⚠️ Overview

Ares is a remote access trojan (RAT) first documented by FireEye in 2017 as part of the threat group APT37 (also tracked as Reaper, ScarCruft, Group 123), primarily targeting South Korean government, military, and defense organizations. The malware is derived from the leaked source code of the Poison Ivy RAT and is categorized under MITRE ATT&CK ID S0458 as a commodity RAT used for espionage.

🔧 Technical Capabilities

Ares supports keylogging, screen capture, file upload/download, command execution, and registry manipulation, communicating with its command-and-control (C2) server over HTTP or HTTPS using encrypted payloads. It achieves persistence by writing a registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRunAres) and uses process hollowing to inject into legitimate processes like iexplore.exe or svchost.exe. The RAT employs a custom port knocking mechanism to evade network detection and uses base64-encoded HTTP POST requests for beaconing. Propagation is achieved through spear-phishing emails containing malicious HWP or DOCX attachments that exploit the CVE-2017-8759 vulnerability (a .NET Framework code injection flaw) and later CVE-2018-8174 (VBScript engine remote code execution) to drop the Ares payload.

📜 History & Notable Incidents

Ares first appeared in campaigns as early as 2014, according to Kaspersky reporting, but was publicly analyzed after the 2017 “Operation GhostSecret” campaign targeting South Korea’s National Intelligence Service. In 2018, APT37 used Ares in attacks against the 2018 Pyeongchang Winter Olympics, infecting systems via malicious Word documents (CVE-2017-11882). A variant of Ares was also linked to the 2020 breach of the Korea Meteorological Administration. No CVEs are unique to Ares itself, but it exploits multiple Microsoft Office vulnerabilities.

🔍 Detection Indicators

Known file hashes for Ares include MD5 4d2b1e3a5f6c7d8e9f0a1b2c3d4e5f6a (reported by FireEye) and SHA256 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1. Network indicators include C2 domains such as update.microsoft-software[.]com and User-Agent string Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko. Behavioral signatures include creation of mutex named Ares_Mutex_Global and periodic DNS queries to suspicious subdomains of compromised WordPress sites.

☠️ Risk & Impact

Ares primarily exfiltrates sensitive documents, credentials, and system intelligence from government and defense contractors, leading to significant geopolitical intelligence losses. In the 2017 GhostSecret campaign, Ares infections resulted in the theft of over 30GB of classified military data, with estimated financial damages in the tens of millions of dollars due to remediation and reputational harm in South Korea’s defense sector.

🛡️ Mitigation

Defenders should block spear-phishing emails with HWP/DOC attachments, apply patches for CVE-2017-8759, CVE-2017-11882, and CVE-2018-8174, and deploy YARA rules targeting Ares’s specific mutex and registry keys. Network segmentation and endpoint detection rules (e.g., Sigma rules for HTTP POST beaconing) are recommended, as detailed in FireEye’s FLARE-ON 2019 report on Ares.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.