APT-C-55（Kimsuky）组织假借“生日祝福”为诱饵分发Quasar RAT的攻击活动分析
Tags
Common Information
| Type | Value |
|---|---|
| UUID | 11fdaec4-9429-4ce3-bf95-f0adfcbcd0f0 |
| Fingerprint | 65b466d11799da26 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Feb. 21, 2022, midnight |
| Added to db | June 5, 2023, 2:44 p.m. |
| Last updated | Nov. 17, 2024, 5:57 p.m. |
| Headline | APT-C-55（Kimsuky）组织假借“生日祝福”为诱饵分发Quasar RAT的攻击活动分析 |
| Title | APT-C-55（Kimsuky）组织假借“生日祝福”为诱饵分发Quasar RAT的攻击活动分析 |
| Detected Hints/Tags/Attributes | 5/0/37 |
Source URLs
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 265 | ✔ | 360数字安全 | https://wechat2rss.xlab.app/feed/85e7bf4fe192ded1a15f130aa43ac306d227f61b.xml | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 194 | drive.google.com |
|
| Details | Domain | 189 | asec.ahnlab.com |
|
| Details | File | 1 | 通过loader将quasarrat加载到caspol.exe |
|
| Details | File | 1 | 下载的载荷是名为runrunlastrun.vbs |
|
| Details | File | 1 | c:\windows\syswow64\复制powershell.exe |
|
| Details | File | 1 | 和wscript.exe |
|
| Details | File | 1 | winappversion.ini |
|
| Details | File | 3 | runps.vbs |
|
| Details | File | 3 | conf.ps1 |
|
| Details | File | 1 | 并运行runps.vbs |
|
| Details | File | 1 | 该命令通过powershell执行conf.ps1 |
|
| Details | File | 1 | 该脚本使用wscript.exe |
|
| Details | File | 1 | 执行winappversion.ini |
|
| Details | File | 1 | runrunlastrun.vbs |
|
| Details | File | 1 | runlastrun.ps1 |
|
| Details | File | 14 | caspol.exe |
|
| Details | md5 | 1 | C63336057F756C711C594E8B59B0265F |
|
| Details | md5 | 1 | 29652A5599AAB8088D8BFD453471FEFD |
|
| Details | md5 | 1 | 9E2D09F47CC48DD3E84205376A8F9ECB |
|
| Details | md5 | 1 | 81424820BDF139B1FE3DE3FAA4E98AE6 |
|
| Details | md5 | 1 | 2DA5816578795BE004AD5D4190276A7F |
|
| Details | md5 | 1 | CE161ED698C71AD9BEBB737F301B2B89 |
|
| Details | md5 | 1 | 86A2CF6525C30C9D39CD6A4B0F67670B |
|
| Details | md5 | 1 | 8e35c04988a1ff196a12624139918f94 |
|
| Details | md5 | 1 | F667BF120D5760845FCDD2F02254EFF4 |
|
| Details | md5 | 1 | A9106A7C36418B9E4A19D0C7CC654E46 |
|
| Details | md5 | 1 | C26E3C33D2F3A5A13282EEE6E764BD79 |
|
| Details | md5 | 2 | 9D8C438B710B314B2DC2E003B2F177B7 |
|
| Details | IPv4 | 12 | 1.3.0.0 |
|
| Details | Pdb | 1 | o:\work\virusattack\processhollowingcsharp\processhollowingcsharp\obj\x86\release\processhollowingcsharp.pdb |
|
| Details | Threat Actor Identifier - APT-C | 15 | APT-C-55 |
|
| Details | Url | 1 | https://drive.google.com/uc?export=download&id=1wkzc_xz_qdqdwnircl3kmmpxffkaesg8&confirm=t）下载载荷并执行。最后，该脚本使用wscript.exe执行winappversion.ini文件 |
|
| Details | Url | 1 | https://drive.google.com/uc?export=download&id=1ovbe1se3rh9wh1lyt1ob1ngpdtjjw1yf&confirm=t |
|
| Details | Url | 1 | https://drive.google.com/uc?export=download&id=1wkzc_xz_qdqdwnircl3kmmpxffkaesg8&confirm=t |
|
| Details | Url | 1 | https://drive.google.com/uc?export=download&id=1gufzch1fsssqz_xf8hwolgqhsygbtnk9&confirm=t |
|
| Details | Url | 1 | https://drive.google.com/uc?export=download&id=1fjt46ezrfwakdam |
|
| Details | Url | 2 | https://asec.ahnlab.com/en/31089 |