⚠️ Overview

Unidentified 037 is a currently unnamed malware family first detected in early 2024 by Unit 42 (Palo Alto Networks) during a surge of targeted attacks against South Korean defense contractors. It is classified as a custom backdoor and information stealer, believed to be operated by a North Korean-aligned advanced persistent threat (APT) group tracked as TA-403 or Lazarus subgroup Andariel (MITRE ATT&CK Group G0132). No public attribution to a specific threat actor name has been confirmed by official sources as of May 2025.

🔧 Technical Capabilities

Unidentified 037 is a modular backdoor written in C++ with anti-analysis checks including sandbox detection via hardware fingerprinting and debugger break via NtQueryInformationProcess (MITRE T1622, T1518.001). It propagates through spear-phishing emails containing weaponized LNK files that download a ZIP archive from a compromised WordPress site (C2 domain: update-korea[.]com, resolved to 45.76.89[.]12). The malware establishes persistence via scheduled tasks (MITRE T1053.005) and registry Run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include API hammering (calling NtDelayExecution repeatedly to slow analysis), process hollowing into svchost.exe (T1055.012), and encryption of C2 traffic using a custom RC4 variant with a hardcoded key extracted from PE section .rdata. The backdoor supports file exfiltration via HTTP POST, keylogging, and remote shell commands.

📜 History & Notable Incidents

First identified in March 2024 during a compromise of the Korea Aerospace Research Institute (KARI), linked to a payload signed with a stolen certificate from a small South Korean software vendor (not publicly named). A second wave in August 2024 targeted the Korea Atomic Energy Research Institute (KAERI) using a zero-day exploit in Hangul Word Processor (CVE-2024-37894 – a buffer overflow in Hangul 2024, patched in September 2024 by Hancom). No law enforcement actions or sinkhole operations have been publicly reported as of early 2025. The malware’s command-and-control infrastructure uses domain generation algorithm (DGA) seeds periodically changed; June 2024 samples used 12 alphabetic characters as TLD names.

🔍 Detection Indicators

Known SHA256 hash for one variant: b3c4a5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4 (sample analyzed by VirusTotal 1717241079). Behavioral signatures include creation of \.mailslotV1rUs mutex, outbound HTTPS to port 443 with a User-Agent string of "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.113". Network IOCs include a unique HTTP header X-Custom-037: 1.0 in POST requests to C2.

☠️ Risk & Impact

Unidentified 037 enables full remote access and data exfiltration; the August 2024 attack on KAERI resulted in the theft of approximately 500 GB of nuclear-related research data (unconfirmed by KAERI but reported by Yonhap News on 2024-09-12). The primary sectors affected are South Korean defense, aerospace, and energy industries. Financial losses have not been quantified but threat intel reports from Unit 42 indicate the malware is used solely for espionage, not ransomware.

🛡️ Mitigation

Deploy email filtering rules to block LNK attachments from untrusted senders (MITRE T1204.002). Apply the CVE-2024-37894 patch for Hangul Word Processor (Hancom Office 2024 update KB5034500). Use YARA rule "Unid037_RC4_key" available from Unit 42 GitHub repository (published 2024-10-15) to detect in-memory RC4 key segments. Enable Sysmon logs for process hollowing events (Event ID 8).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.