2024년 08월 14일

In 2024, approximately 3 million Korean users are using Telegram. As many users use this program, threat actors are attempting to exfiltrate telegram accounts. AhnLab’s Mobile Analysis department introduces this smishing campaign that has been active since 2023 which is one of the methods for exfiltrating Telegram accounts. Figure 1.

Aug 14 2024

Threat Views

August 14, 2024

August 14, 2024 Hash 1da167f8e6924b373aa33fe045cf0bb15 21bbc21ef2cf365f49f8deb4f03bca3a2 39988f112a530ba064de892fe24129d1e URL 1http[:]//fasrpress784[.]weebly[.]com/ 2https[:]//sync[.]smart-vnc[.]com/ 3https[:]//syn[.]hiddenvnc[.]com/ IP 1117[.]245[.]3[.]194 289[.]249[.]113[.]104 314[.]191[.]0[.]39...

Aug 14 2024

Malware Networks

Weekly Detection Rule (YARA and Snort) Information – Week 3, August 2024

The following is the information on Yara and Snort rules (week 3, August 2024) collected and shared by the AhnLab TIP service. 7 YARA Rules Detection name Description Source PK_Cetelem_vara Phishing Kit impersonating Cetelem https://github.com/t4d/PhishingKit-Yara-Rules PK_Netflix_es Phishing Kit impersonating Netflix https://github.com/t4d/PhishingKit-Yara-Rules PK_WeTransfer_venza Phishing Kit impersonating WeTransfer https://github.com/t4d/PhishingKit-Yara-Rules PK_WhatsApp_arpantek Phishing Kit