Extracted

• • Target
    국세 고지서.pdf
  • Size 125KB
  • SHA256 1d01eab612da7d635e6b92395ead126e3e07b7987b3a38c8831e25cbcd5456b7
  • MD5 425e7f14bfef366725fb806c93a0e94e
  • SHA1 717bd6595a1fe3e708cabca7b27fee872d969cac
  • SHA512 f7b2b1b9f59930850f2eae5ef3bd260d037797efbca2584664f1a8a0a3d1d68ae5fbaed682ea40885c8e26fb91717cf4e89dc57c473cc47a1bf02c4e73597067
  • SSDEEP 3072:YCPMa+GMy/jHAmHbbwAPcFHqID/Pzgqfo/VYl:vPuGMuZbwpD/PzbfMVYl
  • TLSH
    T129C3E1A813348859E4596665FB00ADAE45DE30F9494F71963E3C85CE078AF23B070EFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    암호.txt.lnk
  • Size 2KB
  • SHA256 979f8f4a9c03463fd1da53f0cf821ffa8cfdfc70b8cade1c71705b3d49e0aaa9
  • MD5 520ea3a423faea050e68bbadc69dd7e3
  • SHA1 d383203d15d16ff7d87c0172a71d6965b4d2c0b4
  • SHA512 2ff56cc41061922579924ef4577c0697141e8c762a5c9e7c9e84a227ea932c61b4070d2e2cf3a7f445b0d7c2322110fef171f9d2f6a9a2976116046fab46f242
  • TLSH
    T1085144161AE613AEE373977657FAF20A6122F874AB074EEC01C152401E50604F876F7F
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionpersistencespywarestealertrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral3behavioral4