Summary: 2025/04/17 10:35

First reported date: 2016/02/24
Inquiry period : 2025/04/16 10:35 ~ 2025/04/17 10:35 (1 days), 2 search results

지난 7일 기간대비 50% 높은 트렌드를 보이고 있습니다.
지난 7일 기간대비 상승한 Top5 연관 키워드는
Lazarus Campaign Report APT cti 입니다.
악성코드 유형 Konni 도 새롭게 확인됩니다.
공격자 Kimsuky 도 새롭게 확인됩니다.
기관 및 기업 AhnLab SECUI 도 새롭게 확인됩니다.
기타 동향 AhnLabSecuInfo 보고서 그룹 PDF 등 신규 키워드도 확인됩니다.

Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.

Trend graph by period


Related keyword cloud
Top 100

# Trend Count Comparison
1Lazarus 2 ▲ 1 (50%)
2동향 1 ▲ new
3AhnLab 1 ▲ new
4SECUI 1 ▲ new
5Campaign 1 ▲ 1 (100%)
6Report 1 ▲ 1 (100%)
7AhnLabSecuInfo 1 ▲ new
8APT 1 ▲ 1 (100%)
9보고서 1 ▲ new
10그룹 1 ▲ new
11PDF 1 ▲ new
12cti 1 ▲ 1 (100%)
13dprk 1 ▲ 1 (100%)
14trend 1 ▲ new
15Konni 1 ▲ new
16Kimsuky 1 ▲ new
17RepositoriesPython 1 ▲ new
18GitHub 1 ▲ new
19Lures 1 ▲ new
20North Korea 1 - 0 (0%)
Special keyword group
Top 5

Malware Type
Malware Type

This is the type of malware that is becoming an issue.


Keyword Average Label
Konni
1 (100%)
Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.


Keyword Average Label
Lazarus
2 (66.7%)
Kimsuky
1 (33.3%)
Attack technique
Technique

This is an attack technique that is becoming an issue.


Keyword Average Label
Campaign
1 (50%)
APT
1 (50%)
Country & Company
Country & Company

This is a country or company that is an issue.


Keyword Average Label
AhnLab
1 (25%)
SECUI
1 (25%)
dprk
1 (25%)
North Korea
1 (25%)

Additional information

No Request Hash(md5) Report No Date
1 Winvoke.exe
Lazarus Generic Malware PE64 PE File OS Processor Check GIF Format
f4d46629ca15313b94992f3798718df7123522021.06.16
Level Description
danger File has been identified by 49 AntiVirus engines on VirusTotal as malicious
watch Installs itself for autorun at Windows startup
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates a shortcut to an executable file
notice Creates executable files on the filesystem
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Sends data using the HTTP POST Method
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
No Category URL CC ASN Co Date
1c2https://blockchain-newtech.com/download/download.asp2023.10.10
No URL CC ASN Co Reporter Date
1https://api.camdrivers.cloud/linux.update
Lazarus zip
US USNAMECHEAP-NETNDA0E2025.03.04
2https://api.camdrivers.cloud/linux-al2i.sh
Lazarus sh ua-curl
US USNAMECHEAP-NETNDA0E2025.03.04
3https://api.drivercamhub.cloud/linux-al2i.sh
Lazarus
US USADVANTAGECOMlontze72025.02.27
4http://45.43.11.201:1244/pdown
APT BeaverTail Lazarus python StrelaStealer
US USPacket Flip, LLCDaveLikesMalwre2024.12.12
5http://147.124.197.138:1244/pdown
APT BeaverTail Lazarus python StrelaStealer
US USAC-AS-1DaveLikesMalwre2024.12.12
View only the last 5
Beta Service, If you select keyword, you can check detailed information.