Kimsuky 5
Contents
Introduction
Kimsuky Waiting Period
Have you ever wondered how the APT evolve its tactics over time? Today, we embark on a new series exploring this question where we look at how the Kimsuky APT has developed over time by looking at the different TTP it employed in past and how it evolved.
The said sample we’re analysing today is not long back. We’re going to look into a sample from 2019 which employs a simple technique called “Masquerading” which gives a file two extensions. The file we have , has the name “베트남 녹지원 상춘재 행사 견적서.hwp .exe”. The HWP extension is nothing but Hangul Word Processor or think of it was Microsoft Word but for Korea.
On translating we find that the file name is “Vietnam Green Garden Sangchunjae Event Quotation Form.hwp .exe”. This sounds like a authentic document which was used in Social Engineering. On quick google search we can find that …
Kimsuky Waiting Period
Have you ever wondered how the APT evolve its tactics over time? Today, we embark on a new series exploring this question where we look at how the Kimsuky APT has developed over time by looking at the different TTP it employed in past and how it evolved.
The said sample we’re analysing today is not long back. We’re going to look into a sample from 2019 which employs a simple technique called “Masquerading” which gives a file two extensions. The file we have , has the name “베트남 녹지원 상춘재 행사 견적서.hwp .exe”. The HWP extension is nothing but Hangul Word Processor or think of it was Microsoft Word but for Korea.
On translating we find that the file name is “Vietnam Green Garden Sangchunjae Event Quotation Form.hwp .exe”. This sounds like a authentic document which was used in Social Engineering. On quick google search we can find that …
IoC
03c35e4c6a641373db665e7d58cea421188fbc82
1050935f6acee3afda3876478718632b968c986eb9c59fc2e27599c1515515f5
114.207.244.99
35d60d2723c649c97b414b3cb701df1c
6dfce07abc39e5d6aebd74a1850ad65cc6ce10a8540b551c4f6d441ec4cf48ab
9944ce9354fb8961826339770ffc118000058271
e54b370d96ca0e2ecc083c2d42f05210
http://antichrist.or.kr/data/cheditor/dir1/F.php
1050935f6acee3afda3876478718632b968c986eb9c59fc2e27599c1515515f5
114.207.244.99
35d60d2723c649c97b414b3cb701df1c
6dfce07abc39e5d6aebd74a1850ad65cc6ce10a8540b551c4f6d441ec4cf48ab
9944ce9354fb8961826339770ffc118000058271
e54b370d96ca0e2ecc083c2d42f05210
http://antichrist.or.kr/data/cheditor/dir1/F.php