Analysis of Wpcdoor Attack Cases Spread via Korea-Based DVR Management Software

On October 27, 2026, Huntress disclosed a case of malware distribution that exploited DVR management software. [1] The company targeted in this incident was a Korean firm that develops products such as CCTV and DVR systems, and according to the company’s ASD logs, infection logs were also confirmed in Korea. Given that malware of the same type has continued to be detected beyond this specific incident, it appears that the threat actor is using various methods for malware distribution. In this report, we analyze the attack cases confirmed in Korea and the malware used, and summarize additional instances of the same type that have been collected. 

 

1. Attack Flow

1.1. DVR Management Software

A report by Huntress confirmed that malware was installed via “CMS.exe,” a component of CMS (Central Management Software)—the DVR management software developed by a Korean company—but noted that the connection between this attack and the vendor could not be determined. Our own logs also confirmed that the “CMS.exe” process generated the malware “iphlpapi.dll.” It remains unclear whether this attack exploited a vulnerability or took advantage of improper configurations or built-in features.

Figure 1. Malware generated by the CMS.exe process

 

1.2. Malware Installation

A. During the installation of “rs.win32.exe” by the CMS software, the malware “IPHLPAPI.DLL” is downloaded
. B. “IPHLPAPI.DLL” is loaded into the “rs.win32.exe” process via DLL side-loading and executes
. C. “IPHLPAPI.DLL” acts as a downloader, installing and executing
the legitimate program “WpcMon.exe” and the malware “samcli.dll.” D. “samcli.dll” It also acts as a downloader to download the Wpcdoor backdoor malware and execute
it in memory. E. Wpcdoor steals information from the infected system and transmits it to the C&C server, after which it can execute commands issued by the threat actor.

“rs.win32.exe” is DVR management software, and this path has been used for some time. Although the specific method is unknown, it is presumed that “%APPDATA%\CMS\RemoteSetup\” and related modules are typically installed in the “rs.win32.exe” path during the CMS update process or when specific features are enabled. 

For reference, the compressed file uploaded to VirusTotal contains “rs.win32.exe,” the Qt library files required to run the program, and “IPHLPAPI.DLL” and “IPHLPAPI_.DLL.” Among these, “IPHLPAPI.DLL” is the malware. In other words, it is presumed that the CMS installed the following files in the “%APPDATA%\CMS\RemoteSetup\” path:

Figure 2. Utilities and Malware Present in the Compressed File

Subsequently, when “rs.win32.exe” is executed, the malware “IPHLPAPI.DLL,” located in the same Path, is loaded via DLL side-loading. This malware then installs the legitimate system file “WpcMon.exe” and the malware “samcli.dll” in the “%LOCALAPPDATA%\Microsoft\WpcMon\” Path and executes “WpcMon.exe.” “WpcMon.exe” loads “samcli.dll” via DLL side-loading; this malware also acts as a downloader, downloading the final backdoor malware, Wpcdoor, and executing it in memory.

Figure 3. Malware loaded by the WpcMon.exe process

 

2. Malware Analysis

2.1. Stage 1 Downloader (IPHLPAPI.DLL, QtCore4.dll)

“IPHLPAPI.DLL” is loaded and executed by “rs.win32.exe.” It exports the GetAdaptersInfo() API; when this API is called, it invokes the GetAdaptersInfo() function of the actual legitimate file “IPHLPAPI.DLL,” located on the same Path.

Upon execution, it connects to the C&C server to request files to download, making two requests: for “WpcMon.exe” and “samcli.dll.” The packet begins with the signature “WPCF” and ends with the file name of the requested file. 

Figure 4. Packet during a file download request

Offset	Size	Request	Response
0X00	0X04	“WPCF”	“WPCF”
0X04	0X02	00 01	00 01
0X06	0X02	00 10	00 20
0X08	0X04	Size of random data	Size of encrypted data
0X0C	0X04	Checksum	Checksum
0X10	–	Random data (0x14)	Encrypted Data
0X24	–	File name to download	N/A

Table 1. Packet Structure for Download Requests

The downloaded payload is decrypted using an XOR operation with the key 0x82615458, saved to the path “%LOCALAPPDATA%\Microsoft\WpcMon\,” and then “WpcMon.exe” is executed. Although access is currently unavailable, based on Huntress’s report and ASD logs, it is presumed that a stage-two downloader was installed. 

• Download Path – 1: %LOCALAPPDATA%\Microsoft\WpcMon\WpcMon.exe
• Download Path – 2: %LOCALAPPDATA%\Microsoft\WpcMon\samcli.dll

Figure 5. Download Routine

For reference, in addition to this attack case, a first-stage downloader named “QtCore4.dll” has also been identified. “QtCore4.dll” is essentially identical in form to the type described above, but there are differences in the downloader path and other details. This method involves downloading a second-stage downloader named “rsaenh.dll” from the following path, then modifying the environment variables “WINDIR” and “SystemRoot” to point to the “%LOCALAPPDATA5\Microsoft\Windows\” path, and finally executing the “C:\Windows\Sysnative\FileHistory.exe” file. 

• Download path: %LOCALAPPDATA5\Microsoft\Windows\System32\rsaenh.dll

 

2.2. Stage 2 Downloader (samcli.dll, rsaenh.dll)

The second-stage downloader, “samcli.dll,” executes the downloaded payload directly from memory rather than from a file. Upon initial execution, it checks for a mutex and then communicates with the C&C server; the structure of the communication packets and the XOR key used to decrypt the payload are identical to those of the first-stage downloader. 

• Mutex: Global\81669d8b1539333e96b84c2e5c4dba5d

In the “QtCore4.dll” case, “rsaenh.dll” is downloaded instead of “samcli.dll.” “rsaenh.dll” also has the same structure as the Stage 2 downloader. 

Figure 6. Packet during a backdoor download request

 

2.3. Wpcdoor Backdoor

The final executable is a backdoor that includes functionality for Information Theft on the infected system. Here, it is classified as Wpcdoor based on the exploited process name “WpcMon.exe” and the signature string “WPCF” used by the downloader.

When Wpcdoor executes, it checks for a mutex and registers itself under the “Run” key with the name “WpcMon.” It then retrieves information such as the identifier (UUID), username, computer name, and OS version, captures a screenshot, and transmits this data to the C&C server. One notable feature is that it also checks whether the “zlib.dll” file is present on the same Path and transmits the result. It then receives commands from the C&C server and performs the functions as follows. 

Command Code	Function
0X01	Capture a screenshot
0X02	Clipboard Hijacking
0X03	Clipboard Modification
0X06	File Download/Upload
0X07	Command execution
0X08	File Lookup
0X09	File Grabber
0X0B / 0x0C	Port Forwarding
0X0D	Information Theft of user information stored in the web browser
0X0E	Memory dump and theft of specific processes
0X0F	Searching for and stealing keywords from the memory of wallet-related processes
0X11	Terminate process
0X12	Update
0X13	HVNC (172.86.127[.]14:8443)

Table 2. Supported Commands

Among these commands, command 0x0D performs information theft not only of credential information but also of data such as cookies, browsing history, and credit card numbers. Command 0x09 searches the user folders as follows to find file names received from the C&C server and steals them. 

• File Grabber Target Folders: Desktop, Downloads, Documents, Pictures, Videos, OneDrive, AppData

The 0x0F command searches the memory of a specified process for the wallet extension IDs as follows: if a match is found, it searches the memory for a specific string pattern. Given that these are wallet extensions, it is presumed that this string is a seed phrase—a set of words used to restore the wallet. 

• MetaMask (Chrome): nkbihfbeogaeaoehlefnkodbefgpgknn
• MetaMask (Edge): ejbalbakoplchlghecdalmeeeajnimhm
• Coinbase: hnfanknocfeofbddgcijnmhnfnkdnaad
• Phantom: bfnaelmomeimhlpmgjnjophhpkkoljpa
• Trust: egjidjbpglichdcondbcbdnbeeppgdph
• Ronin: fnjhmkhhmkbjkkabndcnnogagogbneec
• Binance: fhbohimaelbohpjbbldcngcnapndodjp
• TronLink: ibnejdfjmmkpcnlpebklmnkoeoihofec
• Solflare: bhhhlbepdkbapadjdnnojkbgioiodbic
• SecondFi: ffnbelfdoeiohenkjibnmadjiehjhajb

Note that in addition to the commands received from the C&C server, Wpcdoor also transmits data as follows to the C&C server. 

Response codes	Function
0X00	Transmission of information upon initial connection
0X01	Transmit screen captures at regular intervals
0X04	Keylogging transmission
0X05	Clipboard
0X0A	Heartbeat
0X10	Transmission of Clipboard Text Matching Conditions

Table 3. Transmitted Data

 

3. Conclusion

Recently, an incident was confirmed in which malware distribution occurred through exploitation of domestic DVR management software. AhnLab SEcurity intelligence Center (ASEC) has classified the threat actor as Larva-26013, and Larva-26013 has been observed installing Wpcdoor in other attack cases outside of Korea as well. The attacker can ultimately use the installed Wpcdoor backdoor to steal user information stored on the infected system. Users should apply the latest security patches for software and operating systems supported by their respective vendors, check the security settings of the compromised software, and immediately change any usernames and passwords used in that software and related systems. 

 

MD5

0a9cb414b53536ad8fc217fc46a2cf56

14746a3aa1d1882a53d244b39e6895b3

2376baa1ba3a918f754db6bbc15cb1d7

6bafd9065f68ecd5778b8c828bb17134

7e42d1461339572111a2eedfff42e1c2

IP

144[.]172[.]116[.]37

172[.]86[.]127[.]14

172[.]86[.]127[.]89