PostNapTea
Aliases: SIGNBT
- First seen
- 2022-01-01 00:00:00
- Malware type
- rat, screen-capture
- Family
- Malware family
- Profile updated
- 2026-07-07 14:29:49
Targeted industries: media-and-entertainment technology-and-telecommunications
Targeted regions: country_code:kr
Context
PostNapTea aka SIGNBT is an HTTP(S) RAT that is written as a complex object-oriented project. In 2022-2023, it was deployed against targets like a newspaper organization, agriculture-related entity or a software vendor. The initial access was usually achieved by exploiting vulnerabilities in widely-used software in South Korea. It collects various information about the victim’s computer, such as computer name, product name, OS details, system uptime, CPU information, system locale, time zone, network status, and malware configuration. PostNapTea uses AES for encryption and decryption ot network traffic. There is a constant prefix SIGNBT occuring in its HTTP POST requests. The prefix is concatenated with 2 characters that identify the communication stage: • LG: logging into the C&C server • KE: acknowledging the succesful login to the C&C • FI: sending the status of a failed operation • SR: sending the status of a successful operation • GC: getting the next command There are five classes that represent command groups: • CCButton: for file manipulation and screen capturing • CCBitmap: for network commands, implementing functionality of Windows commands often abused by attackers, like sc, reg, arp, net, ver, wmic, ping, whoami, netstat, tracert, lookup, ipconfig, systeminfo, and netsh advfirewall. • CCComboBox: for file system management • CCList: for process management • CCBrush: for control of the malware itself It stores its configuration in JSON format. It resolves the Windows APIs it requires during runtime, via the Fowler–Noll–Vo (FNV) hash function. Its internal name in the version-information resource is usually ppcsnap.dll or pconsnap.dll, which loosely inspired its code name.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Postnaptea_Auto (yara-rule)
Reports & references
- virusbulletin.com — Lazarus Campaigns And Backdoors In 2022 2023 (report)
- wiz.io — North Korean Tradertraitor Crypto Heist (report)
- Kaspersky — 116326 (report)
- Kaspersky — 110888 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Postnaptea (report)