Input: We also believe their target profile may change but for now it will mostly focus on Korean peninsula targets, however, as explained their capabilities will likely continue to evolve over time as they further refine their TTPs.IOCs"Golden Time" Campaign:Maldoc #1 sha256: 7d163e36f47ec56c9fe08d758a0770f1778fa30af68f39aac80441a3f037761eMaldoc #2 sha256: 5441f45df22af63498c63a49aae82065086964f9067cfa75987951831017bd4fROKRAT #1: cd166565ce09ef410c5bba40bad0b49441af6cfb48772e7e4a9de3d646b4851cROKRAT #1: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00Network:Malicious URLs:- hxxp://discgolfglow[.]com/wp-content/plugins/maintenance/images/worker.jpg- hxxp://acddesigns[.]com[.]au/clients/ACPRCM/kingstone.jpgSafe URLs:- hxxps://www[.]amazon[.]com/Men-War-PC/dp/B001QZGVEC/EsoftTeam/watchcom.jpg- hxxp://www[.]hulu[.]com/watch/559035/episode3.mp4"Evil New Year" Campaign:Maldoc sha256: 281828d6f5bd377f91c6283c34896d0483b08ac2167d34e981fbea871893c919Dropped #1: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08aDropped #2: 7ebc9a1fd93525fc42277efbccecf5a0470a0affbc4cf6c3934933c4c1959eb1Dropped #3: 6c372f29615ce8ae2cdf257e9f2617870c74b321651e9219ea16847467f51c9fDropped #4: 19e4c45c0cd992564532b89a4dc1f35c769133167dc20e40b2a41fccb881277bDropped #5: 3a0fc4cc145eafe20129e9c53aac424e429597a58682605128b3656c3ab0a409Dropped #6: 7d8008028488edd26e665a3d4f70576cc02c237fffe5b8493842def528d6a1d8Unpacked #1: 7e810cb159fab5baccee7e72708d97433d92ef6d3ef7d8b6926c2df481ccac2fUnpacked #1: 21b098d721ea88bf237c08cdb5c619aa435046d9143bd4a2c4ec463dcf275cbeUnpacked #1: 761454dafba7e191587735c0dc5c6c8ab5b1fb87a0fa44bd046e8495a27850c7Unpacked #1: 3d442c4457cf921b7a335c0d7276bea9472976dc31af94ea0e604e466596b4e8Unpacked #1: 930fce7272ede29833abbfb5df4e32eee9f15443542434d7a8363f7a7b2d1f00Unpacked #1: 4b20883386665bd205ac50f34f7b6293747fd720d602e2bb3c270837a21291b4Unpacked #1: f080f019073654acbe6b7ab735d3fd21f8942352895890d7e8b27fa488887d08Network:- www[.]imuz[.]com/admin/data/bbs/review2/board/index.php- www[.]imuz[.]com/admin/data/bbs/review2/board/123.php- www[.]imuz[.]com/admin/data/bbs/review2/board/02BC6B26_put.jpg (where 02BC6B26 is randomly generated)- www[.]wildrush[.]co[.]kr/bbs/data/image/work/webproxy.php- www[.]wildrush[.]co[.]kr/bbs/data/image/work/02BC6B26_put.jpg (where 02BC6B26 is randomly generated)- www[.]belasting-telefoon[.]nl//images/banners/temp/index.php- www[.]belasting-telefoon[.]nl//images/banners/temp/02BC6B26_put.jpg (where 02BC6B26 is randomly generated)- www[.]kgls[.]or[.]kr/news2/news_dir/index.php- www[.]kgls[.]or[.]kr/news2/news_dir/02BC6B26_put.jpg (where 02BC6B26 is randomly generated)"Are You Happy?" Campaign:Wiper sha256: 6332c97c76d2da7101ad05f501dc1188ac22ce29e91dab6d0c034c4a90b615bd"FreeMilk" Campaign:Office sha256: f1419cde4dd4e1785d6ec6d33afb413e938f6aece2e8d55cf6328a9d2ac3c2d0HTA sha256: a585849d02c94e93022c5257b162f74c0cdf6144ad82dd7cf7ac700cbfedd84fJS sha256: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3cPoohMilk sha256: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2Freenki sha256: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54dfFreenki 2016: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5Network:- hxxp://old[.]jrchina[.]com/btob_asiana/udel_calcel.php?fdid=[base64_data]- hxxp://old[.]jrchina[.]com/btob_asiana/appach01.jpg- hxxp://old[.]jrchina[.]com/btob_asiana/appach02.jpg- hxxp://old[.]jrchina[.]com/btob_asiana/udel_ok.ipp- hxxp://old[.]jrchina[.]com/btob_asiana/udel_confirm.php"North Korean Human Rights" Campaign:Maldoc sha256: 171e26822421f7ed2e34cc092eaeba8a504b5d576c7fd54aa6975c2e2db0f824Dropper #1: a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037Dropper #2: eb6d25e08b2b32a736b57f8df22db6d03dc82f16da554f4e8bb67120eacb1d14Dropper #3: 9b383ebc1c592d5556fec9d513223d4f99a5061591671db560faf742dd68493fROKRAT:: b3de3f9309b2f320738772353eb724a0782a1fc2c912483c036c303389307e2e"Evil New Year 2018" Campaign:Maldoc sha256: f068196d2c492b49e4aae4312c140e9a6c8c61a33f61ea35d74f4a26ef263eadPNG : bdd48dbed10f74f234ed38908756b5c3ae3c79d014ecf991e31b36d957d9c950ROKRAT:: 3f7827bf26150ec26c61d8dbf43cdb8824e320298e7b362d79d7225ab3d655b1Network:- hxxp://60chicken[.]co[.]kr/wysiwyg/PEG_temp/logo1.pngReferenceshttp://blog.talosintelligence.com/2017/02/korean-maldoc.htmlhttp://blog.talosintelligence.com/2017/04/introducing-rokrat.htmlhttp://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html

Tactics: TA0001, TA0005, TA0009
Techniques: T1115, T1566.003, T1566, T1027, T1566.002, T1560, T1027.001