CHM Impersonates Korean Financial Institutes and Insurance Companies - ASEC BLOG
Tags
| maec-delivery-vectors: | Watering Hole |
| attack-pattern: | Javascript - T1059.007 Malicious File - T1204.002 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Powershell - T1086 Scripting - T1064 Scripting |
Common Information
| Type | Value |
|---|---|
| UUID | fea797cb-b5fa-4c26-917c-64c36befe795 |
| Fingerprint | 8c623aba0df79f8a |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | July 28, 2023, 8:05 a.m. |
| Added to db | July 28, 2023, 2 a.m. |
| Last updated | Oct. 6, 2024, 9:15 p.m. |
| Headline | CHM Impersonates Korean Financial Institutes and Insurance Companies |
| Title | CHM Impersonates Korean Financial Institutes and Insurance Companies - ASEC BLOG |
| Detected Hints/Tags/Attributes | 28/2/15 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://asec.ahnlab.com/en/55569/ |
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 17 | ✔ | ASEC | https://asec.ahnlab.com/en/feed/ | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 4 | ppangz.mom |
|
| Details | Domain | 7 | atusay.lat |
|
| Details | Domain | 4 | labimy.ink |
|
| Details | Domain | 4 | crilts.cfd |
|
| Details | File | 4 | docs.js |
|
| Details | File | 2 | c:\users\public\libraries\docs.js |
|
| Details | File | 50 | alg.exe |
|
| Details | md5 | 5 | aaeb059d62c448cbea4cf96f1bbf9efa |
|
| Details | md5 | 4 | 59a924bb5cb286420edebf8d30ee424b |
|
| Details | md5 | 4 | 0f27c6e760c2a530ee59d955c566f6da |
|
| Details | md5 | 4 | bfe2a0504f7fb1326128763644c88d37 |
|
| Details | Url | 4 | https://ppangz.mom/mjifi |
|
| Details | Url | 7 | https://atusay.lat/kxydo |
|
| Details | Url | 4 | https://labimy.ink/rskme |
|
| Details | Url | 4 | https://crilts.cfd/cdeeb |