Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery
Threat Actors
Malware Families
Excerpt
by Robin Dost Subscribe Newsletter Actor tracking: APT43 (Kimsuky) / MB-0010 I can’t sleep right now, because it’s too hot in Germany, so i thought why not finishing an analysis i almost forgot about. In this analysis i am using Malwarebox Tooling for most of my work. Everything started with a suspicious CHM sample arriving in MANTIS . SHA256: 0efbd18c77479b458078521c18bdad84852b71250122a17cb8105c10d3df38d4 Infection overview The observed chain can be…
Read the original report →Diamond Model
Adversary(3)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 26ba5b01f614a215b948a5700338575412dcff2df972b7696b2c8c3f3b74a723 | Medium | Score 53/100 | First seen |
| SHA256 | 21781885f9d6ebc5f9e0f828aacbe3db2aaa1c142bda1495b17e723c9912f826 | Medium | Score 53/100 | First seen |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | Medium | Score 56/100 | First seen |
| SHA256 | 962e7a2a0b6ea9926f2198db06aa1d67326a75de7168400f8863fe7a23e51ef8 | Medium | Score 53/100 | First seen |
| SHA256 | 0efbd18c77479b458078521c18bdad84852b71250122a17cb8105c10d3df38d4 | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…