Malware Disguised as Resume/Copyright-Related Emails Distributed in the Wild!

ASEC analysis team has confirmed the malware under the disguise of a resume is still being distributed. This time, it disguised as resume and copyright-related files. The file that is being recently distributed also takes the form of NSIS (Nullsoft Scriptable Install System) and is being distributed under various filenames as translated below.

Outline on the original image (the image I created) and the image you are currently using.exe

You have violated copyright laws and here is the summary of violations.exe

Contains my work experience, I am looking forward to working with you).exe

Resume (Also contains my work experience, I am looking forward to working with you).exe

Portfolio_210222 (Please check my work experience as well thank you).exe

Resume_210222 (Please check my work experience as well thank you).exe

One of the disguised emails regarding copyright violation had a compressed attachment files within which there exists a compressed file named ‘Copyright violation.alz,’ and it contains two executable files with the same hash.

These files are the variant of previously distributed Makop ransomware. When executed, files get encrypted with extension [Serial Number].[vassago0213@airmail.cc].vassago added. The ransomware uses the following commands to delete shadow copy and proceeds with encryption.

To learn more about the recent malware distribution, visit ASEC Blog.