malware_trace_kr

@Steam_Nostalgia Korea Malware Trace & Analysis

[malware_trace_kr @malwaretracekr]

대한민국에서 일어나는 #악성코드 를 trace 및 analysis 합니다. (This account trace & analysis #malicious links in Korea.)
계정 주인(Account Manager) : @Steam_Nostalgia
#malware

[malware_trace_kr @malwaretracekr]

#피싱 #Phishing #네이버 #Naver
h**ps://boxga[.]com/main.php (119[.]207.78.214) #AS4766

h**ps://www.sungsimdangmall.co[.]kr/ → h**ps://torre.co[.]kr/sub/sub.js → h**ps://boxga[.]com/main.php → h**ps://www.osro.co[.]kr/about/menu/about.php

[MalwareHunterTeam @malwrhunterteam]

8cc66e4069a30885202b0328407ff167671133a1a539808c48f12928348744e0
🤔
@ShadowChasing1 @h2jazi

[malware_trace_kr @malwaretracekr]

#Malware #스미싱 #Smishing
h**p://nhisis[.]xyz (115[.]91.26.153) #AS138195 #MOACK
Download app : <Phone Number>.apk
https://t.co/2yhRqqGHrO

[malware_trace_kr @malwaretracekr]

#Malware #스미싱 #Smishing
h**p://cn.btk3[.]tech/ (163[.]197.168.245) #AS140107 #citiscloud
Download app : FAIL (Whitelist Required)
CC : @kisa118 @ZeroCERT @malwaremansys

[malware_trace_kr @malwaretracekr]

CC : @kisa118 @ZeroCERT @malwrhunterteam @malwaremansys

[malware_trace_kr @malwaretracekr]

#Malware #택배 #Parcel #스미싱 #Smishing #MoqHao
h**://ogspf.zyqfr[.]com/ (27[.]124.36.32) #AS64050 @bgpdotnet
iOS : h**p://qwnuzcilyt.duckdns[.]org/ @duckdns
(172[.]81.131.11) #AS27176 @datawagon
download app : epost.apk (epost)
https://t.co/0MoU8n1c1X

[malware_trace_kr @malwaretracekr]

#Malware #택배 #Parcel #스미싱 #Smishing
h**ps://dokdo[.]in/UbL -> h**ps://dm.mobans[.]top/?=01 (104[.]21.39.167) @cloudflare @CloudflareAbuse
Download app : FAIL (Whitelist Required)
CC : @kisa118 @ZeroCERT @malwaremansys

[malware_trace_kr @malwaretracekr]

SMS : [Web발신] 고객님 주문하신물품 주소잘못확인되어 주소변경부탁합니다 (URL)
CC : @kisa118 @ZeroCERT @malwrhunterteam @malwaremansys

[malware_trace_kr @malwaretracekr]

#Malware #택배 #Parcel #스미싱 #Smishing #MoqHao
h**p://kjdbz.reagz[.]com/ (27[.]124.36.32) #AS64050 @bgpdotnet
iOS : h**p://kdljiifjwu.duckdns[.]org/ @duckdns (172[.]81.131.11) #AS27176 @datawagon
download app : epost.apk (epost)
https://t.co/BdNJmjaDk9

[malware_trace_kr @malwaretracekr]

SMS : [Web발신]
[교통민원24(이파인)]교통법규위반행위 벌점통지서 발송 완료 (URL)

[malware_trace_kr @malwaretracekr]

#Malware #스미싱 #Smishing
h**p://yuwc.eobur[.]kr (36[.]226.6.175) #AS3462
Download app : <Phone Number>.apk
https://t.co/AqygfRAlbb
@kisa118 @ZeroCERT @malwrhunterteam @malwaremansys

[malware_trace_kr @malwaretracekr]

CC : @kisa118 @ZeroCERT @malwaremansys @BongphilKim

[malware_trace_kr @malwaretracekr]

#android #Malware #몸캠피싱 #sextortion

downlaod app : 비밀채팅.zip -> chatting.apk (비밀채팅)
https://t.co/KDPf2o5udl

[Osumi, Yusuke @ozuma5119]

#Phishing #malware #android
Brand: National Police Agency (South Korea)🇰🇷

🦠hxxp://t2m[.]kr/Oxn6v
→ hxxp://uyfgrgdse[.]wuwic[.]me
<tel>.apk
⚡️ C2:www[.]uenbs[.]fit 123.204.25[.]166

IoC: https://t.co/vMjiy0tWmB
🔍https://t.co/RryjeM8vag

ref: https://t.co/Z2y4FZBeAF

[malware_trace_kr @malwaretracekr]

#Malware #스미싱 #Smishing
h**p://t2m[.]kr/Oxn6v -> h**p://uyfgrgdse.wuwic[.]me (118[.]160.88.81) #AS3462
download app : <Phone Number>.apk (교통민원24(이파인))
https://t.co/rx8g5EdVGq
@kisa118 @ZeroCERT @malwrhunterteam @malwaremansys @BongphilKim

[muz.so 무료단축URL서비스 @muz_so]

가짜 검진모아 페이지에 주의해주세요.
Beware of Fake MOAMOA(https://t.co/HZopdqUAaQ) Page

hxxp://xzx[.]kr/hJ -> hxxp://olpty.ciofr[.]me (61.227.48[.]123)

#Malware #Smishing #Phishing

[muz.so 무료단축URL서비스 @muz_so]

가짜 CJ대한통은 페이지에 주의해주세요.
Beware of Fake CJ Logistics Page

hxxp://muz[.]so/ag9G -> hxxp://dc.spellmanj[.]top (172.67.194[.]211 / Cloudflare)

#Malware #Smishing #Phishing

[MalwareHunterTeam @malwrhunterteam]

"shinhan.apk": 57f17374f1a4901426f13ca50b0043884422eac078dd58330e06c1f0697b6d3b
From: http://knab-alert[.]email/ -> http://knab-alert[.]email/shinhan.apk