![[Caution] Virus/XLS Xanpei Infecting Normal Excel Files](https://asec.ahnlab.com/wp-content/uploads/2022/04/59_5_xls_├╖║╬╞─└╧.png)
[Caution] Virus/XLS Xanpei Infecting Normal Excel Files
The ASEC analysis team has recently discovered the constant distribution of malware strains that spread the infection when Excel file is opened. Besides infecting normal Excel files, they can also perform additional malicious behaviors such as acting as a downloader and performing DNS Spoofing, therefore, users need to take great
SystemBC Being Used by Various Attackers
SystemBC is a proxy malware that has been used by various attackers for the last few years. While it is recently distributed through SmokeLoader or Emotet, this malware has steadily been used in various ransomware attacks in the past. When an attacker attempts to access a certain address with malicious
Malicious Help File Disguised as COVID-19 Infectee Notice Being Distributed in Korea
The ASEC analysis team introduced readers to malware that takes the form of a Windows help file (*.chm) about two weeks ago. The malicious CHM file that was recently discovered is disguised as a notice for people infected with COVID-19 and is being distributed to Korean users. The attacker is
Malicious Word Documents Using MS Media Player (Impersonating AhnLab)
Last week, the ASEC analysis team uploaded a post named “Malicious Word File Targeting Corporate Users Being Distributed” that contained information about a malicious Word file. Currently, documents of the same type are being distributed with text that impersonates AhnLab. The Word files confirmed this time download another Word file
APT Attack Disguised as Resume Template for North Korean Defectors (VBS Script)
The ASEC analysis team has recently discovered that a malicious info-leaking VBS is being distributed via phishing email disguised as North Korea-related material. The email is about casting calls for a North Korea-related broadcast, and a compressed file is attached to it. It asks the readers to fill out the
APT Attacks Using Word File Disguised as Donation Receipts for Uljin Wildfire (Kimsuky)
At the beginning of March this year, a wildfire broke out in the Samcheok and Wuljin area, and numerous people from all over Korea donated to help the victims and restore the damages. Amidst such a situation, the ASEC analysis team discovered the attacker’s attempt at launching APT attacks disguised
Malicious Word File Targeting Corporate Users Being Distributed
The ASEC analysis team discovered a Word file that seems to target corporate users. The file contains an image that prompts users to enable macros like other malicious files. To trick users into thinking that this is an innocuous file, it shows information related to improving Google account security when
BitRAT Disguised as Officer Installer Being Distributed
The ASEC analysis team previously uploaded a post about BitRAT that was distributed under the disguise of Windows OS license verification tool. The BitRAT is now being distributed as Office Installer with different files, preying upon potential victims. BitRAT Disguised as Windows Product Key Verification Tool Being Distributed The following
VBS Script Disguised as PDF File Being Distributed (Kimsuky)
On March 23rd, the ASEC analysis team has discovered APT attacks launched by an attack group presumed to be Kimsuky, and they targeted certain Korean companies. Upon running the script file with the VBS extension, the malware runs the innocuous PDF file that exists internally to trick the user into
APT Attack Using Word Files About Cryptocurrency (Kimsuky)
On March 21st, the ASEC analysis team has discovered the Kimsuky group’s APT attacks that use Word files containing information about cryptocurrency. A total of three Word files were discovered that were used as baits for the attacks. The macro’s author and its execution flow are identical to that which
