wAgentTea
Aliases: wAgent
- First seen
- 2020-10-01 00:00:00
- Malware type
- downloader
- Family
- Malware family
- Last IoC activity
- 2026-07-21 04:43:38
- Profile updated
- 2026-07-07 14:29:53
Targeted industries: healthcare-and-pharmaceutical manufacturing
Targeted regions: country_code:kr
Context
wAgentTea is an HTTP(S) downloader. It was deployed mostly against South Korean targets like a pharmaceutical company (Q4 2020) or semiconductor industry (Q2 2023). In several cases, the initial access was obtained via exploitation of South Korean software like Initech's INISAFE CrossWeb EX or Dream Security’s MagicLine4NX. It uses AES-128 for encryption and decryption of its network traffic, and for decryption of its binary configuration. There is a hard-coded list of parameter names used in its HTTP POST request: identy;tname;blogdata;content;thesis;method;bbs;level;maincode;tab;idx;tb;isbn;entry;doc; category;articles;portal It contains a specific RTTI symbol ".?AVCHttp_socket@@".
Reports & references
- virusbulletin.com — Lazarus Campaigns And Backdoors In 2022 2023 (report)
- wiz.io — North Korean Tradertraitor Crypto Heist (report)
- Kaspersky — 116326 (report)
- Kaspersky — 99906 (report)
- asec.ahnlab.com — 20231013 Lazarus Op.Dream Magic (report)
- asec.ahnlab.com — 33801 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Wagenttea (report)