North Korean BADCALL trojan proxy variants and Android RAT
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA reports four North Korean BADCALL malware variants that turn Windows systems into proxies and deploy Android RAT for remote access.
The U.S. Government (DHS, FBI, DoD) identified four malware variants used by North Korea's HIDDEN COBRA cyber operations. Three are 32-bit Windows executables and one DLL that function as proxy servers, using a simple XOR/ADD cipher (XOR with 0x47, add 0x28) to protect traffic. The Windows proxy malware disables the Windows firewall by modifying registry keys to open ports 8000 or 443, then listens for operator connections using hardcoded authentication strings ("1qazXSDC23we", "qwertyuiop", "ghfghjuyufgdgftr"). The malware implements a "Fake TLS" protocol by embedding public SSL certificates from legitimate services (Apple, Microsoft, Google, Facebook, etc.) without actual TLS encryption. The fourth variant is an Android APK deployed as a fully-featured RAT listening on port 60000, capable of recording calls, capturing screenshots, accessing contacts, downloading/uploading files, and executing commands. All proxy variants support relaying traffic between an operator and remote systems. Defenders should monitor for these file hashes, authentication traffic patterns, unusual firewall rule modifications, and connections on ports 8000 and 443.
Mentioned in this report
Detection guidance
Windows Firewall GloballyOpenPorts Registry Modification
Detects registry writes under the Windows Firewall GloballyOpenPorts list, the method the BADCALL proxy malware uses to open a listening port without calling netsh. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windows Firewall GloballyOpenPorts Registry Modification
description: Detects direct registry writes to the Windows Firewall GloballyOpenPorts
list. BADCALL-style proxy malware modifies firewall registry keys to open inbound
ports (8000 or 443) before listening for operator connections. Normal firewall tooling
is excluded.
tags:
- attack.defense-impairment
- attack.t1686
- attack.t1090
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains|all:
- \SharedAccess\Parameters\FirewallPolicy\
- \GloballyOpenPorts\List\
filter_system:
Image|endswith:
- \svchost.exe
- \netsh.exe
- \mpssvc.dll
condition: selection and not filter_system
falsepositives:
- Legacy applications or installers that register their own open firewall ports directly
in the registry
- Group policy or configuration management agents that write the firewall policy keys
level: medium
id: fde5ccb3-88c8-55b6-a863-cffbe1625c03
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar19-252a
Firewall Open Port Registry Entry for TCP 8000 or 443 by Non-System Process
Detects a firewall open-port registry value for TCP 8000 or 443 written by a process running from a user-writable location, matching the BADCALL proxy firewall bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firewall Open Port Registry Entry for TCP 8000 or 443 by Non-System Process
description: Detects creation of a GloballyOpenPorts or AuthorizedApplications firewall
registry entry for TCP 8000 or 443 by an executable in a user-writable path. This
matches HIDDEN COBRA proxy malware that opens these ports to accept operator connections.
tags:
- attack.defense-impairment
- attack.t1686
- attack.t1571
logsource:
category: registry_set
product: windows
detection:
selection_key:
TargetObject|contains: \SharedAccess\Parameters\FirewallPolicy\
selection_port:
TargetObject|endswith:
- \List\8000:TCP
- \List\443:TCP
selection_path:
Image|contains:
- \AppData\
- \Temp\
- \ProgramData\
- \Users\Public\
- \Windows\Debug\
condition: selection_key and selection_port and selection_path
falsepositives:
- Portable server software launched from a user profile that opens its own port 443
or 8000
level: high
id: 040fb529-2771-593a-b898-3ff1cebfc2ef
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar19-252a
Inbound Connection on TCP 8000 or 443 to Executable in User-Writable Path
Detects inbound connections to a process running from a user-writable directory on ports 8000 or 443, consistent with a proxy implant waiting for operator connections. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound Connection on TCP 8000 or 443 to Executable in User-Writable Path
description: Detects incoming network connections on local port 8000 or 443 handled
by a binary in a user-writable path. BADCALL-style proxy implants listen on these
ports and relay traffic for the operator. Requires Sysmon network connection logging
with the Initiated field.
tags:
- attack.command-and-control
- attack.t1090
- attack.t1571
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'false'
DestinationPort:
- 8000
- 443
Image|contains:
- \AppData\
- \Temp\
- \ProgramData\
- \Users\Public\
- \Windows\Debug\
filter_browsers:
Image|endswith:
- \chrome.exe
- \firefox.exe
- \msedge.exe
condition: selection and not filter_browsers
falsepositives:
- Developer web servers or portable apps listening on port 8000 from a user profile
- Per-user installed collaboration tools that accept inbound connections
level: low
id: 17224c88-3d25-5720-8771-fae0880849aa
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar19-252a
3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar19-252a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs