AhnLab EDR Tracks and Responds against Link File (*.lnk) Distributing RokRAT

AhnLab Security Emergency response Center (ASEC) has shared information regarding the RedEyes threat group (also known as APT37, ScarCruft), who distributed CHM Malware Disguised as Security Email from a Korean Financial Company last month.

The LNK file contains a PowerShell command and performs malicious behavior without the knowledge of the individual who uses the normal pdf file by creating and executing script files along with normal files in the temp path. …

ahnlab apt37 asec center chm distributed edr email emergency file files financial information link lnk lnk file malware malware analysis powershell redeyes response rokrat rokrat malware scarcruft security threat threat group