AhnLab ASEC blog (asec.ahnlab.com)
Word Files Related to Diplomacy and National Defense Being Distributed · 2022-04-27
excerpt: The ASEC analysis team has discovered the continuous distribution of malicious Word files with North Korea-related file names. The Word files contain malicious VBA macro codes and are the same file type introduced in <Discovery of Continuous Distribution of North Korea-related Malicious Word Files>. The names of the distributed files that were recently discovered […] | attribution sentence: [File Detection] Downloader/DOC.Kimsuky MD5 0a0f858beeb6914aaf07896b7790a1d4 657b538698483f43aada2e5e4bc4a91d cb2a18028055cdf1582c1c5ac3756203 URL http[:]//g00gledrive[.]mywebcommunity[.]org/file/upload/list[.]php?query=1 http[:]//impartment[.]myartsonline[.]com/file/upload/list[.]php?query=1 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . | target sentence: Yet as the command used is the same as the one discovered in the post < Word Document Attack Targeting Companies Specialized in Carbon Emissions > , it appears that the macro performed behaviors such as leaking user PC information.