EDR Product Analysis of an Infostealer
AhnLab Security Emergency response Center (ASEC) released an analysis report on an Infostealer that is being distributed through YouTube. Infostealer Being Distributed via YouTube As mentioned in the report, an Infostealer is being distributed through various platforms, and the leaked information is causing both direct and indirect harm to users.
Emotet Being Distributed via OneNote
AhnLab Security Emergency response Center (ASEC) has recently discovered the distribution of Emotet being distributed via OneNote. A spear phishing email as below attached with a OneNote file prompts the reader to open the attachment which contains a malicious script file (JS file). Upon running the OneNote file, it directs
Kimsuky Group Uses ADS to Conceal Malware
AhnLab Security Emergency response Center (ASEC) has discovered that the Kimsuky group is using Alternate Data Stream (ADS) to hide their malware. This malware is an Infostealer that collects data by starting the VBScript included inside an HTML file. It can be characterized by its tendency to add the actual
ASEC Weekly Phishing Email Threat Trends (March 12th, 2023 – March 18th, 2023)
AhnLab Security Emergency response Center (ASEC) monitors phishing email threats with the ASEC automatic sample analysis system (RAPIT) and honeypot. This post will cover the cases of distribution of phishing emails during the week from March 12th, 2023 to March 18th, 2023 and provide statistical information on each type. Generally,
Microsoft Office Outlook Vulnerability (CVE-2023-23397) Appearance and Manual Measure Guide
AhnLab Security Emergency response Center (ASEC) recently published a notice about a Microsoft Office Outlook vulnerability. Warning for Microsoft Office Outlook Privilege Escalation Vulnerability (CVE-2023-23397) CVE-2023-23397 is a vulnerability that leaks a user’s account credentials upon receiving an email and triggering a notification. The stolen information includes the ‘NTLM’
Kimsuky Group Distributes Malware Disguised as Profile Template (GitHub)
AhnLab Security Emergency response Center (ASEC) has confirmed the distribution of a malicious Word file disguised as a profile template from emails impersonating a certain professor. ‘[Attachment] Profile Template.doc’ is the filename of the password-protected Word file that was discovered, with the password itself being included in the body of
Tracking the CHM Malware Using EDR
AhnLab Security Emergency response Center (ASEC) has shared an APT attack case that has recently used CHM (Compiled HTML Help File). Malware Distributed Disguised as a Password File CHM is a Help screen that is in an HTML format. Threat actors are able to input malicious scrip codes in HTMLs
New Infostealer LummaC2 Being Distributed Disguised As Illegal Cracks
A new Infostealer called “LummaC2” is being distributed disguised as illegal programs such as cracks and keygens. Other malware such as CryptBot, RedLine, Vidar, and RecordBreaker (Raccoon V2) are distributed in a similar manner and have been covered here on ASEC Blog. Modified CryptBot Infostealer Being Distributed New Info-stealer Disguised
Warning for MagicLine4NX (Certificate Solution) Vulnerability and Update Recommended
Vulnerable Software and Overview MagicLine4NX is a non-ActiveX joint certificate program developed by the Korean company, Dream Security. Users can use MagicLine4NX to perform logins with a joint certificate and digitally sign transactions. This program is registered as a Startup Program and will be relaunched by a certain service
OneNote Malware Disguised as Compensation Form (Kimsuky)
AhnLab Security Emergency response Center (ASEC) has discovered the distribution of a OneNote malware disguised as a form related to compensation. The confirmed file is impersonating the same research center as the LNK-type malware covered in the post below. Based on the identical malicious activity performed by the VBS files,
