Kimsuky Group Distributes Malware Disguised as Profile Template (GitHub)

AhnLab Security Emergency response Center (ASEC) has confirmed the distribution of a malicious Word file disguised as a profile template from emails impersonating a certain professor.

‘[Attachment] Profile Template.doc’ is the filename of the password-protected Word file that was discovered, with the password itself being included in the body of the email.

Figure 1. Original email

Figure 2. Part of the Word file contents

Figure 3. File properties

A malicious VBA macro is contained within the Word file, which, upon …

ahnlab asec attachment body center distribution doc email emails emergency file filename github impersonating kimsuky macro malicious malware malware analysis password powershell profile response security template vba vba macro word