# Warning: NordDragonScan Malware Attacks Windows Using LOTL Techniques

Security researchers have recently discovered a new information-stealing software named "NordDragonScan," which conducts stealthy attacks on Windows computers using "living-off-the-land" (LOTL) techniques.

* **Affected Platforms**: Microsoft Windows
    
* **Affected Users**: Microsoft Windows
    
* **Impact**: Stolen information may be used for future attacks
    
* **Severity Level**: High
    

# **Initial** Vector

The attacker exploits a shortened link service with the URL “*hxxps://cutt\[.\]ly/4rnmskDe*” redirecting to “*hxxps://secfileshare\[.\]com*,” which triggers the download of a RAR file named “*Укрспецзв\_Акт\_30\_05\_25\_ДР25\_2313\_13 від 26\_02\_2025.rar*” (Ukrspetszv\_Act\_30\_05\_25\_DR25\_2313\_13 dated 26\_02\_2025). This file contains a malicious LNK shortcut that silently calls `mshta.exe` to execute the HTA payload `1.hta` from the same server.

![LNK file shortcut details](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_1374900709_cop.img.png/1751476965385/norddragon2.png align="left")

*Figure 1. LNK File*

Next, the malicious HTA file copies a legitimate PowerShell.exe file to the path “*C:\\Users\\Public\\Documents\\install.exe*” to disguise itself. It then downloads an encrypted TXT file, decrypts it, and saves the result as `Act300525.doc`. This decoy document, titled “Акт здачі-приймання наданих Послуг до договору про надання послуг” (Service Acceptance Act under the Service Agreement), is harmless and intended to distract the user. Finally, the HTA script silently downloads and executes a malicious payload, embedded as an executable file named `adblocker.exe`, into the victim's directory “*\\AppData\\Local\\Temp\\adblocker.exe*”

![HTA file content](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_1374900709_cop_1612739927.img.png/1751478648280/norddragon3.png align="left")

*Figure 2. HTA File "1.hta"*

![Decoy document from "1.hta"](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_282441299.img.png/1751487253220/norddragon4.png align="left")

*Figure 3. Decoy Document from "1.hta"*

The attacker's server maintains multiple fake files designed to entice user interaction. These decoy files use a similar HTA script mechanism, helping to download and execute the same payload, `adblocker.exe`, on compromised systems. The reuse of the same executable file across different decoy documents indicates a strategy by the attacker to maximize infection opportunities while using diverse document themes and file names to evade detection and security monitoring.

# **Analysis of the Malicious Payload**

The malicious payload downloaded from the previous phase is a *.NET* executable file containing an embedded PDB path: “*C:\\Users\\NordDragon\\Documents\\visual studio*”

NordDragonScan employs string obfuscation techniques, performing XOR operations and byte swapping to hide the code from static analysis. It then checks whether a dedicated working directory “NordDragonScan” exists in the “*%LOCALAPPDATA%*” directory. If this directory does not exist, it creates a new one to temporarily store stolen data before uploading it to the C2 server.

![Checking the directory](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_1890763147.img.png/1751488248253/norddragon9.png align="left")

*Figure 4. Checking the Directory*

Next, the malware connects to the C2 server, “*kpuszkiev.com*,” with specific HTTP headers, notably “User-Agent: RTYUghjNM,” along with the victim's MAC address. During the initial connection, the main goal is to obtain a dynamic URL from the C2, which is then used as an endpoint to extract stolen data.

![Getting the upload URL](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_1629563430.img.png/1751488313569/norddragon10.png align="left")

*Figure 5. Obtaining the URL for Data Extraction*

It then establishes persistence by adding a “NordStar” registry entry to “*Software\\Microsoft\\Windows\\CurrentVersion\\Run*”

![the NordStar Registry](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_1061941272.img.png/1751488354258/norddragon11.png align="left")

*Figure 6. Adding Registry for Auto-Launch on Startup*

# **Information Gathering Phase**

After connecting, NordDragonScan moves to the information-gathering phase on the local machine. It collects basic victim information, including computer name, username, operating system version, architecture, processor count, driver information, and RAM using a combination of WMI and .NET commands. The attacker then lists all active network adapters, extracts the primary IPv4 address and subnet mask, and calculates the CIDR range. The malware then begins a slow scan of each address within the same subnet, creating a catalog of accessible hosts on the same LAN.

![Getting networking information](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_143715479.img.png/1751488384851/norddragon12.png align="left")

*Figure 7. Gathering Network Information*

![Scanning the network](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_1463121042.img.png/1751488400059/norddragon13.png align="left")

*Figure 8. Network Scanning*

It also captures a screenshot and saves it as “SPicture.png” and collects data from Chrome and Firefox browsers on the victim's machine.

![Copying Chrome data into “Chrm”](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_865504826.img.png/1751488421272/norddragon14.png align="left")

*Figure 9 Copying Chrome Data into “Chrm”*

![Copying Firefox data](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_830339745.img.png/1751488443762/norddragon15.png align="left")

*Figure 10. Copying Firefox Data*

NordDragonScan continues to scan the local file system, including Desktop, Documents, and Downloads folders, and copies files in these directories with the following extensions: “.docx,” “.doc,” “.xls,” “.ovpn,” “.rdp,” “.txt,” and “.pdf.” Once a matching file is found, it copies it into the working directory and groups them by file origin. When the scanning phase is complete, it makes a POST request to the C2 server. This request uses a custom header “User-Agent: Upload,” or “Backups:,” and the name of the data it is preparing to send, such as “sysinfo.txt” for system information.

![Stolen data in the working directory](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_965759785.img.png/1751488461602/norddragon16.png align="left")

*Figure 11. Stolen Data in the Working Directory*

![Uploading system information](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows/_jcr_content/root/responsivegrid/table_content/par/image_569896282.img.png/1751488490833/norddragon17.png align="left")

*Figure 12. POST Request Sent by Malware to C2 Server*

# **List of IOCs Related to NordDragonScan Malware**

## **Domain**

| **secfileshare\[.\]com** |
| --- |
| kpuszkiev\[.\]com |

## **Hash**

| **Value** | **Type** | **Description** |  |
| --- | --- | --- | --- |
| 2102c2178000f8c63d01fd9199400885d1449501337c4f9f51b7e444aa6fbf50 | SHA256 | File RAR hash |  |
| e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725 | SHA256 | File RAR hash |  |
| 3f3e367d673cac778f3f562d0792e4829a919766460ae948ab2594d922a0edae | SHA256 | File RAR hash |  |
| f8403e30dd495561dc0674a3b1aedaea5d6839808428069d98e30e19bd6dc045 | SHA256 | File HTA hash |  |
| fbffe681c61f9bba4c7abcb6e8fe09ef4d28166a10bfeb73281f874d84f69b3d | SHA256 | File HTA hash |  |
| 39c68962a6b0963b56085a0f1a2af25c7974a167b650cf99eb1acd433ecb772b | SHA256 | File HTA hash |  |
| 9d1f587b1bd2cce1a14a1423a77eb746d126e1982a0a794f6b870a2d7178bd2c | SHA256 | File HTA hash |  |
| 7b2b757e09fa36f817568787f9eae8ca732dd372853bf13ea50649dbb62f0c5b | SHA256 | File HTA hash |  |
| f4f6beea11f21a053d27d719dab711a482ba0e2e42d160cefdbdad7a958b93d0 | SHA256 | File executable hash |  |

# **Recommendations**

FPT Threat Intelligence recommends organizations and individuals take several measures to prevent information-stealing software (infostealer) like NordDragonScan and similar variants:

* **Enhance Email and Download Control:** Implement strict email filtering policies to prevent downloading suspicious compressed files (.rar, .zip) or dangerous HTA scripts (.hta).
    
* **Monitor System Execution Behavior:** Continuously monitor system processes that may be abused, such as `mshta.exe`, `PowerShell.exe`, `rundll32.exe`, and suspicious behaviors like remote file decryption, creating executables in temporary folders, setting registry entries for persistence, or communicating with Command & Control (C2) servers.
    
* **Protect Browser Data and Sensitive Information:** Avoid saving automatic login information in Chrome or Firefox browsers.
    
* **Configure File and System Access Policies Appropriately:** Apply restricted write and execute permissions in directories commonly exploited by malware, such as `%LOCALAPPDATA%`, `%TEMP%`. Enhance monitoring of sensitive file formats like `.docx`, `.pdf`, `.xls`, `.ovpn`, `.rdp` to prevent data leakage.
    
* **Conduct Security Awareness Training for End Users:** Equip users with knowledge to identify fake shortcut files, document spoofing techniques, and habits to thoroughly check file origins before opening. Emphasize the importance of not installing software from shortened links or untrusted sharing sites.
    
* **Establish Intrusion Detection and Monitoring Systems:** Monitor outbound network traffic to detect unusual data transmission to C2 servers, uncommon HTTP headers, or behaviors related to beaconing/heartbeat to unknown domains.
    

# **References**

* [**NordDragonScan: Quiet Data-Harvester on Windows**](https://www.fortinet.com/blog/threat-research/norddragonscan-quiet-data-harvester-on-windows)