Telecom\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107470",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ff1903df-82fe-4c45-93f8-211be846e450",
        "value": "61.100.9.206",
        "Tag": [
          {
            "colour": "#540719",
            "local": false,
            "name": "asn:asn=\"9952\"",
            "relationship_type": ""
          },
          {
            "colour": "#c029ab",
            "local": false,
            "name": "asn:as-owner=\"HOSTWAY-AS-KR Hostway IDC\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107491",
        "to_ids": true,
        "type": "url",
        "uuid": "edbefb30-f5fd-45b6-aabd-3cb6e7330835",
        "value": "http://www.novel21.co.kr/data/editor/2110/index.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107512",
        "to_ids": true,
        "type": "domain",
        "uuid": "2f9906e8-fb79-4e0d-9901-5f1b33d908ea",
        "value": "novel21.co.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107533",
        "to_ids": true,
        "type": "domain",
        "uuid": "8f3b51d5-099f-43c0-a9d8-7db98cf86d7e",
        "value": "webhostingkorea.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107554",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5200ac5e-0678-4721-ad34-5ec61ab71543",
        "value": "www.novel21.co.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}