찾아줄게요

ARC 파일은 무엇입니까?

• 안녕하세요. 제 컴퓨터에서 ARC라는 파일을 찾았는데 이것이 무엇인지 잘 모르겠습니다. 알려주시면 감사하겠습니다.

• ARC 파일은 LH ARC(구버전)/pjARC 압축 아카이브 압축 아카이브 파일 입니다. Pkware에서 배포한 파일인 것으로 보입니다. 2008-11-04 05:24:15에 처음으로 보고되었으며 2008-08-09 03:20:46에 마지막으로 보고되었습니다.

• 적절한 프로그램을 다운로드하여 ARC 파일을 열 수 있습니다.

• 압축 유틸리티인 'Pkarc'로 압축된 파일이다.

• 시그니처 정보가 없습니다.

• 연관 링크 #1: 첨부된 링크가 없습니다.

• 연관 링크 #2: 첨부된 링크가 없습니다.

• [2021-07-07 02:55:32] @_Y000_ Publicidad que te manda a descargar un archivo .apk malicioso! https://sorry.waitfordownlaod.com/ZWMwMDBhMDYzNTAwMjA1MjAwMDAyMDVjMDAyMDVjMDAyMDVjMjhkNTRjYjZmYg= = /?name= Downloader&sclid= 60e4b434479281000109c99c&extra= 8284 Virustotal: https://www.virustotal.com/gui/file/a9d5a0741cc5634c6c4a3d76c39560591b97141c27bcc15a6e798aacf9597cbe/detection https://twitter.com/_Y000_/status/1412500481688182788/photo/1

• [2021-07-07 00:55:04] @malware_traffic 2021-07-06 (Tuesday) - #BazarLoader (#BazaLoader) from "Stolen Image Evidence" zip archive led to #CobaltStrike - Encoded binary for Cobalt Strike at: hxxp://46.17.98.191/OuqC8rXGwlN5saz48clBNekGjhs8Kjmf - List of IOCs available at: https://github.com/brad-duncan/IOCs/blob/main/2021-07-06-BazarLoader-with-Cobalt-Strike-IOCs.txt https://twitter.com/malware_traffic/status/1412470165179092992/photo/1

• [2021-07-06 22:25:17] @d4rksystem Open directory on InternetArchive hosting obfuscated dotNet loaders that are dropping infostealer variants. Loaders are compiled on the fly with aspnet_compiler.exe. C2: 103.155.81.167 cc @malwrhunterteam @JAMESWT_MHT @executemalware @abuse_ch @MalwarePatrol @James_inthe_box https://twitter.com/d4rksystem/status/1412432472088981511/photo/1

• [2021-07-06 08:01:16] @wwp96 #opendir @JAMESWT_MHT hxxp://136.144.41.3/LINEARcndkjncjkd/ https://app.any.run/tasks/ccdbfbe3-b790-4c40-8d7b-4a0f9a8399c2/ https://twitter.com/wwp96/status/1412215034206429186/photo/1

• [2021-07-06 01:33:22] @InQuest ???? Malicious file found hosted at: https///archive.org/download/plus-blog-06062021/PLUS%20BLOG%2006062021.zip SHA256: d194caceb864ad7d1081b118c27e3f521090c038cbcea023700467e78b39e1ce IOC extracted from sample: https://labs.inquest.net/dfi/hash/37fb5c80dc58d15c4e53e2195b88d65fb51680674f926de94a9d8c3ec7326531

• [2021-07-05 22:14:34] @InQuest ???? Malicious file found hosted at: https///archive.org/download/arsip-30062021/ARSIP%2030062021.zip SHA256: f9b19947166077a985f1dfb7c2bf4f166af43854682b040bba24ceecd712685d IOC extracted from sample: https://labs.inquest.net/dfi/hash/354ff302b85cb1db89e1e0f01abf62bfc34538208e04cb3840fc37ab1e386849

• [2021-07-05 22:01:38] @treetopsec Cursory search from #ApexLegends #hack https://www.virustotal.com/gui/file/3ee1dea0e945193bae77ba74c4c3d9613c3afa4ae4e2a4e1e83928a83c2e12f1/detection This is just a tiny sliver. I am using a free sandbox. Emotet signatures. and a ton of other variations of Trojans to drop hell on users. #infosec folks. feel free to tell me what YOU see. #apexhacked #Respawn

• [2021-07-04 14:53:03] @pollo290987 #redline Archlute.exe 9c156d6a18ccdeb50e1eb401ff5a6e64 dingicash C2: /45.12.213.248:36372

• [2021-07-04 08:32:43] @bad_packets “Blockchain can eliminate the TCP/IP’s fundamental security flaws.” https://web.archive.org/web/20210703220948/ https://www.rsaconference.com/library/blog/understanding-blockchain-security

• [2021-07-03 22:30:12] @cocaman @rpargman @malwrhunterteam @Jirehlov @ESETresearch like here File Version Information CopyrightCopyright (C) 2019. xihilujice Internal Namesodinokibi.exe https://www.virustotal.com/gui/file/0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d/details

• [2021-07-03 04:59:05] @davis_mistica https://narcissisticbehaviors.quora.com/What-is-narcissistic-abuse?ch= 2&share= c3a03096

• [2021-07-03 01:46:11] @BushidoToken ☣ #AgentTesla spoofing #UPS employee emails. logos. invoices. Word Doc w/ Equation Editor (CVE-2017-11882) Filenames: UPS-AIRWAY BILL_20210325115310.docx. AWB.doc. chrome.exe/vbc.exe C2: https://app.any.run/submissions/#domain:monnimonitorcloudfiles.mangospot.net Hashes: https://www.virustotal.com/gui/search/9dcbe83b39985ca2b2b2047e123e73d860b838a576092ebc1895ba2af7f87711%250A8c3684a7dc88ad3cf2b3c29d8152261a5c789a7ed5f8919286b695b07cd77269%250Ab24dca7a4be8c8bf61d8e2c17bb596caee88f6f2aabda72c14dc6f0f3684bb87 https://twitter.com/BushidoToken/status/1411033476380385286/photo/1

• [2021-07-02 14:59:34] @JAMESWT_MHT Mentioned "samples belong to the same threat actor as Specter" https://bazaar.abuse.ch/browse/tag/45.67.230.53/ https://twitter.com/ESETresearch/status/1410864779229548546 https://twitter.com/JAMESWT_MHT/status/1410870749473148930/photo/1

• [2021-07-02 03:09:02] @elastic The new Threat Intel Filebeat module allows you to consume TI. normalize it into ECS. load it into Elasticsearch. and create Threat Match rules. Check out the default open source feeds from @abuse_ch. @anomali. @OTX. @MISPProject. and #MalwareBazaar https://go.es.io/3dymV28 https://twitter.com/elastic/status/1410691941172486148/photo/1

• [2021-07-02 03:04:06] @James_inthe_box #rustyloader #yara sig (thanks @Anti_Expl0it!): https://gist.github.com/silence-is-best/7b8211fc0ef0f35e1f71fa18fc91856b https://www.hybrid-analysis.com/yara-search/results/0421abd62bcc34b1e0a75b5e5d6a847a956113002cbe9b02be7a96fdf56edb86 cc @bry_campbell

• [2021-07-02 00:28:58] @FewAtoms @ValeryMarchive @fr0s7_ @James_inthe_box This count as plan a or c?:)) #malware #opendir hxxp://ourfirm.com/wordpress/bolo/bob/ hxxp://ourfirm.com/wordpress/bolo/ik/ hxxp://ourfirm.com/yav/ https://urlhaus.abuse.ch/host/ourfirm.com https://twitter.com/FewAtoms/status/1410651657495617539/photo/1

• [2021-07-01 17:08:11] @pollo290987 #asyncrat REFERENCIAS DE FACTURA PROGRAMADA PENDIENTE DE JUNIO.OLD.XLS.exe 8596052f4363bb3e6a757b49d0a6bc4e C2: /marcelajarakmisdhuakfsg.duckdns.org:5020

• [2021-06-29 22:47:22] @GossiTheDog It’s about a year old but if it helps research - https://www.virustotal.com/gui/file/f972e4c87614e56523b4a90b2735f556725fdd05386542c134223a773968fc94/detection https://twitter.com/cryptoinsane/status/1408205222669848581

• [2021-06-29 04:05:40] @chicfox https://nvs.quora.com/What-is-worse-than-narcissistic-abuse?ch= 2

• [2021-06-28 21:13:32] @James_inthe_box @SwearengenCyber @alex_lanstein @DaveMarcus mail.exe #bitrat #xenarmor c2: 79.134.225.115 edi.exe #remcos c2: 79.134.225.112

• [2021-06-28 03:00:54] @ffforward (Thread) Very well executed unidentified campaign from friday. ????#covid19 #vaccine malspam from /cov19inf.com on @bacloud. with SPF and DKIM. Attached encrypted xlsm with unique(?) password with macro on close that drops 6KB dll loader that downloads 7MB EXE. C2 /usergtarca.com https://twitter.com/ffforward/status/1409240342533181442/photo/1

• [2021-06-27 11:18:09] @hiramcoop La primera detección en Virus Total fue cuando subimos el archivo. Reporte: https://skty.cc/qu

• [2021-06-27 08:19:41] @lazyactivist192 @hacks4pancakes Oh no. that's too bad. Other than local historical societies. you could try contacting https://guides.lib.jjay.cuny.edu/SpecialCollections/Manuscripts and seeing if they'll take them. as it seems to match their other collections. It sounds like way too much to archive on your own. that's for sure

• [2021-06-26 03:06:06] @InQuest Some fresh. low detection (4/63) #qbot with a new coercive lure to add within https://inquest.net/malware-lures-gallery https://labs.inquest.net/dfi/sha256/20a72dc5350b296f2857911444fa065f5b0bb437be8d1bc61819cf29828a2955 A fun pivot on the XMP ID shows 4 related samples ingested from MalwareBazaar @abuse_ch https://labs.inquest.net/dfi/search/ioc/xmpid/xmp.did%3A0728ABF7826CEB11B13BD96D1C4ED12D @James_inthe_box @dmoore21 @bigmacjpg https://twitter.com/InQuest/status/1408516873457651712/photo/1

• [2021-06-26 03:04:36] @MBThreatIntel ???? New #Qbot #malspam: A new DocuSign template used to push Qbot Email -> Contains archive file -> Contains Excel file -> Drops Qbot -> Injects itself into Explorer.exe Maldocs: 27c2d85cc6aac0fe20bd951c18ac4731 27c2d85cc6aac0fe20bd951c18ac4731 66dca0051f3a152e092c5598137f7df6 https://twitter.com/MBThreatIntel/status/1408516497656500224/photo/1

• [2021-06-26 00:15:55] @James_inthe_box @benkow_ More onlyloggers: https://www.hybrid-analysis.com/string-search/results/6d2fe1a79899a6274d165cf74fd111b1efb203ef85708ce5229155bebd80b6c8

• [2021-06-23 19:05:41] @BushidoToken ☣️ Looks like #Lazarus or #GMERA? - MacOS 64-bit ARM executable - Detected as ‘Trojan.OSX.Nukesped’ https://www.virustotal.com/gui/file/80e58eb314d0d5e1a50be0c5fca0ca42cdda5e5297d6f7a2590840ac60504be1/detection Linked to a fake crypto trading app: https://www.virustotal.com/gui/file/8e9b77843611ae61276d9d7c50620ed08a2295b90baa37e2e0dc8a937ec089f2/relations cc @patrickwardle @TrendMicroRSRCH @ESETresearch @z0ul_

• [2021-06-23 18:23:01] @petrovic082 #opendir #vbs #dropper hxxps://ia601401.us.archive.org/25/items/bypass_obbv/ https://app.any.run/tasks/d8c197be-1a05-4874-8521-2f972680adcd/

• [2021-06-23 18:19:20] @petrovic082 #opendir #vbs #dropper hxxps://ia601409.us.archive.org/32/items/bypass1sd/ https://app.any.run/tasks/6f1e5ade-34c1-4a2d-b0b6-3c4e44a593c3/

• [2021-06-23 11:51:21] @DynamicAnalysis @GamerBo62385068 @KelliX84 @ABC11_WTVD Actual historians. There many sources like this. so maybe just do some research. https://www.wsws.org/en/articles/2019/12/28/nytr-d28.html

• 보이스피싱, 불법촬영물, 랜섬웨어, 사이버 안보위협 등에 관련된 사안의 경우 다음과 같은 기관 및 단체의 도움을 받을 수 있습니다. 노모어랜섬(No More Ransom) 경찰청 사이버범죄 신고시스템 국가정보원 민원센터