RAT
Kaolin RAT
aka KaolinTea
Kaolin RAT is a complex modular RAT, with Release_TMain_x64.dll as its internal DLL name.
Kaolin RAT, also known as KaolinTea, is a Windows rat operated by Lazarus Group.
Background
Kaolin RAT is an intricate modular RAT whose internal DLL name is Release_TMain_x64.dll.
It offers the usual backdoor features, such as listing and manipulating files and processes, swapping out its configuration, gathering the victim's system details, establishing a TCP connection, and running local commands while capturing their output.
It can also load extra DLL payloads directly in memory through dedicated exported functions:
- _DoMyFunc,
- _DoMyFunc2,
- _DoMyThread,
- _DoMyCommandWork.
For its networking and exfiltration work, Kaolin RAT depends on a bundled trojanized curl library, importing functions including:
- SendDataFromURL,
- ZipFolder,
- UnzipStr,
- curl wrappers.
C&C traffic is protected with AES encryption, and to dodge network detection the malware fills its POST request parameters with words chosen at random from a hardcoded custom dictionary; one of those words ("kaolin") gave the family its name. In Lazarus operations, Kaolin RAT has appeared as a late-stage payload, usually delivered after loaders such as RollFling, RollSling, and RollMid, and it also acts as a delivery mechanism for the FudModule rootkit paired with a 0-day exploit.
Source: Malpedia (Fraunhofer FKIE).