Extracted

• • Target
    암호.txt.lnk
  • Size 2KB
  • SHA256 c959bce53a371baa50f81eea003b933ae7a98a34fda7b0a91425eff06780d5ef
  • MD5 6ce51d47a69a7c3f0e8f29bea41b843a
  • SHA1 606e6c7eccd19f15603962f405dd9f0534697f7e
  • SHA512 ae3c36ab5e98a1e9c62e56d8095cbb775e416bc26ed7168de21f6f9c9295ff135180ff443f2dadd650325446f0d85b20cbf6518997f5e6077b8176d84893666f
  • TLSH
    T18D5153010EF60269D273C73A6BFAF7029531F810DA079EEC01C01644AC90A08F8B6F2E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionpersistenceransomwarespywarestealertrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2
• • Target
    최근 5년간 국세환급금 조회 지급.pdf
  • Size 1.0MB
  • SHA256 21117589cea85fc571cd3c583470071113434aa487a08d5abee3d4b5aab6b3aa
  • MD5 9f7d8cbc031f49b889aab83ec08d62a7
  • SHA1 82f39a9f6e94902972536e6ac81011f4c0c9d2e7
  • SHA512 643cff81906ea604cd33d62b692878a9b2ce3856addb954acff4324eaa77ad68fb5ae0205f8b2a68f0e2c487f75c025dacef90b7d755893ed7f276076b5ec220
  • SSDEEP 24576:OkXHMgSqkD6wEdkiob6JwSuQhO1sMemxbD2retw7:xMgrwvYkJTQhO1sMdbk
  • TLSH
    T1782523C70AAD8CD049A265787A0C4E6701EB67E2A5CE26176B1487D50302EC3E577FEF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3behavioral4