Larva-26005: Tracing Xctdoor’s Connection to CRAT Attacks

Summary

The Larva-26005 threat actor is actively distributing Xctdoor malware to users in South Korea. The campaign relies on multiple delivery methods, including malicious LNK files, spear phishing, and malware disguised as legitimate security software such as Veraport and SoftCamp. Xctdoor functions as a backdoor capable of command execution, file manipulation, and sensitive information theft.

Investigation

ASEC investigated links between current Larva-26005 activity and earlier CRAT malware campaigns. The analysis uncovered shared obfuscation routines, similar installation paths within AppX packages, and connections to the Lazarus group. Researchers also documented a multi-stage execution chain involving VBS, BAT, and PowerShell scripts.

Mitigation

Users should remain cautious when opening email attachments or downloading executable files from unknown or unverified sources. Security software installers should be validated before execution to ensure they are legitimate. Organizations should also keep endpoint security products such as V3 updated to the latest versions to detect known malware signatures.

Response

If suspicious LNK files or unauthorized RegSvr32 activity is detected, the affected host should be isolated from the network immediately. Responders should examine %PUBLIC% and %LOCALAPPDATA% for unauthorized scripts, DLLs, or related artifacts. A broader environment-wide scan should also be performed for indicators associated with XcLoader and Xctdoor.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary seeks to establish persistence on the victim’s machine to survive reboots. They drop a malicious DLL disguised as a lock file (settings.Lock) into a subdirectory of the Microsoft.MicrosoftOffice365Hub package. To evade detection, they use regsvr32.exe to load this file. Because regsvr32.exe is a digitally signed Microsoft binary, it often bypasses basic security controls. The command is crafted to specifically target the path identified in the threat intelligence report, facilitating the execution of the Xctdoor backdoor via COM interface hijacking.

• Regression Test Script:

  # Simulation Script for Xctdoor Persistence Detection
  # Note: This script creates a dummy file to simulate the payload to avoid actual malware execution.
  
  $targetDir = "$env:LOCALAPPDATAPackagesMicrosoft.MicrosoftOffice365Hub_8wekyb3d8bbweSettings"
  $targetFile = Join-Path $targetDir "settings.Lock"
  
  # 1. Create the directory structure if it doesn't exist
  if (!(Test-Path $targetDir)) {
      New-Item -Path $targetDir -ItemType Directory -Force | Out-Null
  }
  
  # 2. Create a dummy "malicious" file (in reality, this would be a DLL)
  # We use a zero-byte file for safety in this simulation
  New-Item -Path $targetFile -ItemType File -Force | Out-Null
  
  Write-Host "[+] Dummy payload created at: $targetFile"
  
  # 3. Execute regsvr32 to trigger the detection rule
  Write-Host "[+] Executing regsvr32 to trigger detection..."
  Start-Process "regsvr32.exe" -ArgumentList "/s `"$targetFile`"" -Wait
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  # Cleanup Script
  $targetDir = "$env:LOCALAPPDATAPackagesMicrosoft.MicrosoftOffice365Hub_8wekyb3d8bbweSettings"
  $targetFile = Join-Path $targetDir "settings.Lock"
  
  if (Test-Path $targetFile) {
      Remove-Item -Path $targetFile -Force
      Write-Host "[+] Cleaned up simulation file."
  } else {
      Write-Host "[!] Target file not found, nothing to clean."
  }