Extracted

• • Target
    7월 신고 납부기한 통지서.pdf.lnk
  • Size 2KB
  • SHA256 0ba78b693744c5f3b45a1b9e9e96479f51701590aa36c7dbd24cb9abcdc2d410
  • MD5 e9b4f25301f870abc01fa7051d96374d
  • SHA1 4465cdc8d7cd142fa0f9e7c3b184385f6109cf83
  • SHA512 2495eec95cf11c909cbe32f318edfcfab9ae46631fcdeb3ecd1aa85b57566763872ded10c3f6a0c7bcebf6dcf87792741d8b94b4bfe678bd52a3ff40b135ec5c
  • TLSH
    T1335110122EF602A9F373D77257FBB2196637F8249B03099C40D242001D51A18E87AFBB
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionpersistencespywarestealertrojandiscovery

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2