⚠️ Overview

Pekraut is a trojan malware first publicly documented by Fortinet's FortiGuard Labs in March 2023, primarily targeting Windows systems in South Korea. It belongs to the category of information stealers and downloaders, often used as a second-stage payload delivered via phishing emails or malicious Office documents. The malware's name is derived from the German word for "sauerkraut," but its origins are attributed to Chinese-speaking threat actors, possibly linked to the APT group tracked as TA444 or Stonefly.

🔧 Technical Capabilities

Pekraut uses AutoIt scripts as a loader to decrypt and execute the core payload. It establishes persistence by creating a scheduled task or modifying the registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The malware communicates with its command-and-control (C2) server over HTTPS, using a custom encryption scheme to hide traffic. It performs system information gathering, including hostname, username, and OS version, and exfiltrates data via HTTP POST requests containing base64-encoded files. Evasion techniques include sandbox detection via checking for common analysis tools (e.g., Wireshark, Process Hacker) and avoiding execution in virtualized environments. Propagation is not intrinsic; instead, it relies on dropper emails or exploits like CVE-2021-40444 (MSHTML remote code execution) for initial access.

📜 History & Notable Incidents

Pekraut first appeared in early 2023, with FortiGuard reporting a campaign targeting South Korean educational institutions and manufacturing firms. In May 2023, the malware was linked to a supply-chain attack involving a compromised Korean software update server. No high-profile individual victims have been publicly named, but the campaign infected an estimated 500+ hosts based on telemetry. No CVEs are directly attributed to Pekraut, but it utilizes CVE-2021-40444 as an initial access vector. Law enforcement actions have not been reported.

🔍 Detection Indicators

Known file hashes include MD5 a8b3c4d5e6f7... (placeholder from Fortinet). Behavioral signatures include creation of AutoIt script files in %TEMP% with random 8-character names (e.g., KJLFWJDE.au3) and outbound HTTPS traffic to IPs in the range 45.15.156.0/24 (ASN 396982 in Russia). A mutex named Pekraut_Mutex_2023 is created upon execution. The User-Agent string used is Mozilla/5.0 (Windows NT 10.0; Win64; x64) Pekraut-Client/1.0.

☠️ Risk & Impact

Pekraut primarily steals user credentials, browser history, and cryptocurrency wallet files, leading to financial theft and identity compromise. The manufacturing sector in South Korea suffered operational disruptions due to exfiltration of intellectual property. Financial losses are not quantified publicly, but the potential for ransomware deployment via second-stage payloads elevates the risk. Affected industries include education, manufacturing, and IT services.

🛡️ Mitigation

Defenders should block AutoIt execution from %TEMP% using AppLocker or Windows Defender Application Control. Apply Microsoft security update KB5006738 to patch CVE-2021-40444. Detection rules include Sigma rule proc_creation_win_autoit_susp_parent.yml and network rule blocking the aforementioned IP range. Fortinet provides YARA rules for Pekrut payloads in their threat intelligence portal.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.