[N3mes1s]

Here are some examples of Trojan.Jokra (Symantec) used to target South Korean banks and media.

9263E40D9823AECF9388B64DE34EAE54
5FCD6E1DACE6B0599429D913850F0364
0A8032CD6B4A710B1771A080FA09FB87
DB4BBDC36A78A8807AD9B15A562515C4
F0E045210E3258DAD91D7B6B4D64E7F3
E4F66C3CD27B97649976F6F0DAAD9032
50E03200C3A0BECBF33B3788DAC8CD46

And few posts on it:
http://labs.alienvault.com/labs/index.p ... s-attacks/
http://labs.alienvault.com/labs/index.p ... n-attacks/
http://blogs.mcafee.com/mcafee-labs/sou ... ve-malware
http://www.symantec.com/security_respon ... 99&tabid=2
http://nakedsecurity.sophos.com/2013/03 ... er-attack/
http://www.symantec.com/connect/blogs/s ... ber-attack
http://asec.ahnlab.com/926 (korean) http://translate.google.com/translate?s ... ab.com/926 (en)

kudos to mila for examples

[hnpl2011]

Do anyone have the file load the modules and dropper?

Here are some examples of Trojan.Jokra (Symantec) used to target South Korean banks and media.

9263E40D9823AECF9388B64DE34EAE54
5FCD6E1DACE6B0599429D913850F0364
0A8032CD6B4A710B1771A080FA09FB87
DB4BBDC36A78A8807AD9B15A562515C4
F0E045210E3258DAD91D7B6B4D64E7F3
E4F66C3CD27B97649976F6F0DAAD9032
50E03200C3A0BECBF33B3788DAC8CD46

And few posts on it:
http://labs.alienvault.com/labs/index.p ... s-attacks/
http://labs.alienvault.com/labs/index.p ... n-attacks/
http://blogs.mcafee.com/mcafee-labs/sou ... ve-malware
http://www.symantec.com/security_respon ... 99&tabid=2
http://nakedsecurity.sophos.com/2013/03 ... er-attack/
http://www.symantec.com/connect/blogs/s ... ber-attack
http://asec.ahnlab.com/926 (korean) http://translate.google.com/translate?s ... ab.com/926 (en)

kudos to mila for examples

[N3mes1s]

More Insights on the Recent Korean Cyber Attacks (Trojan.Hastati) -
http://www.fireeye.com/blog/botnet-acti ... stati.html