Extracted

• • Target
    6월 신고 납부기한 통지서.pdf
  • Size 125KB
  • SHA256 1d01eab612da7d635e6b92395ead126e3e07b7987b3a38c8831e25cbcd5456b7
  • MD5 425e7f14bfef366725fb806c93a0e94e
  • SHA1 717bd6595a1fe3e708cabca7b27fee872d969cac
  • SHA512 f7b2b1b9f59930850f2eae5ef3bd260d037797efbca2584664f1a8a0a3d1d68ae5fbaed682ea40885c8e26fb91717cf4e89dc57c473cc47a1bf02c4e73597067
  • SSDEEP 3072:YCPMa+GMy/jHAmHbbwAPcFHqID/Pzgqfo/VYl:vPuGMuZbwpD/PzbfMVYl
  • TLSH
    T129C3E1A813348859E4596665FB00ADAE45DE30F9494F71963E3C85CE078AF23B070EFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    암호.txt.lnk
  • Size 2KB
  • SHA256 d6226ff1c96bff8cc840fb62db0a6bead9d029b7915436db87a1882332054c82
  • MD5 1e85cfa72fd753f1cd9d8db6845c946f
  • SHA1 92f59aa6a46937456c0272bdbc45ec03e5331a92
  • SHA512 ee233f553ed3e4b3c7676d48168ffc8fe9f5dfef807b5a81d9839b640ab735041e87baf83413c59ea50a491423e290b07b29fc778d363400f8f6bdfaa10ecc04
  • TLSH
    T1295141011FE602BEF373C77A27FABB099520F574DB0759AC41C06244AEA0A04F875B2E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionpersistenceransomwarespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral3behavioral4