Full Report
Authors: Vaibhav Krushna Billade, Dixit Panchal & Rumana Siddiqui. Table of Contents Introduction Key Targets Infection Chain Initial Campaign Findings Technical Analysis Stage 1: Initial Delivery (RAR Archive) Stage 2: Rouki-Obfuscated Batch Loader Stage 3: Startup Persistence Script Stage 4: Secondary Payload Execution Stage 5: Information Stealer Deployment (sim.py) Conclusion Seqrite Coverage Indicators of Compromise […] The post Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector appeared first on Seqrite Labs.
Analysis Summary
# Threat Actor: Unidentified (Targeting Thailand’s Healthcare Sector)
## Attribution & Identity
As of the current analysis, the threat actor remains unidentified by a specific name or alias. However, their sophisticated use of obfuscation techniques and strategic focus on critical infrastructure in Southeast Asia suggest a motivated entity, potentially with espionage or financial gain as a primary objective.
## Activity Summary
The actor has recently been observed conducting a multi-stage campaign targeting Thailand's healthcare sector. The attack leverages social engineering themed around government-approved medical equipment to lure victims into executing a complex infection chain that culminates in the deployment of a custom Python-based information stealer (`sim.py`).
## Tactics, Techniques & Procedures
The actor employs a multi-stage execution chain characterized by heavy obfuscation and the abuse of legitimate services.
* **Initial Access:** Spear phishing using malicious RAR archives named `Health_Ministry_Approved_Equipment_2026.rar`.
* **Execution & Obfuscation:**
* **Rouki-Obfuscated Batch Loaders:** Use of complex batch scripts to decrypt and execute secondary payloads.
* **File Masquerading:** Disguising batch files as `.png` or `.txt` to evade basic detection.
* **Persistence:** Establishing presence via the Windows Startup folder and Registry Run keys.
* **Defense Evasion:** Indicator removal via file deletion after execution and the use of GitHub for hosting payloads.
* **Exfiltration:** Leveraging the Telegram Bot API to exfiltrate stolen data.
**MITRE ATT&CK Mapping:**
* **T1566.001:** Spearphishing Attachment
* **T1059.003 / T1059.001:** Command and Scripting Interpreter (Shell/PowerShell)
* **T1027:** Obfuscated Files or Information
* **T1547.001:** Registry Run Keys / Startup Folder
* **T1102 / T1105:** Use of legitimate services (GitHub) for C2 activities
* **T1567.002:** Exfiltration to Web Service (Telegram)
## Targeting
* **Sectors:** Healthcare / Medical Industry.
* **Geography:** Thailand.
* **Victims:** Organizations appearing to be involved with or regulated by the Ministry of Health.
## Tools & Infrastructure
* **Malware:**
* **sim.py:** A specialized Python-based information stealer designed to harvest credentials from web browsers and local system stores.
* **Batch Scripts:** `Health_Ministry_Approved_Equipment_2026.bat`, `payload.bat`, `WindowSecuryt.bat`, `u-t2.bat`.
* **Infrastructure:**
* **Payload Hosting:** GitHub (legitimate service abuse).
* **C2/Exfiltration:** Telegram Bot API.
* **GitHub Repositories:** Used to host `Desktops.zip` and script components.
## Implications
This campaign demonstrates a high level of persistence and an intent to harvest sensitive data from critical infrastructure. By targeting the healthcare sector using government-themed lures, the actor exploits trust and urgency. The use of legitimate platforms like GitHub and Telegram for infrastructure makes detection and IP-based blocking significantly more difficult for traditional security measures.
## Mitigations
* **Email Security:** Implement strict filtering for compressed archive formats (RAR/ZIP) and inspect them for executable script content.
* **Scripting Restrictions:** Disable or strictly monitor the execution of Windows Batch and PowerShell scripts from the user profile folders.
* **Endpoint Monitoring:** Monitor for unauthorized changes to the Windows Startup folder or unexpected Registry modifications.
* **Application Whitelisting:** Prevent the execution of unknown Python binaries or scripts in environments where they are not required for business operations.
* **Network Auditing:** Audit and restrict traffic to known cloud services (GitHub, Telegram) if they are not utilized for legitimate business purposes within the corporate network.