SparkRAT Being Distributed Within a Korean VPN Installer - ASEC BLOG
Common Information
Type Value
UUID 85c1f8d3-c1d6-4295-9e03-1f9c0e0f1b2c
Fingerprint bc041a6fede92600
Analysis status DONE
Considered CTI value 2
Text language
Published May 18, 2023, 8:20 a.m.
Added to db May 18, 2023, 1:50 a.m.
Last updated Dec. 21, 2024, 4:49 a.m.
Headline SparkRAT Being Distributed Within a Korean VPN Installer
Title SparkRAT Being Distributed Within a Korean VPN Installer - ASEC BLOG
Detected Hints/Tags/Attributes 33/3/16
Source URLs
RSS Feed
Attributes
Details Type #Events CTI Value
Details Domain 2
gwekekccef.webull.day
Details File 2
%localappdata%\syservices\svchost.exe
Details File 1199
svchost.exe
Details File 2
svch.exe
Details File 10
main.ini
Details File 53
3.exe
Details File 2
svh.exe
Details md5 2
2e3ce7d90d988e1b0bb7ffce1731b04b
Details md5 2
b571d849c0cb3c7af1cee6990654972b
Details md5 2
5b78c44262ebcb4ce52e75c331683b5b
Details md5 2
a5950704dfa60ba5362ec4a8845c25b2
Details md5 2
7923f9e0e28ceecdb34e924f2c04cda0
Details md5 2
e4805cbd59fe793c48f6341f3d1e5466
Details md5 2
54dd763bca743cbdbdfe709d9ab1d0db
Details IPv4 3
1.0.4.3
Details IPv4 2
59.22.167.217