Malware
PostNapTea
aka SIGNBT
PostNapTea aka SIGNBT is an HTTP(S) RAT that is written as a complex object-oriented project.
PostNapTea, also known as SIGNBT, is a Windows malware family operated by Lazarus Group.
Background
PostNapTea, also called SIGNBT, is an HTTP(S) RAT built as an elaborate object-oriented codebase.
Throughout 2022-2023 it was used against victims such as a newspaper company, an agriculture-related organization and a software vendor, with initial access typically gained by exploiting flaws in software broadly used in South Korea.
It harvests an assortment of host details, including computer name, product name, OS specifics, system uptime, CPU information, system locale, time zone, network status and the malware's own configuration.
Network traffic is encrypted and decrypted with AES, and its HTTP POST requests carry a fixed SIGNBT prefix. That prefix is followed by a 2-character code marking the communication stage: • LG: logging into the C&C server • KE: acknowledging the succesful login to the C&C • FI: sending the status of a failed operation • SR: sending the status of a successful operation • GC: getting the next command
Five classes correspond to the command groups: • CCButton: for file manipulation and screen capturing • CCBitmap: for network commands, implementing functionality of Windows commands often abused by attackers, like sc, reg, arp, net, ver, wmic, ping, whoami, netstat, tracert, lookup, ipconfig, systeminfo, and netsh advfirewall. • CCComboBox: for file system management • CCList: for process management • CCBrush: for control of the malware itself
Configuration is kept in JSON format, and the malware resolves the Windows APIs it needs at runtime using the Fowler–Noll–Vo (FNV) hash function.
Within the version-information resource its internal name is usually ppcsnap.dll or pconsnap.dll, which loosely inspired the code name assigned to it.
Source: Malpedia (Fraunhofer FKIE).