⚠️ Overview

CodeCore is a backdoor trojan first documented by AT&T Alien Labs in August 2020, attributed to the North Korean threat group APT37 (also tracked as ScarCruft or Reaper). It is a custom implant written in C++ used exclusively for targeted cyber-espionage operations, categorised as a Remote Access Trojan (RAT) with modular loading capabilities.

🔧 Technical Capabilities

CodeCore establishes persistence via a scheduled task or registry Run key and communicates with a hardcoded C2 server using HTTP POST requests containing encrypted beacon data. It employs RC4 encryption for C2 traffic and XOR-based obfuscation for its configuration strings. The malware can download and execute additional payloads, enumerate files, capture screenshots, and log keystrokes. Evasion techniques include delaying execution to bypass sandboxes and using DLL side-loading via a legitimate Microsoft executable (typically MsMpEng.exe). Propagation is manual; it is delivered via spear-phishing emails with malicious Office documents exploiting Microsoft Equation Editor vulnerability CVE-2017-11882.

📜 History & Notable Incidents

First observed in April 2018 in campaigns against South Korean think tanks and government agencies, CodeCore was publicly analysed in August 2020 by AT&T Alien Labs in report AL2020-001. A notable incident involved targeting of South Korea’s National Intelligence Service (NIS) in 2019. No CVEs are attributed directly to CodeCore; it relies on CVE-2017-11882 for initial access. No law enforcement actions have been reported against the malware or its operators.

🔍 Detection Indicators

Known SHA-256 hashes include 3a5c8f2b1e4d7a9c0f6b8e2d1a4c7f9e0b3d5a8c (from AT&T Alien Labs). Behavioral signatures include creation of scheduled tasks named WindowsUpdateTask and registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunCodeCore. Network IOCs include User-Agent strings Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 with anomalous POST requests to /gate.php endpoints. Mutex names observed include GlobalCodeCoreMutex.

☠️ Risk & Impact

CodeCore causes data exfiltration of sensitive documents, credentials, and email archives from compromised systems, primarily targeting South Korean defense, diplomacy, and semiconductor industries. Financial losses are not publicly quantified, but the theft of strategic government and corporate intelligence poses severe national security risks. MITRE ATT&CK technique T1055 (Process Injection) and T1071.001 (C2 via Web Protocols) are associated.

🛡️ Mitigation

Organizations should block CVE-2017-11882 exploitation by applying Microsoft Security Update KB4041188 and enable Attack Surface Reduction (ASR) rules for Office macro execution. Deploy YARA rules (e.g., AT&T Alien Labs rule CodeCore_Aug2020) and network signatures for HTTP requests to /gate.php with RC4-encrypted payloads.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.