BanPolMex RAT

BanPolMex RAT is a Windows rat operated by Lazarus Group.

Background

BanPolMex is a remote access trojan that communicates over TCP.

For encrypting both its configuration and its network traffic, it relies on an RC4-like stream cipher named Spritz.

It reports extensive details about the victim's environment, including the computer name, Windows version, available memory and drive space, processor identifier and architecture, system locale, system metrics, manufacturer, and network configuration.

The RAT offers nearly 30 commands covering filesystem operations, rudimentary process management, file exfiltration, and pulling down and running extra tools from the attacker's C&C server. Like many RATs in the Lazarus arsenal, its commands are indexed by 32-bit integers, but here those indices decode into readable ASCII strings that hint at their purpose: SLEP, HIBN, DRIV, DIR, DIRP, CHDR, RUN, RUNX, DEL, WIPE, MOVE, FTIM, NEWF, DOWN, ZDWN, UPLD, PVEW, PKIL, CMDL, DIE, GCFG, SCFG, TCON, PEEX, PEIN.

Its internal DLL name is aclui.dll, and it statically links code from open-source libraries such as libcurl (version 7.47.1) and zLib (version 0.15).

The RAT was used against victims of a watering hole campaign aimed at employees of Polish and Mexican banks, uncovered in February 2017, and is typically loaded via HOTWAX.

Source: Malpedia (Fraunhofer FKIE).