Trusted Design

Infected Korean Website Installs Banking Malware

概要

On September 18, 2015, we saw an activity on koreatimes.com where we captured a malicious binary. We investigated further and found that this campaign is specifically targeted to Korean sites and Korean banks. The payload we got also specifically targets Korean banks by modifying the infected systems hosts file to redirect traffic from Korean banks to its controlled server. This means the attacker can craft a phishing website without the user knowing it is visiting a phishing site. It also targets Ahnlab by killing processes and deleting files specific to the software. Ahnlab is a popular antivirus software in South Korea.

Created: 2026-02-23

Indicators

• CVE - CVE-2014-6332 -
• hostname - www.jfkdsajfk5263.com -
• FileHash-MD5 - a6ec0fbe1ad821a3fb527f39e180e378 -
• URL - http://www.jfkdsajfk5263.com/server.jpg -
• CVE - CVE-2011-3544 -
• FileHash-MD5 - b9a5a00e134fe0df217c01145319b1cb -
• CVE - CVE-2015-0336 -
• FileHash-MD5 - c242d641d9432f611360db36f2075f67 -

類似Pulses

• Updated Blackmoon banking Trojan (score: 0.73)
• TROJ_WERDLOD: New Banking Trojan Targets Japan (score: 0.68)
• Android banking malware masquerades as Flash Player (score: 0.64)
• FortiGuard Lion: A Peek into BlackMoon’s Sustained Attacks against South Korea (score: 0.64)
• Phishing malware - Standard Bank SA (score: 0.64)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る