Void Dokkaebi Uses Cython-Compiled InvisibleFerret Malware

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The attacker has obtained a set of Cython‑compiled modules (mod.pyd, pad.pyd, brw.pyd) that implement credential‑harvesting and C2 communication. To achieve persistence, the adversary copies these modules into the current user’s VS Code configuration directory (%USERPROFILE%.vscode). VS Code periodically scans this folder for extensions, causing the malicious modules to be loaded by a later malicious Python script. The copy operation generates a Sysmon FileCreate event that matches the Sigma rule.

• Regression Test Script:

  # -------------------------------------------------
  # Simulation of InvisibleFerret Cython module drop
  # -------------------------------------------------
  $vscodePath = "$env:USERPROFILE.vscode"
  # Ensure the target folder exists
  if (-not (Test-Path -Path $vscodePath)) {
      New-Item -ItemType Directory -Path $vscodePath | Out-Null
  }
  
  # Simulated malicious binaries (random garbage content)
  $modules = @("mod.pyd","pad.pyd","brw.pyd")
  foreach ($mod in $modules) {
      $dest = Join-Path -Path $vscodePath -ChildPath $mod
      # Write 1 KB of random bytes to mimic a compiled extension
      $bytes = New-Object byte[] 1024
      (New-Object System.Random).NextBytes($bytes)
      [System.IO.File]::WriteAllBytes($dest, $bytes)
      Write-Host "Created $dest"
  }

• Cleanup Commands:

  # -------------------------------------------------
  # Cleanup of simulated malicious files
  # -------------------------------------------------
  $vscodePath = "$env:USERPROFILE.vscode"
  $modules = @("mod.pyd","pad.pyd","brw.pyd")
  foreach ($mod in $modules) {
      $file = Join-Path -Path $vscodePath -ChildPath $mod
      if (Test-Path $file) {
          Remove-Item -Path $file -Force
          Write-Host "Removed $file"
      }
  }