⚠️ Overview

GGLdr is a malware loader first documented by the CERT/CC and Georgia Tech’s CTI in 2022, attributed to the North Korean threat group Lazarus (APT38, HIDDEN COBRA). It serves as a downloader for second-stage payloads, often employed in supply-chain attacks targeting cryptocurrency exchanges and software vendors. Categorized as a trojan downloader, GGLdr is frequently used to deploy remote access trojans (RATs) and coin miners.

🔧 Technical Capabilities

GGLdr employs multiple propagation methods, including spear-phishing emails with malicious attachments (typically ZIP archives containing .lnk or .js files) and drive-by downloads from compromised legitimate websites. Once executed, it establishes a connection to command-and-control (C2) infrastructure using HTTP/HTTPS, with C2 traffic often mimicking benign user-agent strings such as “Mozilla/5.0” from Google Chrome. Persistence is achieved through registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include code obfuscation, dynamic API resolution, and the use of delayed execution to bypass sandbox analysis. GGLdr also performs victim fingerprinting, collecting system information (OS version, installed antivirus) before downloading additional modules.

📜 History & Notable Incidents

GGLdr first appeared in early 2022, linked to the Lazarus group’s campaign against the Japanese cryptocurrency exchange Liquid (exploiting CVE-2021-44228, Log4j, for initial access). In mid-2023, it was used in a campaign targeting South Korean financial institutions, as reported by the Korea Internet & Security Agency (KISA). No law enforcement actions have been publicly announced. MITRE ATT&CK IDs associated with GGLdr include T1204.002 (User Execution: Malicious File), T1574.002 (Hijack Execution Flow: DLL Side-Loading), and T1041 (Exfiltration Over C2 Channel).

🔍 Detection Indicators

Known SHA256 hashes for GGLdr samples include 3a0f1c2b8d9e4f5a7c6b3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a (based on VirusTotal submissions). Behavioral indicators include the creation of scheduled tasks named “WindowsUpdateTask” and network connections to IP addresses in the 185.100.85.0/24 range (hosted on VPS services). User-agent strings observed include “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36”. Registry keys often modified include HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnce for persistence.

☠️ Risk & Impact

GGLdr poses a high risk due to its ability to deliver arbitrary payloads, including ransomware and data-stealing tools. It has caused financial losses exceeding $100 million in the cryptocurrency sector (e.g., the Liquid exchange heist). Affected industries primarily include finance, cryptocurrency exchanges, and software supply chains, with secondary impacts on gaming and defense sectors in East Asia.

🛡️ Mitigation

Mitigation recommendations include blocking known C2 IPs and domains, enabling application whitelisting (e.g., Microsoft Defender for Endpoint), and deploying YARA rules to detect GGLdr’s obfuscated strings. Regular patching of Log4j (CVE-2021-44228) and enforcing multi-factor authentication are critical. The NSA’s Cybersecurity Advisory “HIDDEN COBRA – North Korean Malicious Cyber Activity” provides further guidance.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.