AhnLab Details LNK Campaign Disguised as Korean Credit Card Security Emails
Summary
AhnLab describes a malicious LNK campaign disguised as security emails from a Korean credit card company. Payload delivery varies with Windows Defender status; resulting malware can steal browser and mail data, log keystrokes, collect clipboard data, and enable remote C
Key points
- The malicious LNK files impersonate security emails from a major Korean credit card company; AhnLab says the activity resembles a prior Kimsuky LNK campaign but does not establish attribution.
- The LNK invokes PowerShell and mshta to run an obfuscated HTA, which downloads a decoy document and checks whether Windows Defender is running.
- With Defender running, the malware downloads an encrypted file, decrypts it, and extracts scripts and logs for information theft and backdoor activity.
- With Defender stopped, it downloads additional files, decrypts a DLL, and loads it using rundll32; the DLL reportedly stops in VBox and VM environments.
- The analyzed payloads include a backdoor with remote command and file-transfer functions, an infostealer targeting browser and mail accounts, and a component that injects code into Chrome to steal browser cookies.
- AhnLab advises checking file origins and types, reviewing suspicious registry entries, and inspecting %TEMP% and %LOCALAPPDATA% for identified files.
Article Details
- Attack Vectors
- Malicious LNK files were distributed disguised as security emails from a major credit card company in Korea.
- The LNK file used PowerShell to launch mshta.exe, which executed an HTA containing obfuscated VBScript and downloaded a decoy document.
- Payload downloads and execution paths changed depending on whether Windows Defender was running.
- When Windows Defender was stopped, sys.dll was loaded with rundll32; downloaded components performed backdoor activity, information theft, keylogging, clipboard collection, and Chrome process injection.
- Defensive Notes
- Verify the source and file type of files presented as secure emails, and avoid running suspicious files.
- Inspect registered registry entries for suspicious modifications.
- Check %TEMP% and %LOCALAPPDATA%pipe for suspicious files such as 1.log, 1.ps1, and 2.log; delete them if found.
MITRE ATT&CK
T1005 · Data from Local SystemThe components read local file contents and collect file, directory, browser, and other host data.T1027 · Obfuscated Files or InformationThe HTA contains obfuscated VBScript; the article also describes Base64-encoded payload content and encrypted files.T1036 · MasqueradingThe LNK files impersonate security-email files, and a downloaded decoy document is made to look legitimate.T1055 · Process InjectionAPP injects decrypted code into the main Chrome process to steal browser cookies.T1056.001 · KeyloggingThe article reports keylogging by components extracted from pipe.zip and by notepad.log.T1057 · Process DiscoveryThe malware checks whether the Windows Defender service is running and APP scans for chrome.exe.T1059.001 · PowerShellThe LNK file invokes mshta through PowerShell.T1071.001 · Web ProtocolsThe malware retrieves payloads through web URLs, including Google Drive download URLs.T1105 · Ingress Tool TransferThe malware downloads additional files, including payloads saved as pipe.log, user.txt, and sys.log.T1115 · Clipboard DataThe article reports clipboard-data collection by components extracted from pipe.zip and by notepad.log.T1204.002 · Malicious FileThe attack relies on a user opening a malicious LNK file disguised as a security-email file.T1218.005 · Mshtamshta.exe executes the HTA file retrieved by the LNK execution chain.
Threat Actors
Products
EdgeOne payload targets Chrome, Edge, and Whale cookies, while another steals account data from Chrome, Firefox, Thunderbird, Group Mail, and IncrediMail.Google ChromeOne payload targets Chrome, Edge, and Whale cookies, while another steals account data from Chrome, Firefox, Thunderbird, Group Mail, and IncrediMail.Group MailOne payload targets Chrome, Edge, and Whale cookies, while another steals account data from Chrome, Firefox, Thunderbird, Group Mail, and IncrediMail.IncrediMailOne payload targets Chrome, Edge, and Whale cookies, while another steals account data from Chrome, Firefox, Thunderbird, Group Mail, and IncrediMail.Microsoft Windowsemails from a major Korean credit card company, using different payload paths depending on whether Windows Defender is enabled or disabled.Mozilla FirefoxOne payload targets Chrome, Edge, and Whale cookies, while another steals account data from Chrome, Firefox, Thunderbird, Group Mail, and IncrediMail.Mozilla ThunderbirdOne payload targets Chrome, Edge, and Whale cookies, while another steals account data from Chrome, Firefox, Thunderbird, Group Mail, and IncrediMail.WhaleOne payload targets Chrome, Edge, and Whale cookies, while another steals account data from Chrome, Firefox, Thunderbird, Group Mail, and IncrediMail.Windows Defenderemails from a major Korean credit card company, using different payload paths depending on whether Windows Defender is enabled or disabled.