AhnLab ASEC blog (asec.ahnlab.com)
Malicious Batch File (*.bat) Disguised as a Document Viewer Being Distributed (Kimsuky) · 2023-06-29
excerpt: AhnLab Security Emergency response Center (ASEC) has confirmed the distribution of malware in the form of a batch file (*.bat). This malware is designed to download various scripts based on the anti-malware process, including AhnLab products, installed in the user’s environment. Based on the function names used by the malware and the downloaded URL parameters, […] | attribution sentence: Based on the function names used by the malware and the downloaded URL parameters, it is suspected to have been distributed by the Kimsuky group. | target sentence: Folder Name LNK’s Target File Name Changed LNK Arg uments C:\Users\Public\Desktop (Moved to C:\Users\[username]\Desktop and properties changed) msedge.exe chrome.exe outlook.exe whale.exe firefox.exe cmd.exe /c start [filename] [previous arguments] [command configured by the threat actor] C:\Users\[