Extracted

• • Target
    암호.txt.lnk
  • Size 2KB
  • SHA256 649c3785a4dcc56696bb3b66f7e0bde308312649a6731d3c04de4a2d9a043b5b
  • MD5 d7c9e7032995833fbfee782efa334a14
  • SHA1 143373a4a05897bf5cc392b4f58e69c9acd2ec16
  • SHA512 40202a7041fe7978a820e3196ec5cabf1715f3e4fdfdf3f3766f733868476f3c7f3378bd0a77d5eba0bb8dd35f8ac2c9e0c9dcca5bf5d07310770c78d45a34e3
  • TLSH
    T10A5111160BF6136DE373CB766BFAF2896222F820AA074AEC41C152406D50604F877F7E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionpersistencespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral1behavioral2
• • Target
    지급명령 통지서.pdf
  • Size 865KB
  • SHA256 a0cf2ec2a350f84ccb41a5a22c1f3aee16d3bbd4088b5a7961a0d450ed5e55cf
  • MD5 88f30f325caba8351450dec8d5966396
  • SHA1 38467c450c60d50b512e6d490bd9655dbb635747
  • SHA512 f925cfc0c055324fe7f0233da086c92088e01e2be580f36f8308bd1c19a754048db1ceae842258631a459e68be98857295ddf8af4d30e1f67ca6092ac4870efc
  • SSDEEP 12288:GhAoY/woHYrJR/qIGOOYQIMMmmkEdQESjb+MYkZjdspd/Bhojqg+vcWTwhQBHW:G+nzcJp1cYQIT9Sjb+M27ZhvPE1hQJW
  • TLSH
    T1DF15D0F893259890D0C10664BF2D769B81CBA0F1454BF56B6FA8C1DB0A90FD5B094FFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3behavioral4