ASEC Weekly Malware Statistics (October 18th, 2021 – October 24th, 2021)

The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from October 18th, 2021 (Monday) to October 24th, 2021 (Sunday). For the main category, info-stealer ranked top with 62.0%, followed by Downloader with 20.2%, RAT (Remote Administration Tool) malware with 6.7%, Backdoor with 5.3%, Ransomware with 4.2%, Banking malware with 0.9%, and CoinMiner with 0.7%. Top 1 –  AgentTesla AgentTesla was ranked first with…

Malicious Excel File Disguised as an Invoice, Possibly Targeting Companies

The ASEC analysis team has recently discovered a malicious Excel file disguised as an invoice. This file is being distributed as an e-mail attachment with the filename of Invoice-[number]_date.xlsb. The following is the malicious e-mail that is being distributed in Korea. Upon running the Excel file, editing is restricted, prompting users to click the image within the file (see figure below). As the macro is designated to this image, the user must click the image for the macro to be…

Malicious HWP File with COVID-19 Relief Fund Related ‘Collection of Personal Information Consent Form’

The ASEC analysis team has discovered a malicious HWP file that hasn’t been distributed for some time. The HWP file that was last posted in April was inserted with a malicious link object inside, and it is the first time this year that a file inserted with malicious EPS was found. The file is also uploaded in VirusTotal, and judging by the fact that the filename is ‘test.hwp’ and ‘123.hwp,’ it is possible that the file was created for testing….

Coinminer Malware Distributed via Discord

While monitoring malware that is being distributed in Korea, the ASEC analysis team confirmed that coinminer malware was being distributed via Discord messenger. The attacker introduces a program that generates Robux, a currency used in a game called Roblox, for free in the following Discord chat room named “Free Robux Generator” and prompts the user to download it. Upon clicking the “Robux Generator – Download,” the compressed file shown below is downloaded. Upon decompressing the file, an executable named “robux…