Distribution of Hangul Word Processor File (HWP) during Academic Conference Season in Korea - ASEC BLOG
Tags
| country: | Pakistan |
| attack-pattern: | Malicious File - T1204.002 Malware - T1587.001 Malware - T1588.001 Software - T1592.002 |
Common Information
| Type | Value |
|---|---|
| UUID | 29b2cfe1-a541-4ec8-a3f1-08450fb0a4e1 |
| Fingerprint | b4fc380b2df544c3 |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | June 4, 2020, 3:50 p.m. |
| Added to db | Sept. 11, 2022, 4:59 p.m. |
| Last updated | Dec. 26, 2024, 9:05 a.m. |
| Headline | Distribution of Hangul Word Processor File (HWP) during Academic Conference Season in Korea |
| Title | Distribution of Hangul Word Processor File (HWP) during Academic Conference Season in Korea - ASEC BLOG |
| Detected Hints/Tags/Attributes | 27/2/15 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://asec.ahnlab.com/en/17443/ |
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 5 | resulview.com |
|
| Details | File | 11 | no1.bat |
|
| Details | File | 10 | vbs.txt |
|
| Details | File | 10 | no1.txt |
|
| Details | File | 24 | start.vbs |
|
| Details | File | 106 | upload.php |
|
| Details | File | 9 | temprun.bat |
|
| Details | File | 4 | pakistan.txt |
|
| Details | File | 13 | %computername%.txt |
|
| Details | File | 4 | mdp.exe |
|
| Details | Url | 2 | http://resulview.com/5hado/no1.txt |
|
| Details | Url | 4 | http://resulview.com/5hado/vbs.txt |
|
| Details | Url | 2 | http://resulview.com/5hadr/upload.php |
|
| Details | Url | 2 | http://resulview.com/5hado/%computername%.txt |
|
| Details | Windows Registry Key | 200 | HKCU\Software\Microsoft\Windows\CurrentVersion\Run |