2026-07-21상세분석보고서게임업계대상MoonPeak감염사례분석.pdf (1 MB)

A malicious LNK disguised as a game-character design file launches a multistage PowerShell infection chain that checks the analysis environment and collects system information. The malware generates aes.js at runtime to steal cookies for command-and-control activity, establishes scheduled-task persistence, and downloads additional payloads. A GZIP payload disguised as an RTF file ultimately loads MoonPeak, a XenoRAT-based malware variant, while asynchronous socket communications and a mutex shared with earlier MoonPeak samples reinforce the identification.