Tracking Process Hollowing Malware Using EDR

Posted By ,

AhnLab Security Emergency response Center (ASEC) once released a report on the types and distribution trends of .NET packers as shown in the post below. As indicated in the report, most .NET packers do not create actual malicious executables hidden via packing features in the local path, injecting malware in normal processes to run them instead.  .NET packers are being exploited as initial distribution files or as mid-process loaders for various malware types such as Remcos, FormBook, ScrubCypt, AsyncRAT, etc. It…

Tracking Traces of Malware Disguised as Hancom Office Document File and Being Distributed (RedEyes)

Posted By ,

AhnLab Security Emergency response Center (ASEC) has confirmed the distribution of malware disguised as Hancom Office document files. The malware that is being distributed is named “Who and What Threatens the World (Column).exe” and is designed to deceive users by using an icon that is similar to that of Hancom Office. Decompressing the compressed file reveals a relatively large file with a size of 36,466,238 bytes. AhnLab Endpoint Detection and Response (EDR) is capable of detecting such attack techniques through its…

ASEC Weekly Phishing Email Threat Trends (May 14th, 2023 – May 20th, 2023)

Posted By ,

AhnLab Security Emergency response Center (ASEC) monitors phishing email threats with the ASEC automatic sample analysis system (RAPIT) and honeypot. This post will cover the cases of distribution of phishing emails during the week from May 14th, 2023 to May 20th, 2023 and provide statistical information on each type. Generally, phishing is cited as an attack that leaks users’ login account credentials by disguising as or impersonating an institute, company, or individual through social engineering methods. On a broader note,…

Analysis of Attack Cases: From Korean VPN Installations to MeshAgent Infections

Posted By ,

AhnLab Security Emergency response Center (ASEC) has previously covered the case where SparkRAT was distributed contained within a Korean VPN’s installer in the post, “SparkRAT Being Distributed Within a Korean VPN Installer”[1]. This VPN was commonly installed by Chinese users who required better access to the Internet, and the problem was addressed after the blog post was uploaded. However, there have been recent cases indicating the resurgence of malware distributing SparkRAT through the installer of the same VPN company. The…

ASEC Weekly Malware Statistics (May 15th, 2023 – May 21st, 2023)

Posted By ,

AhnLab Security Emergency response Center (ASEC) uses the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from May 15th, 2023 (Monday) to May 21st, 2023 (Sunday). For the main category, Infostealer ranked top with 43.8%, followed by downloader with 36.9%, backdoor with 15.3%, ransomware with 3.4%, and CoinMiner with 0.6%. Top 1 – Amadey This week, Amadey Bot ranked first place with 25.6%. Amadey is a downloader that can…