BabySharkMalware
- lateop
BabyShark is Microsoft Visual Basic (VB) script-based malware family first seen in November 2018. The malware is launched by executing the first stage HTA from a remote location, thus it can be delivered via different file types including PE files as well as malicious documents.From MISP Galaxy
Last reported 1 month ago, by SOCRadar3 reports
ATT&CK techniques
6 of 25 · each with the sentence it comes from- T1036Masquerading
“These archives contained LNK files masquerading as PDFs, using lures focused on global food price growth due to the Strait of Hormuz situation, Russia-Ukraine peace negotiation frameworks, and social researcher resumes to deceive targets.”
- T1053.005Scheduled Task
“T1053.005”
- T1566.001Spearphishing Attachment
“T1566.001”
- T1005Data from Local System
“T1005”
- T1016System Network Configuration Discovery
“T1016”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures“…list client with server-side logic mirrors the design philosophy of related Kimsuky toolsets, including the FlowerPower, GitPower, and BabyShark families, where lightweight loaders execute server-side commands and push results back to remote infrastructure.”
-
Playing defense against Gamaredon Group“…e same techniques have also been associated with threat groups like APT32 and are leveraged by malware families such as AgentTesla and BabyShark.”
-
Targeted APT Activity: BABYSHARK Is Out for Blood“North Korea's recent BabyShark malware works with the fileless technique by downloading encrypted malicious scripts from Google drive.”
Indicators in its reports
named in the reports above- worldinfocontact[.]clubin 1 report
- wshell[.]runin 1 report
- hxxps://hodbeast[.]com/silver/upload.phpin 1 report
- hodbeast[.]comin 1 report
- hxxps://frebough[.]com/onedrive/winmm.php?op=in 1 report
- frebough[.]comin 1 report
- hxxp://beastmodser[.]club/sil/0304/VOA_Korea.docxin 1 report
- beastmodser[.]clubin 1 report
- hxxps://beastmodser[.]club/sil/0304/d.php?na=version.gifin 1 report
- retmodul[.]comin 1 report
- 5b31d65b0607ae3d…14d9766978eain 1 report
- c86d6e9dfc79bdf2…67b32bef3a6bin 1 report
- bf82675bac2cd574…d2666cd72f5ain 1 report
- 2ad3266331e40567…b92036c93160in 1 report
- e314b40449b7b9b8…fd84ecf17cafin 1 report
- e08fe0b287b4d112…1329389ad931in 1 report
- def0975728fc5da6…63c7830bec8din 1 report
- d41c943fd5ffacde…4bd486f182b3in 1 report
- c327631a212e4a96…78ecb0bfe66fin 1 report
- hopto[.]orgin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.