DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Domain/URLs

img.darklights.store

img.monderhouse.space

img.responsive.pstatic.autos

img.smartnords.site

img.socialteams.store

img.worksongo.store

Hash

5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91

09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe

fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61

83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130

7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110

6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53

ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16

feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3

6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53

d53c760c23b4405eb04ad0f20ead375440344b3bdf1fb7854ed12e40d155eabe

2f02b09d61d432134e994ad671258f523bbf289ae6091fd4eae192c60bd51b6f

8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c

a1d8af3a6acb731f07f72040eccb3450c1c83d40e29f736c2a63d35388660be4

12810854c8b2c391b23e2e18b013e873d0369b0637aa3cf993136c07188ba3b8

009a1e2d7a582a24e50cf2ffc2a005482c8e38f22bf5ed416053855f8d054e1e

4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5

94630b96f628c96a6bff7904b40ffc9ad67c86f8a4ff6080c3b524831c93f402

72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558

a8bfab4de81a1acb04aacdf757346946b0f5e30f0c9f402004016d0e425119c7

Detection Query 1 :

domainname like "img.darklights.store" or url like "img.darklights.store" or siteurl like "img.darklights.store" or domainname like "img.worksongo.store" or url like "img.worksongo.store" or siteurl like "img.worksongo.store" or domainname like "img.responsive.pstatic.autos" or url like "img.responsive.pstatic.autos" or siteurl like "img.responsive.pstatic.autos" or domainname like "img.smartnords.site" or url like "img.smartnords.site" or siteurl like "img.smartnords.site" or domainname like "img.socialteams.store" or url like "img.socialteams.store" or siteurl like "img.socialteams.store" or domainname like "img.monderhouse.space" or url like "img.monderhouse.space" or siteurl like "img.monderhouse.space"

Detection Query 2 :

sha256hash IN ("a1d8af3a6acb731f07f72040eccb3450c1c83d40e29f736c2a63d35388660be4","fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61","83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130","94630b96f628c96a6bff7904b40ffc9ad67c86f8a4ff6080c3b524831c93f402","5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91","09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe","ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16","2f02b09d61d432134e994ad671258f523bbf289ae6091fd4eae192c60bd51b6f","72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558","7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110","4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5","d53c760c23b4405eb04ad0f20ead375440344b3bdf1fb7854ed12e40d155eabe","8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c","feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3","6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53","12810854c8b2c391b23e2e18b013e873d0369b0637aa3cf993136c07188ba3b8","a8bfab4de81a1acb04aacdf757346946b0f5e30f0c9f402004016d0e425119c7","009a1e2d7a582a24e50cf2ffc2a005482c8e38f22bf5ed416053855f8d054e1e")