admin/APT_REPORT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.MD

Browse Source
This commit is contained in:
blackorbird
2019-04-23 15:00:25 +08:00
committed by GitHub
parent aa8c6f3a7d
commit 550970eba0
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
group123/README.MD
View File

@@ -19,27 +19,28 @@ Lee Soo-hyun <loveshlee@unikorea.go.kr>
info:
http://155.138.236.240/sec[.]png?id=
phishing:
input password and login it will redirect to unikorea.go.kr
## phishing:
### input password and login it will redirect to unikorea.go.kr
https://unikorea.go.kr/upload/editUpload/20190418/2019041814360535872.png
https://unikorea.go.kr/upload/editUpload/20190418/2019041814364795734.png
The html file is misleading in this two-step process and will connect you to a specific Google Drive address in the background.
### The html file is misleading in this two-step process and will connect you to a specific Google Drive address in the background.
download:memo.utr
google drive owner: 한국정치학회
Gmail:kpsapress@gmail.com
decode PE and collect private information
post to "pcloud"
### post to "pcloud"
the authorize email is kcrc1214@hanmail.net ,2018.12.3 join
The attacking organization seems to have registered Russian expressions to intentionally give the analysts a false flag, and when translated into English, it will change to the expression 'Humpty Dumpty'.
D:\System\Kernel32\Shell32\Sample\Release\Шалтай-Болтай.pdb (Humpty Dumpty)
### D:\System\Kernel32\Shell32\Sample\Release\Шалтай-Болтай.pdb (Humpty Dumpty)
HTML code feature
### HTML code feature
<meta http-equiv ='Content-Type'content ='text / html; charset = UTF-8'/>
<meta http-equiv ='Cache-Control'content ='no-cache'/>