꿈을꾸는 파랑새

오늘은 북한 해킹 단체 김수키(Kimsuky)에서 만든 피싱(Phishing) 사이트 구글 드라이브로 위장하는 사이트입니다. 사용자 자격 증명 타겟팅 이라고 하면 될 것입니다.
피싱(Phishing) 사이트 즉 Google 로그인 페이지로 리디렉션되는 가짜 Google 알림

hxxps://gplokio(.)site/drive/?ati=MzM5a3Nk

해당 사이트에 접속하면 다음과 같은 메시지를 확인할 수가 있습니다.
서버와의 통신이 임시 중단되었습니다.
Google에서 서버와의 통신과정에 임시 오류가 발생하였으며 그로 말미암아 Gmail 서비스가 잠시 중지되었습니다. 계속하려면 다시 로그인해주시기 바랍니다. 
즉 서버 와의 통신 장애로 되지 않는 로그인 해달라고 하는 것이며 해당 로그인을 하려고 클릭을 하면 다음과 같은 사이트를 통해서 전달됩니다.

This photo has no EXIF data.

웹 소스 내용

<div style="text-align: center; padding-bottom: 13px">
																		<img height="79px" src="hxxps://www(.)gstatic(.)com/accountalerts/email/Red_circle_x2_35x39(.)png">
																	</div>
																	서버와의 통신이 임시 중단되었습니다.<br>
																	<!-- <a style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.87); font-size: 16px; line-height: 1.8;">??@gmail(.)com</a> -->
																</div>
															</div>
															<div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 13px; color: rgba(0,0,0,0.87); line-height: 1.6;padding-left: 20px; padding-right: 20px;padding-bottom: 32px; padding-top: 24px;">
																<div class="v2sp">Google에서  서버와의 통신과정에 임시 오류가 발생하였으며 그로 인하여 Gmail 서비스가 잠시 중지 되었습니다. 계속하려면 다시 로그인해주시기 바랍니다.
																	<div style="padding-top: 24px; text-align: center;">
																		<a href="hxxps://gkjoiup(.)store/ghod/?millon=&q=aHR0cHM6Ly9hY(2)NvdW50cy5nb29nbGUuY29tL3YzL3NpZ25pbi9pZGVudGlmaWVyP2NvbnRpbnVlPWh0dHBzJTNBJTJGJ(T)JGbWFpbC5nb29nbGUuY29tJTJGbWFpbCUyRiZpZmt2PUFTNUxUQVR3V1dBeS11Rjh6UDhzS1h1(T)Ew(x)eXZmejRKVU85Wlk2d3lzX0s0QUlEUERRNm4tR1o5TDlMZnFkRnJVLW1Sc3VqaDVNU24mcmlwPTEmc2F(j)dT0xJnNlcnZpY2U9bWFpbCZmbG93TmFtZT1HbGl(m)V2ViU2lnbkluJmZsb3dFbnRyeT1TZXJ2aWNlTG9(n)aW4mZHNoPVMtNDAyMzA4MTg5JTNBMTcxODE4(N)jY1NjEyMTQzOCZkZG09MA" target="_self" style="display:inline-block; text-decoration: none;">
																			<table align="center" border="0" cellspacing="0" cellpadding="0" style="background-color: #4184F3; border-radius: 2px; min-width: 90px;">
																				<tbody>
																				<tr style="height: 6px;"></tr>
																				<tr><td style="padding-left: 8px; padding-right: 8px; text-align: center;">
																						<a href="hxxps://gkjoiup(.)store/ghod/?millon=&q=aHR0c(H)M6Ly9hY2NvdW50cy5nb29nbGUuY29(t)L3YzL3NpZ25pbi9pZGVudGlmaWVyP2NvbnRpbnVlPWh0dHBzJTNBJTJGJTJGbWF(p)bC5nb29nbGUuY29tJTJGbWFpbCUyRiZpZmt2PUFTNUxUQVR3V1dBeS11Rjh6UDh(z)S1h1TEwxeXZmejRKVU85Wlk2d3lzX0s0QUlEUERRNm4tR1o5TDlMZnFkRnJVLW1(S)c3VqaDVNU24mcmlwPTEmc2FjdT0xJnNlcnZpY2U9bWFpbCZmbG9(3)TmFtZT1HbGlmV2ViU2lnbkluJmZsb3dFbnRyeT1TZXJ2aWNlTG9naW4mZHNoPVM(t)NDAyMzA4MTg5JTNBMTcxODE4NjY1NjEyMTQzOCZkZG09MA" target="_self" style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; color: #ffffff; font-weight: 400; line-height: 20px; text-decoration: none;font-size: 13px;">로그인</a>
																					</td>
																				</tr>
																				<tr style="height: 6px;"></tr>
																				</tbody>
																			</table>
																		</a>
																	</div>
																</div>
														</div></td>
														<td style="background:url('hxxps://www(.)gstatic(.)com/accountalerts/email/hodor/4-pixel-e(.)png') center left repeat-y;" width="6"></td>
													</tr>
												</tbody></table></td></tr></tbody>
										</table></td>
									</tr>
								</tbody>
							</table></td>
						</tr></tbody>
					</table>
		</div>
		</td></tr>
		</tbody></table>

	</div>

웹 소스 분석

This photo has no EXIF data.

일단 베이스 64로 된 부분을 분해를 해보겠습니다.
원본 베이스 64
aHR0cHM6Ly9hY2Nvd(W)50cy5nb29nbGUuY29tL3YzL3(N)pZ25pbi9pZGVudGlmaWVyP2NvbnRpbnVlPWh0dHBzJTNBJTJGJTJGbWFpbC5(n)b29nbGUuY29tJTJGbWFpbCUyRiZpZmt2PUFTNUxUQVR3V1dB(e)S11Rjh6UDhzS1h1TEwxeXZmejRKVU85Wlk2d3l(z)X0s0QUlEUERRNm4tR1o5TD(l)MZnFkRnJVLW1Sc3V(q)aDVNU24mcmlwPTEmc2FjdT0xJnNlcnZpY2U9bWFpbCZmbG9(3)TmFtZT1HbGlmV2ViU2lnbkluJmZsb3dFbnRyeT1(T)ZXJ2aWNlTG9naW4mZHNoPVMtNDAyMzA4MTg5JTNBMTcxODE4(N)jY1NjEyM(T)QzOCZkZG09MA
베이스 64 디코딩
hxxps://accounts(.)google(.)com/v3/signin/identifier?continue=https%3A%2(F)%2Fmail(.)google(.)com%2Fmail%2F&ifkv=AS5LTATwWWAy-uF8(z)P8sKXuLL1yvfz(4)JUO9ZY6wys_K4AIDP(D)Q6n-GZ9L9LfqdFrU-mRsu(j)h5MSn&rip=1&(s)acu=1&service=mai(l)&flowName=Gl(i)fWebSignIn&(f)lowEntry=ServiceL9o)gin&dsh=S-402308189%3A17(1)8186656121438&ddm=0

This photo has no EXIF data.

분석 포인트
이미지 사용:
src="hxxps://www(.)gstatic(.)com/accountalerts/email/Red_circle_x2_35x39(.)png 이미지가 사용
이미지를 통해 이메일의 신뢰성을 높이고 사용자를 속이기 위한 시각적 요소
서버와의 통신이 임시 중단되었습니다라는 메시지를 통해 사용자가 불안감을 느끼도록 유도하고 있음
클릭 유도 링크:
로그인이라는 텍스트가 포함된 버튼 해당 피싱 사이트로 유도
진짜처럼 보이도록 조작: 베이스 64 디코딩된 URL은 실제 Google 로그인 페이지처럼 보이도록 설계
로그인 세션 하이재킹: 피싱 페이지를 통해 사용자의 Google 로그인 자격 증명을 수집하여 계정에 접근하려는 의도
여기서 한번 속아주면 다음과 같은 구글 드라이브 사이트로 연결됩니다.

This photo has no EXIF data.

hxxps://drive(.)google(.)com/file/d/1rG1fjO(T)QuDeB(O)rQBIj34X(X)7OYP(m)exci1/view
미끼문서:(바쁜 현대인을위한 타점매매&현물매집 노하우 올인원 자료.pdf)
해당 미끼 문서를 열어보면 뜬금없이 알트코인 이라는 백불남자 분의 PDF 를 볼 수가 있습니다.
내부 사이트
hxxps://gkjoiup(.)store/
해당 사이트에서 로그인하면 실제로 로그인이 되며 그리고 만약 내가 낚시에 낚였다고 생각을 하면 비밀번호를 변경하고 반드시 2단계 인증을 사용하는 것을 추천합니다. 결론 저런 식으로 화면 나오면 그냥 피싱 사이트 확률이 100%이니 그냥 무시하시면 됩니다.