북한 김수키(Kimsuky)양도소득 과세표준 신고 및 납부계산서 로 위장한 악성코드-out.lnk(2024.11.26)
Tags
| attack-pattern: | Powershell - T1059.001 Software - T1592.002 Powershell - T1086 |
Common Information
| Type | Value |
|---|---|
| UUID | b552c2d0-ac66-4450-950e-285a99e0bf92 |
| Fingerprint | e6772f4a10ad41b6 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Nov. 27, 2024, 2:53 p.m. |
| Added to db | Nov. 27, 2024, 7:52 a.m. |
| Last updated | Dec. 4, 2024, 4:55 p.m. |
| Headline | 꿈을꾸는 파랑새 |
| Title | 북한 김수키(Kimsuky)양도소득 과세표준 신고 및 납부계산서 로 위장한 악성코드-out.lnk(2024.11.26) |
| Detected Hints/Tags/Attributes | 22/1/23 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://wezard4u.tistory.com/429342 |
| Details | Source | http://wezard4u.tistory.com/429342 |
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 478 | ✔ | 꿈을꾸는 파랑새 | https://wezard4u.tistory.com/feed | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 1 | pi.com |
|
| Details | Domain | 1 | system.co |
|
| Details | File | 1 | 납부계산서.pdf |
|
| Details | File | 4 | chrome.ps1 |
|
| Details | File | 1 | 0607online-x.txt |
|
| Details | File | 2 | system_first.ps1 |
|
| Details | File | 1 | 0607online-f.txt |
|
| Details | File | 1 | currenttime-rrr-0607online.txt |
|
| Details | File | 11 | generic.dic |
|
| Details | File | 9 | temp.ps1 |
|
| Details | File | 1 | -rrr-0607online.txt |
|
| Details | File | 11 | trojan.ps |
|
| Details | md5 | 1 | adcd2bcd43a6f495facfe31e71d4e2b8 |
|
| Details | sha1 | 1 | 4bdbf8733e178d50f1763d5999b58bb889138f43 |
|
| Details | sha256 | 1 | f5740e4027ad48231f199b18b8ae15a1343b282693ca98ae4b913fdd46472171 |
|
| Details | Microsoft Patch Numbers | 12 | KB5046740 |
|
| Details | Microsoft Patch Numbers | 16 | KB5046613 |
|
| Details | Microsoft Patch Numbers | 16 | KB5046617 |
|
| Details | Microsoft Patch Numbers | 15 | KB5046633 |
|
| Details | Url | 1 | https://content.drop"(+)"boxa"+"pi.com/2/f |
|
| Details | Url | 1 | https://dl(.)dropboxusercontent(.)com/scl/fi/g5gd7cl9g07slntq91qys/0607online-x.txt?rlkey=5z93p4sa0tvm0ueqg884ip9gy&st=fxiijkll&dl=0 |
|
| Details | Url | 3 | https://dl.dropboxusercontent |
|
| Details | Windows Registry Key | 108 | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows |