mark

20190403
Kimsuky Organization, Operation Stealth Power Silence Operation
https://blog.alyac.co.kr/2234

hwp: 
3.17 미국의 편타곤 비밀 국가안보회의.hwp
a0748e19b043ffe9bdf04c5d2df26689

최근 한반도 관련 주요국 동향.hwp
the creator name  "Tom"
computer name : Tom

mshta.exe http://xxx/shop/price/com/first.hta
http://xxx/shop/price/com/expres.php?op=1
http://xxx/shop/kcp/js/com/expres.php?op=1
cow.php
moonx.hta

upload.php
$env:temp\processlist.txt 
$env:temp\ttmuprc.ssa 
$env:temp\servcicelist.txt

PDF:
enindi25-142.godo.co[.]kr（106.249.25.142 ）
phishing:
tcjst.com/img/dot[.]gif

Operation Stealth Power related Low Kick （https://blog.alyac.co.kr/2209）