MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58ed2920063d16078decd59bcf02229022dc15d4f3a4c96fca6d2b8752322ec9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Kimsuky

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	58ed2920063d16078decd59bcf02229022dc15d4f3a4c96fca6d2b8752322ec9
SHA3-384 hash:	72f86fa573e42ec7c7fb96c0e50846ea3665865db529bd72be2637544c7ce322bd84d0db38e78fb7ac56f3dc800ce29e
SHA1 hash:	5177e1d318b249304654d418bf8acc03e6843afb
MD5 hash:	1cfef99f68b749d81736397e652c3d87
humanhash:	music-friend-solar-mirror
File name:	Interview by Reuters(SeanKing).msc
Download:	download sample
Signature	Kimsuky Create hunting rule
File size:	146'568 bytes
First seen:	2024-05-30 10:03:18 UTC
Last seen:	Never
File type:
MIME type:	text/xml
ssdeep	384:IZfYzUHBI0D2CbiiNPyVIB7nstz5R0l5V5qr:omUHTD9iiNPydzRu9qr
TLSH	T1BDE35B738EC82BF4874A2961061FF7628D592F636052A0B3384D7D961E166B08F5F73D
Reporter	smica83
Tags:	apt Kimsuky MSC

Intelligence

File Origin

# of uploads :

# of downloads :

195

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.DeepScan.Generic.KimsukyCml.A.FFFFFFFE.13742.15699.UNOFFICIAL

SecuriteInfo.com.DeepScan.Generic.KimsukyCml.A.FFFFFFFE.8049.29060.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=665a173020ad30d287679088win7simulatehigh_evasion

Tags:

Banker Kimsukycml Dexter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/66584f1b458fabe8a95d36cb/reports/601f5b5e-b9d8-4ed5-a6c7-bd0392f55391/overview

Verdict:

Malicious

Labled as:

DeepScan:Generic.KimsukyCml.A

Link:

https://www.hybrid-analysis.com/sample/58ed2920063d16078decd59bcf02229022dc15d4f3a4c96fca6d2b8752322ec9

Score:

33%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/58ed2920063d16078decd59bcf02229022dc15d4f3a4c96fca6d2b8752322ec9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/58ed2920063d16078decd59bcf02229022dc15d4f3a4c96fca6d2b8752322ec9/

Threat name:

Text.Trojan.KimsukyCml

Status:

Malicious

First seen:

2024-05-29 21:20:38 UTC

File Type:

Text (XML)

AV detection:

5 of 24 (20.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ldwssiaghulapdpm2wn46arcsarnyfou6osms36knuvyoursf3eq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kimsuky

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/58ed2920063d16078decd59bcf02229022dc15d4f3a4c96fca6d2b8752322ec9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.