찾아줄게요

BAK 파일은 무엇입니까?

• 안녕하세요. 제 컴퓨터에서 BAK라는 파일을 찾았는데 이것이 무엇인지 잘 모르겠습니다. 알려주시면 감사하겠습니다.

• BAK 파일은 백업파일 입니다. Various에서 배포한 파일인 것으로 보입니다. 2008-09-28 03:49:43에 처음으로 보고되었으며 2008-08-09 03:38:04에 마지막으로 보고되었습니다.

• 적절한 프로그램을 다운로드하여 BAK 파일을 열 수 있습니다.

• 갱신되기 전의 파일 정보를 담은 백업 파일. 새로 갱신된 파일에 문제가 생겼을 경우 bak 파일의 확장자 이름을 원래의 확장자 이름으로 변경하면 문제를 해결할 수 있다. 많은 응용 프로그램에서 이러한 용도로 bak확장자를 사용하며, 한글의 문서 백업 파일로도 익숙한 확장자명이다.

• 시그니처 정보가 없습니다.

• 연관 링크 #1: 첨부된 링크가 없습니다.

• 연관 링크 #2: 첨부된 링크가 없습니다.

• [2021-06-11 00:54:40] @InQuest ???? Malicious RTF document found hosted at: http///kabaka.ddns.net/udara/s.wbk SHA256: 26f6293f44f55be8db74c16fdf058186f274a73ff08a70ca9fd8dc686d4597a0 IOC extracted from sample: https://labs.inquest.net/dfi/hash/c853087b00852d651228497e4756694bdf9bef6959efab0d8bed99a6ced79158

• [2021-06-09 15:36:59] @JAMESWT_MHT @malwrhunterteam Yes qwqdanchun.sct https://bazaar.abuse.ch/sample/27dee096fbdbf0463ca2335b1d583acdc4f2886ca6452bc547a9efb8ae0fa738/ drop microsoft .com > #LimeRat / #LimeBak https://bazaar.abuse.ch/sample/d2d5f495be99faf5dcc31f16b20d08b31802215621595e3ffe3a56a2f69c5817/ Run https://app.any.run/tasks/5ce4da80-8a7f-46aa-99e3-b7510be2bf63

• [2021-06-09 12:01:32] @InQuest ???? Malicious RTF document found hosted at: http///kabaka.ddns.net/udara/a.wbk SHA256: ea4bbad3f142b2447af3603e1d3bbd37e81bb5343d99e910c8eb941450530dfc IOC extracted from sample: https://labs.inquest.net/dfi/hash/fc38d73c4dd651a49817f58fe70cf00fca3b3e4b3c1c062c4fa816cb1d95565c

• [2021-02-07 18:51:17] @Arkbird_SOLG Yep that from the December 2020 campaign in focusing Italian people. that use it as evasion method. that drops as JPG. cpl. bak. dll extensions on the victim computer. Some samples : https://tria.ge/201215-xt2p5df422/static1 https://www.hybrid-analysis.com/sample/f7c1f94e8341e44f51653d064855cb4746ba9f9a01de993deaa7fb2eca3499cf/5fdfc4cf4d02f02303080cc6 https://www.hybrid-analysis.com/sample/a8a30f99833a3c3b1a7b2e7f27b0718e0dddadda53501307eaaa57d1fe53206b/5fe0b7c9b17adc7f951f33fc https://twitter.com/SyscallE/status/1358226996015337472 https://twitter.com/Arkbird_SOLG/status/1358367725454827521/photo/1

• [2021-01-15 08:39:23] @executemalware As mentioned by others. the #emotet threat actors are on holiday today. I did see a handful of #hancitor emails. however. Here are the IOCs: https://pastebin.com/nK2BAkj9

• [2021-01-07 07:35:54] @ffforward @GossiTheDog Maybe disinfect the site too ???? https://www.dailydot.com/debug/baked-alaska-protest-covid/ https://twitter.com/ffforward/status/1346963734900715521/photo/1

• [2020-12-18 18:53:09] @JAMESWT_MHT #CobaltStrike #signed "BAKERA s.r.o." Sample https://bazaar.abuse.ch/sample/ad22df78d4ae26f57d3af0ab9c0b464037996878cf8d7772402dd60822136280/ >s://217.12.218.250/posts/32251816/ivc/7600 https://bazaar.abuse.ch/sample/be1495801bc2c3cbdf923c09d946a3e5cd957bee371dd09599a8ba2df1318be3/ h/t @malwrhunterteam @guelfoweb @Arkbird_SOLG @sugimu_sec @lazyactivist192 @fr0s7_ @Jan0fficial @JRoosen @ffforward @emd3l @VK_Intel @arieitan https://twitter.com/JAMESWT_MHT/status/1339886413530222593/photo/1

• [2020-12-15 06:08:46] @andpalmier https://www.portale.cliente.verifica.zzlifts.com/ ????️ @enom ???? @cpanel ☣️ 2607:f748:1301:0:184:107:112:66 (AS32613) ???? https://urlscan.io/result/3f0f8538-976b-4c66-bcdc-d773078aa214/ https://baking-intesa.com/ ????️ @openprovider ???? @letsencrypt ☣️ 45.87.80.51 (AS47583) ???? https://urlscan.io/result/3ac1f889-305f-4121-86db-255c21257fc5/ https://twitter.com/andpalmier/status/1338606886271193093/photo/1

• [2020-12-10 23:40:08] @InQuest ???? Malicious Office document found hosted at: http///bak0-store.com/cfg/3.dotm SHA256: 3502e70d145c4a0eed9c8c43ed4d3fe41854570a300b316692cf48d421411fa8 IOC extracted from sample: https://labs.inquest.net/dfi/hash/e32995a6e7eeff4b6c47e892a895cb0e4cc322a2fb6dabe17dbc27ebd4ffad55

• [2020-11-14 16:20:01] @Certego_Intel #Covid19 #CertStream #Suspicious Domain: saglikbakanligicoronavirus.online VirusTotal: https://www.virustotal.com/gui/domain/saglikbakanligicoronavirus.online #CyberSecurity #ThreatIntel (bot generated)

• [2020-11-05 03:04:57] @InQuest Assessing SaaS Email Provider Baked in Security 11/12/2020 2:00pm EST We have been feeding the most "interesting" #malware from our daily harvest through various mail providers to compare their detection and ID files able to bypass them all. Register: https://share.hsforms.com/1OOfoZgNUTASNBsQw9YE67g2jjh8 https://twitter.com/InQuest/status/1324065112932687873/photo/1

• [2020-10-26 21:43:10] @Cyb3rMik3 Weaponized document file including malicious macro categorized as Generic.Trojan: ????hxxps://aradshabake.com/2/LLC/4r8lwzkZD9v/ ▶️ https://www.hybrid-analysis.com/sample/95227869de8a78a3849b2366b12e97b15206afa1aa96bc293f009afb7906bfce

• [2020-10-23 03:38:06] @Cryptolaemus1 New #emotet Epoch 1 urls //primaage.com/wp-admin/is/ //uvibrands.com/QIG/ s://morrobaydrugandgift.com/wp-contentbak/T9M/ //autodidactai.com/wp-content/5SF/ s://cs.vitalero.com/wp-includes/Vf/ //arcadia-consult.com/wp-admin/6O/ //acheterpermis-deconduire.com/wp-admin/network/vv/

• [2020-10-22 14:35:43] @Cryptolaemus1 New #emotet Epoch 1 urls //swiftlogisticseg.com/wp-admin/jiX/ //www.paikapua.com/a0brac3/Y/ //gordon-and-son.com/wp-includes/n/ s://emmanuelmonastery.org/wp-admin/d/ s://www.afriwaste.app/wordpress/N7L/ //da-industrial.com/js/A4/ s://onepalate.biz/wp-content_bak/Bc/

• [2020-10-21 23:14:44] @Cryptolaemus1 URLhaus #emotet Epoch 3 IOC update https://pastebin.com/deabaKx4

• [2020-10-21 21:07:07] @Cryptolaemus1 New #emotet Epoch 1 urls 1/2 //michaelandrewsbakery.com/wp-admin/M/ //forsalebyowner247.com/wp-includes/8m/ //webgisjambi.com/wp-content/uploads/V5a/ s://tigerstormtraffic.com/wp-includes/h23/ s://optimisticdeals.com/wp-content/S/ //twogirlscleaning.com/openbayl/KaI/

• [2020-10-11 03:52:43] @InQuest ???? Assessing SaaS Email Provider Baked in Security ???? Webinar Thursday Oct 15th at 2PM EST An approach to validate an e-mail security stack's capability to block current real-world threats Register for the event here: https://share.hsforms.com/1OOfoZgNUTASNBsQw9YE67g2jjh8 #Infosec #Malware #threatintel https://twitter.com/InQuest/status/1315032538050686978/photo/1

• [2020-09-03 15:20:01] @Certego_Intel #Covid19 #Spam #Suspicious Domain: honeybakedjobs.com VirusTotal: https://www.virustotal.com/gui/domain/honeybakedjobs.com … #CyberSecurity #ThreatIntel (bot generated)

• [2020-07-03 16:06:15] @andsyn1 #android #malware hxxp://saglikbakanligipandemidestek.ml/{randomstring}/eDestek.apk 87.236.16.114 https://www.virustotal.com/gui/file/68a37d8955ab88d2f5b6b8f850dac5a790b67bb00837002d9c32c2bb0de5e82e … https://www.joesandbox.com/analysis/382012 cc @malwrhunterteam pic.twitter.com/1DeRX4wH33

• [2020-06-25 21:19:12] @ActorExpose phisher; [email protected]. [email protected] phishkit sample; https://pastebin.com/raw/kfrnbaK1 @PhishKitTracker @emailrepio @Spam404 @JCyberSec_ @miss_LN_

• [2020-05-27 06:23:16] @James_inthe_box Ultimately #remcos #rat c2: bakup.banif2abused.xyz

• [2020-05-25 18:57:47] @Deep_Ch_pandey They'll not share Bro. they'll share only half baked information for obvious reasons. Suggest you to pay attention on root. 'NetsupportMgr RAT''. Get the hashes and block it. at least for now.till we get the C2. you can refer to : https://www.virustotal.com/gui/file/4d24b359176389301c14a92607b5c26b8490c41e7e3a2abbc87510d1376f4a87/detection …

• [2020-05-22 01:39:32] @IpNigh #Phishing | #PhishKit | #PhishingKit Found and downloaded. URL:hxxps://bakerpatagonia.com/images/Bank-of-America/BOA/Verify-Your-Account/login.php Threat Actor Emails are attached below. Bot Generated pic.twitter.com/4EyHZcSyY9

• [2020-05-20 09:13:54] @IpNigh #Phishing | #PhishKit | #PhishingKit Found and downloaded. URL:hxxps://www.homemadefoodinkodambakkam.com/hxxps/34.237.113.1137474/sucursalpersonas.transaccionesbancolombia.com/mua/index.html Threat Actor Emails are attached below. Bot Generated pic.twitter.com/goRk19IT6J

• [2020-05-15 18:40:40] @mertcangokgoz Anubis Botnet Incident IOC hxxp://xn--saglk-bakanlg-20gbaktivasyon-1geib.com Name: 20gb_hediye_internet.apk Hash: 270861866a94ea525edd749a9304d0b8ac5b40ff53da02b953e4b54ec3ce9cd1 https://www.virustotal.com/gui/file/270861866a94ea525edd749a9304d0b8ac5b40ff53da02b953e4b54ec3ce9cd1/detection … @malwrhunterteam @JAMESWT_MHT @LukasStefanko

• [2020-05-05 23:14:12] @barisbalci1903 X banka adresinden gönderiliyormuş gibi "e-dekont.pdf.IMG" adlı bir ek ile crypto tarzı mailler gelmektedir. Sakın ola kanıp açmayın. Bilmediğiniz veya şüphelendiğiniz her şeyi telefondan açıp bakınız. Ya da aşağıdaki gibi sorgulatın.. https://www.virustotal.com/gui/file/606998b6a3524c3309df7d2d1c50cc014c0260c2d8b598126330ce813ae8f69a/detection …

• [2020-05-03 22:03:38] @mertcangokgoz Anubis Botnet Incident IOC hxxp://saglikbakanli-hediyeinternet.org Name: 20gb_hediye_internet.apk Hash: 62a78efa413d46363b4c56a3033eccb9b77d139b163d627ffcd148823df74f12 https://www.virustotal.com/gui/file/62a78efa413d46363b4c56a3033eccb9b77d139b163d627ffcd148823df74f12/detection … @malwrhunterteam

• [2020-05-02 18:00:04] @mertcangokgoz Anubis Botnet Incident IOC hxxp://saglikbakanligi-destek.org Name: basvuru_devlet_destegi.apk Hash: 0af1340716ae9c7e9817a3274b3c9b5b81d0418701f37b55439940f83e7a2f08 https://www.virustotal.com/gui/file/0af1340716ae9c7e9817a3274b3c9b5b81d0418701f37b55439940f83e7a2f08/detection … @malwrhunterteam @JAMESWT_MHT

• [2020-05-01 18:50:00] @mertcangokgoz Anubis Botnet Incident IOC hxxp://20gbaktiflestirturkiye.com/ Name: 20gb_hediye_internet.apk Hash: ef2c39a9b60bbc872acea5ea471ab1685ad412a8dca80bd065c5ab9a9bf4cc4b https://www.virustotal.com/gui/file/ef2c39a9b60bbc872acea5ea471ab1685ad412a8dca80bd065c5ab9a9bf4cc4b/detection … @malwrhunterteam

• [2020-04-23 20:42:20] @mertcangokgoz Anubis Botnet Incident IOC hxxp://saglikbakanligi20gbinternet.com Name: 20gb_hediye_internet.apk Hash: f95effa1b8108460331e784bb064ae098ad92efaa35dd17d0bd7c512200e44b1 https://www.virustotal.com/gui/file-analysis/NGQ0N2ZlOGFiZWE3YmI4ZGE5NjUxMDEyNWMyZTMzZGY6MTU4NzY0MTk1MQ= = /detection … @malwrhunterteam

• 보이스피싱, 불법촬영물, 랜섬웨어, 사이버 안보위협 등에 관련된 사안의 경우 다음과 같은 기관 및 단체의 도움을 받을 수 있습니다. 노모어랜섬(No More Ransom) 경찰청 사이버범죄 신고시스템 국가정보원 민원센터