Severity
High
Analysis Summary
HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. new Test NukeSped sample which use LAN ip for testing. The decypt code is similar to Sony attack which happen in 2014. Threat indicators are provided.
Impact
File encryption
Indicators of Compromise
URLs
- http[:]//upload[.]childu[.]co[.]kr/include/OnlyOne1[.]asp
- https[:]//www[.]byucksanpaint[.]com/community/com_gon_open[.]as
- https[:]//www[.]byucksanpaint[.]com/main/main4[.]asp
- https[:]//www[.]keyang[.]co[.]kr/pub/editor/wa_path[.]asp
Malware Hash (MD5/SHA1/SH256)
- 3860487c19cbaa8500237c0c3a031bd904bd7031907c945b5d57f65bfc5c6ea2
- 6b90e2a3f0ad8819b5afe67bf13451c9782af26a9f2bdac3a0e042569054e5fd
- aeb0b1a850b3d0ccd6ae17dc065ee2d3e4e7927e
- d7a722cb4fa08a84831bd688033c2004
Remediation
Block all threat indicators at your respective controls.