Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Dissecting the Infection Chain: Technical Analysis of the Kimsuky JavaScript Dropper
Threat Actors
Malware Families
Excerpt
💡 All the samples and copies of the data exfiltrated by this sample referenced in this research blog can be found on our GitHub Repo Last month, our team came across a few X posts about indicators of compromise related to Kimsuky , a North Korean threat group that has been active since 2012. Kimsuky is predominantly responsible for conducting espionage operations against government entities, think tanks, and subject matter experts. The initial post that we saw…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | b1a0c340c2c8a17a7103275e0c809fe3aaf62fd9ef0f0600ef81e16808406689 | Medium | Score 53/100 | First seen |
| MD5 | 1a00387c696fe3b7ea9602c4cb91f14e | Medium | Score 53/100 | First seen |
| Domain | medianewsonline.com | High | Score 58/100 | First seen |
| SHA256 | 596cd0d30fe035e8be1dd9d78c1f71a8fc0e2c653d1318af26c51758339ca6bd | Medium | Score 53/100 | First seen |
| SHA1 | 31acdff6710ff1e5f0b310fc42c2005a972da7b2 | Medium | Score 53/100 | First seen |
| MD5 | 1010dabfa2662fd1007376f6ec814036 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…