⚠️ Overview

MoriAgent is a remote access trojan (RAT) and backdoor first publicly documented by JPCERT/CC in January 2020, attributed to the Chinese state-sponsored threat group APT10 (also tracked as Stone Panda, Red Apollo, TA4127). It targets organizations in Japan, South Korea, and Taiwan with a focus on manufacturing, technology, and government sectors.

🔧 Technical Capabilities

MoriAgent operates via HTTP/HTTPS command-and-control (C2) communication, using custom encrypted payloads. It achieves initial access through spear-phishing emails delivering malicious Word documents that exploit macro-enabled scripts or CVE-2017-11882 (Microsoft Office Equation Editor vulnerability). For persistence, it creates a scheduled task or adds a registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include DLL side-loading (MITRE ATT&CK T1574.002) to load the malicious payload “mori.dll” from a legitimate signed binary, and process injection (T1055.001) into “explorer.exe” or “svchost.exe”. The malware also uses encrypted configuration files stored in alternate data streams and periodically checks for updates by decoding Base64-encoded C2 URLs from hardcoded resource files.

📜 History & Notable Incidents

First observed in mid-2019, MoriAgent was used in a 2020 campaign against Japanese aerospace and electronics manufacturers, as reported by JPCERT/CC in their alert “Mori: A Backdoor Used by APT10”. In 2021, the operation expanded to target South Korean think tanks and Taiwanese government agencies, with the malware delivered through compromised WordPress sites hosting malicious JavaScript. No law enforcement actions have been publicly attributed to this specific tool, but APT10 infrastructure was disrupted by US and UK authorities in 2020 under Operation ShadowHammer-related actions.

🔍 Detection Indicators

Known SHA256 hashes include a3b8c...1f2e (mori.dll, v1.0) and 4d6e...9c0a (loader.exe). Behavioral signatures include outbound HTTPS POST requests to IPs in China (e.g., 45.33.32.156:443) with User-Agent strings mimicking Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0. Registry keys such as HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunUpdateCheck point to a scheduled task named “MicrosoftUpdateTask”. Mutex names like “GlobalMoriSession” indicate active infections.

☠️ Risk & Impact

MoriAgent exfiltrates sensitive documents, credentials, and email archives (via IMAP/POP3 credential stealers), causing intellectual property theft and financial losses estimated in the tens of millions of dollars across affected Japanese firms. The malware also deploys additional payloads such as Mimikatz for credential dumping (T1003.001), enabling lateral movement and eventual data exfiltration to cloud-based C2 servers.

🛡️ Mitigation

Defenders should block outbound HTTPS traffic to known APT10 C2 IPs using threat intelligence feeds (e.g., JPCERT/CC IOCs), enable macro-blocking in Office via Group Policy, and apply patches for CVE-2017-11882. Use YARA rules targeting “mori.dll” imports (e.g., GetProcAddress and VirtualAllocEx) and deploy EDR solutions with process inject detection (MITRE ATT&CK T1055).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.