Skip to content
MalwareWiki

Malware

ImprudentCook

ImprudentCook is an HTTP(S) downloader. It was delivered in the Operation DreamJob type of activity targeting aerospace and defense companies in South Africa (in Q2 2022) and in Central Europe (in H1

ImprudentCook is a Windows malware family operated by Lazarus Group.

Background

ImprudentCook is an HTTP(S) downloader.

It featured in Operation DreamJob-style activity aimed at aerospace and defense firms in South Africa (Q2 2022) and Central Europe (H1 2023), as well as against an unidentified sector in South Korea back in Q2 2021.

For decrypting its binary configuration and for securing client-server traffic in both directions, it relies on the AES cipher provided by Windows Cryptographic Providers.

It is concealed inside an ADS stream (:dat or :zone) of its dropper, alongside its configuration (:rsrc) and an AES-128 CBC key with an initialization vector used for decryption (:kgb or :data).

It contains two characteristic arrays of strings that represent cookie names for web services, including Bing, Daum and GitHub:

  1. iKc;__uid;OAX;DMP_UID;PCID;gid;gat;csrftoken;NID;1P_JAR;JSESSIONID;WLS;SNID; utma;BID;SRCHD;GsCK_AC;spintop;eader;XSRF-TOKEN;gat_gtag_UA;webid enabled;EDGE_V;dtck_channel;dtmulti;UUID;XUID;ZIA;IUID;SSID;_gh_sess;_octo

  2. channel;post_titles;xfw_exp;wiht_clkey;SGPCOUPLE;NRTK;fbp;uaid;SRCHUSR;GUC;HPVN;dtck_ blog;dtck_media;MUIDB;SRCHHPGUSR;SiteMain

It contains a string, "5.40" or "5.60", looking like version information.

Source: Malpedia (Fraunhofer FKIE).