MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56a90f247ccffb63543d99a659f9517edde587f6e85752c82a9919e325de3ee5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kimsuky


Vendor detections: 12


Intelligence 12 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56a90f247ccffb63543d99a659f9517edde587f6e85752c82a9919e325de3ee5
SHA3-384 hash: b2d22d9e28138d8a2a17ff2bc9640d1b9347ffa755c709718c3a7af70f875d1ea620ffb6012d4f8d2e9f31f6097d0221
SHA1 hash: e687448d520cb3475b576a3fcd4c43fc018053c1
MD5 hash: 13557e48d64dbce89086b1077e5c087e
humanhash: zulu-tango-juliet-jersey
File name:Shadows of BlackwoodHotel.pdf.lnk
Download: download sample
Signature Kimsuky
Create hunting rule
File size:94'489 bytes
First seen:2026-06-18 12:39:36 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/x-ms-shortcut
ssdeep 1536:cWGsLhC8GbhS0Ih0aac70BXw2Rx+Jgmx0+o20pc1+g1v:cMLhC8MyWW70Jw5ipc1+gh
TLSH T148936D6F851EC657EB30E6AB17DA918375008D9A2065DF52B4FF8B3A7204C0972E472F
Magika lnk
Reporter smica83
Tags:Kimsuky lnk

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
LNK
Details
Link:
https://research.acce.ciphertechsolutions.com/results/85f5f9cc-9a7d-4d7f-ac0a-37c8263ce039/
Detection(s):
Sanesecurity.Malware.30517.LnkHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30537.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a33e7141548daf709f7979e
Tags:
xtreme shell virus
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/56a90f247ccffb63543d99a659f9517edde587f6e85752c82a9919e325de3ee5/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 evasive fingerprint masquerade powershell
Link:
https://www.filescan.io/uploads/6a33e71b90632a45f729e553/reports/916cf621-c49c-4be8-974e-42b7d9214762/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/56a90f247ccffb63543d99a659f9517edde587f6e85752c82a9919e325de3ee5
Verdict:
Malicious
File Type:
lnk
First seen:
2026-06-16T20:46:00Z UTC
Last seen:
2026-06-19T21:08:00Z UTC
Hits:
~10
Detections:
Trojan.WinLNK.Agent.sb HEUR:Trojan.WinLNK.Powecod.e HEUR:Trojan.WinLNK.Agent.gen
Link:
https://opentip.kaspersky.com/56a90f247ccffb63543d99a659f9517edde587f6e85752c82a9919e325de3ee5/results?tab=lookup
Result
Threat name:
Kimsuky
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1929931
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Leaks process information
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Potential dropper URLs found in powershell memory
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Parent Double Extension File Execution
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Uses an obfuscated file name to hide its real file extension (double extension)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows shortcut file (LNK) contains suspicious command line arguments
Windows shortcut file (LNK) starts blacklisted processes
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Kimsuky
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1929931 Sample: Shadows of BlackwoodHotel.pdf.lnk Startdate: 18/06/2026 Architecture: WINDOWS Score: 100 49 ch.10001mb.com 2->49 59 Malicious sample detected (through community Yara rule) 2->59 61 Antivirus detection for URL or domain 2->61 63 Antivirus detection for dropped file 2->63 65 16 other signatures 2->65 10 powershell.exe 11 2->10         started        13 wscript.exe 2->13         started        15 svchost.exe 1 1 2->15         started        signatures3 process4 dnsIp5 69 Windows shortcut file (LNK) starts blacklisted processes 10->69 71 Suspicious powershell command line found 10->71 73 Encrypted powershell cmdline option found 10->73 75 Found suspicious powershell code related to unpacking or dynamic code loading 10->75 18 powershell.exe 10->18         started        20 conhost.exe 1 10->20         started        77 Wscript starts Powershell (via cmd or directly) 13->77 79 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->79 81 Suspicious execution chain found 13->81 83 WScript reads language and country specific registry keys (likely country aware script) 13->83 22 powershell.exe 13->22         started        57 127.0.0.1 unknown unknown 15->57 signatures6 process7 signatures8 25 powershell.exe 14 41 18->25         started        30 Acrobat.exe 18 57 18->30         started        67 Potential dropper URLs found in powershell memory 22->67 32 conhost.exe 22->32         started        34 cscript.exe 22->34         started        process9 dnsIp10 55 ch.10001mb.com 185.27.134.116, 49706, 49713, 49716 WILDCARD-ASWildcardUKLimitedGB United Kingdom 25->55 43 C:\Users\user\AppData\Local\Temp\aes.js, ASCII 25->43 dropped 45 C:\Users\user\AppData\Local\...\t2qQ1qN.vbs, ASCII 25->45 dropped 47 C:\Users\user\AppData\Local\...\lpGv0Py.ps1, Unicode 25->47 dropped 85 Loading BitLocker PowerShell Module 25->85 36 cscript.exe 25->36         started        38 AcroCEF.exe 93 30->38         started        file11 signatures12 process13 process14 40 AcroCEF.exe 3 38->40         started        dnsIp15 51 52.6.155.20, 443, 49702 AMAZON-AES-AmazoncomIncUS United States 40->51 53 23.38.160.198, 443, 49707 AKAMAI-AS-AkamaiTechnologiesIncUS United States 40->53
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56a90f247ccffb63543d99a659f9517edde587f6e85752c82a9919e325de3ee5/
Verdict:
Malicious
Threat:
Trojan.WinLNK.Powecod
Link:
https://tip.neiki.dev/file/56a90f247ccffb63543d99a659f9517edde587f6e85752c82a9919e325de3ee5
Threat name:
Shortcut.Trojan.WinLnk
Create hunting rule
Status:
Malicious
First seen:
2026-06-16 23:26:00 UTC
File Type:
Binary
Extracted files:
1
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k2uq6jd4z75wgvb5tgtft6krp3o6lb7w5blvfsbktem6gjo6h3sq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution
Link:
https://tria.ge/reports/260618-pv1qasfz9q/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Checks computer location settings
Deletes itself
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
http://ch.10001mb.com/mort.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56a90f247ccffb63543d99a659f9517edde587f6e85752c82a9919e325de3ee5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Detect_Zoom_Invite_malware_RAT_C2
Create hunting rule
Author:daniyyell
Description:Detects Zoom Invite Call Leading to Malware Hosted in Telegram C2
Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:High_Entropy_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file with equal or higher entropy than 6.5. Most goodware LNK files have a low entropy, lower than 6.
Rule name:INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC
Create hunting rule
Author:ditekSHen
Description:Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Rule name:PDF_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies Adobe Acrobat artefacts in shortcut (LNK) files. A PDF document is typically used as decoy in a malicious LNK.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.
Rule name:SUSP_Scheduled_Tasks_Create_From_Susp_Dir
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_ClickFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects ClickFix social engineering technique using 'Verify you are human' messages and malicious PowerShell commands
Reference:ClickFix social engineering and malicious PowerShell commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments