MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 625f912f4bdb5df0f2584f6b162c8602e5bb756b4853b94a12b9b9dadc25b915. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kimsuky


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 625f912f4bdb5df0f2584f6b162c8602e5bb756b4853b94a12b9b9dadc25b915
SHA3-384 hash: 128b8a945a37ce5a9d1d801e2b2ef88bff9767cea7049018a4438bbeece67c7d237617b5ef51cfc216657478ff9265cc
SHA1 hash: 5b03dd1ece961e28febcfcb582ca58edd39da526
MD5 hash: d555e46e36e34da5779145fa8ae8bed9
humanhash: sad-december-oscar-nitrogen
File name:작물보호제 공급 검토 품목 제안서.lnk
Download: download sample
Signature Kimsuky
Create hunting rule
File size:68'502 bytes
First seen:2026-07-21 10:56:55 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/x-ms-shortcut
ssdeep 1536:Q0SfF2p88+94VV8FFOvwhnpmAhi/ldSjXvU:QFfF2n+94oFovw9DhLbU
TLSH T14B63BF21AFEA0E48FD53CE3125F871EB483F714249E0A8590C6B4D5A4091CADE977F97
Magika lnk
Reporter smica83
Tags:apt Kimsuky lnk

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Malware configuration found for:
LNK
Details
Link:
https://research.acce.ciphertechsolutions.com/results/986b6ebe-4800-41c5-8853-a59c419fe135/
Detection(s):
Lnk.Downloader.ToyBox-10045437-0
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5f50a585479d70bfb79435
Tags:
obfuscate shell sage
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/625f912f4bdb5df0f2584f6b162c8602e5bb756b4853b94a12b9b9dadc25b915/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm cmd downloader evasive fingerprint lolbin
Link:
https://www.filescan.io/uploads/6a5f509ec16e5ef6f54ac691/reports/20bbe455-16cd-448f-91b3-42c5b55a6878/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/625f912f4bdb5df0f2584f6b162c8602e5bb756b4853b94a12b9b9dadc25b915
Verdict:
Malicious
File Type:
lnk
First seen:
2026-07-21T08:45:00Z UTC
Last seen:
2026-07-21T09:15:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/625f912f4bdb5df0f2584f6b162c8602e5bb756b4853b94a12b9b9dadc25b915/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1945787
Signature
AI detected malicious Powershell script
Antivirus / Scanner detection for submitted sample
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Uses nslookup.exe to query domains
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows shortcut file (LNK) contains suspicious command line arguments
Windows shortcut file (LNK) starts blacklisted processes
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1945787 Sample: #Uc791#Ubb3c#Ubcf4#Ud638#Uc... Startdate: 21/07/2026 Architecture: WINDOWS Score: 100 60 edge-block-api-env.dropbox-dns.com 2->60 62 content.dropboxapi.com 2->62 64 3 other IPs or domains 2->64 78 Antivirus / Scanner detection for submitted sample 2->78 80 Windows shortcut file (LNK) starts blacklisted processes 2->80 82 Multi AV Scanner detection for submitted file 2->82 84 6 other signatures 2->84 10 wscript.exe 1 1 2->10         started        13 wscript.exe 2->13         started        15 cmd.exe 2->15         started        signatures3 process4 signatures5 86 Windows shortcut file (LNK) starts blacklisted processes 10->86 88 Wscript starts Powershell (via cmd or directly) 10->88 90 Bypasses PowerShell execution policy 10->90 96 2 other signatures 10->96 17 powershell.exe 14 16 10->17         started        92 WScript reads language and country specific registry keys (likely country aware script) 13->92 21 powershell.exe 13->21         started        94 Encrypted powershell cmdline option found 15->94 23 powershell.exe 15->23         started        25 cmd.exe 1 15->25         started        27 Conhost.exe 15->27         started        process6 dnsIp7 54 edge-block-api-env.dropbox-dns.com 162.125.2.14, 443, 49773, 49776 DROPBOX-DropboxIncUS United States 17->54 56 api-env.dropbox-dns.com 162.125.2.19, 443, 49772, 49775 DROPBOX-DropboxIncUS United States 17->56 74 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 17->74 76 Uses nslookup.exe to query domains 17->76 29 nslookup.exe 1 17->29         started        32 conhost.exe 17->32         started        34 nslookup.exe 1 21->34         started        36 conhost.exe 21->36         started        38 tar.exe 3 23->38         started        41 Acrobat.exe 20 57 23->41         started        43 attrib.exe 1 23->43         started        45 attrib.exe 1 23->45         started        signatures8 process9 dnsIp10 66 myip.opendns.com 29->66 68 220.222.67.208.in-addr.arpa 29->68 70 myip.opendns.com 34->70 72 220.222.67.208.in-addr.arpa 34->72 52 C:\ProgramData\vc_lib\advpackx.ps1, ASCII 38->52 dropped 47 AcroCEF.exe 74 41->47         started        file11 process12 process13 49 AcroCEF.exe 3 47->49         started        dnsIp14 58 23.62.176.141, 443, 49771 AKAMAI-AS-AkamaiTechnologiesIncUS United States 49->58
Verdict:
Malware
YARA:
4 match(es)
Tags:
Batch Command DeObfuscated Execution: CMD in LNK Execution: PowerShell in LNK LNK LOLBin LOLBin:cmd.exe Malicious PowerShell PowerShell Call T1027 T1059.001 T1059.003 T1202: Indirect Command Execution T1204.002
Link:
https://app.malva.re/file/d555e46e36e34da5779145fa8ae8bed9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/625f912f4bdb5df0f2584f6b162c8602e5bb756b4853b94a12b9b9dadc25b915/
Threat name:
Shortcut.Trojan.Pantera
Create hunting rule
Status:
Malicious
First seen:
2026-07-21 10:57:48 UTC
File Type:
Binary
AV detection:
14 of 36 (38.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjpzcl2l3no7b4syj5vrmlegals3w5lljbj3ssqsxg45vxbfxekq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware defense_evasion discovery execution spyware
Link:
https://tria.ge/reports/260721-m2kljsfs4s/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Hide Artifacts: Hidden Files and Directories
Command and Scripting Interpreter: PowerShell
Indicator Removal: File Deletion
Checks computer location settings
Deletes itself
Unexpected DNS network traffic destination
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/625f912f4bdb5df0f2584f6b162c8602e5bb756b4853b94a12b9b9dadc25b915

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Archive_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies archive (compressed) files in shortcut (LNK) files.
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:High_Entropy_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file with equal or higher entropy than 6.5. Most goodware LNK files have a low entropy, lower than 6.
Rule name:PDF_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies Adobe Acrobat artefacts in shortcut (LNK) files. A PDF document is typically used as decoy in a malicious LNK.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments