국내 VPN 설치파일에 포함되어 유포 중인 SparkRAT - ASEC BLOG
Tags
| maec-delivery-vectors: | Watering Hole |
| attack-pattern: | Malware - T1587.001 Malware - T1588.001 Tool - T1588.002 |
Common Information
| Type | Value |
|---|---|
| UUID | dafc7fee-126c-4a83-a39b-29432c6c5d1c |
| Fingerprint | 621318becfce7080 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | May 3, 2023, 10 a.m. |
| Added to db | May 3, 2023, 3:20 a.m. |
| Last updated | Dec. 21, 2024, 4:49 a.m. |
| Headline | 국내 VPN 설치파일에 포함되어 유포 중인 SparkRAT |
| Title | 국내 VPN 설치파일에 포함되어 유포 중인 SparkRAT - ASEC BLOG |
| Detected Hints/Tags/Attributes | 10/2/16 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://asec.ahnlab.com/ko/52076/ |
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 18 | ✔ | ASEC | https://asec.ahnlab.com/ko/feed/ | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 2 | gwekekccef.webull.day |
|
| Details | File | 2 | %localappdata%\syservices\svchost.exe |
|
| Details | File | 1199 | svchost.exe |
|
| Details | File | 2 | svch.exe |
|
| Details | File | 10 | main.ini |
|
| Details | File | 53 | 3.exe |
|
| Details | File | 2 | svh.exe |
|
| Details | md5 | 2 | 2e3ce7d90d988e1b0bb7ffce1731b04b |
|
| Details | md5 | 2 | b571d849c0cb3c7af1cee6990654972b |
|
| Details | md5 | 2 | 5b78c44262ebcb4ce52e75c331683b5b |
|
| Details | md5 | 2 | a5950704dfa60ba5362ec4a8845c25b2 |
|
| Details | md5 | 2 | 7923f9e0e28ceecdb34e924f2c04cda0 |
|
| Details | md5 | 2 | e4805cbd59fe793c48f6341f3d1e5466 |
|
| Details | md5 | 2 | 54dd763bca743cbdbdfe709d9ab1d0db |
|
| Details | IPv4 | 3 | 1.0.4.3 |
|
| Details | IPv4 | 2 | 59.22.167.217 |