Malicious Batch File (*.bat) Disguised as a Document Viewer Being Distributed (Kimsuky)

AhnLab Security Emergency response Center (ASEC) has confirmed the distribution of malware in the form of a batch file (*.bat). This malware is designed to download various scripts based on the anti-malware process, including AhnLab products, installed in the user’s environment. Based on the function names used by the malware and the downloaded URL parameters, it is suspected to have been distributed by the Kimsuky group.

Although the exact distribution path of the malware has not been confirmed, it appears …

ahnlab anti-malware asec bat batch center distributed distribution document download emergency environment file function kimsuky malicious malware malware analysis names process products response scripts security viewer