🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89c4f041ca42b26bfd6279d99e374085227b3eb379cf2168684e594732a2c5b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kimsuky


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89c4f041ca42b26bfd6279d99e374085227b3eb379cf2168684e594732a2c5b7
SHA3-384 hash: b2303fe558dafc2dcef06f7e89965928d6365c3b5cdfa0ce5f9c1662d09726a870d39a5f3ef72806eaff6979808ca995
SHA1 hash: 70e741ffc98e27581ea34f354193f7186b161566
MD5 hash: 0d6f3ce0c314e611f4e933dd6c17f2e3
humanhash: pasta-georgia-comet-ten
File name:zzJG.zip
Download: download sample
Signature Kimsuky
Create hunting rule
File size:4'717 bytes
First seen:2025-02-05 09:10:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 96:Qy/RpdNGXpBHiymNmPjHYN1yxwkE9goWGdahhEcfG2n8rFXl7:QmT7G51iyyNcxLD3hhE4M/7
TLSH T1EBA16C88D78656AADDEC7274AB0D60212A3E470D3C8D56D71CC82904EC42305A8227F6
Magika zip
Reporter JAMESWT_WT
Tags:74-50-94-175 DropBox Kimsuky zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
IT IT
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:G3892.tmp
File size:7'890 bytes
SHA256 hash: 52cc4b42c9ada8a8fa51f8b38a0d1dc83cd8b07fba79d43c3a568d7f38496a41
MD5 hash: 99f9419d756729bc97d687f845d77783
MIME type:text/plain
Signature Kimsuky
File name:83972.tmp
File size:1'592 bytes
SHA256 hash: 4751a4f6ede387128f4438b852c7a722407f5118703e8cf0cc7c7293920769f4
MD5 hash: e96157d3b82008c5e3142a57584678cb
MIME type:text/plain
Signature Kimsuky
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.75805793.31641.8890.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67a32bfd2dcee78dd8197b5b
Tags:
malware
Result
Verdict:
Unknown
File Type:
ZIP File
Link:
https://app.docguard.net/89c4f041ca42b26bfd6279d99e374085227b3eb379cf2168684e594732a2c5b7/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/67a32aff288b2a13362ba504/reports/4a95fd8c-359a-4f13-bfbf-b0e3bb4cc9de/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/89c4f041ca42b26bfd6279d99e374085227b3eb379cf2168684e594732a2c5b7
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/89c4f041ca42b26bfd6279d99e374085227b3eb379cf2168684e594732a2c5b7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/89c4f041ca42b26bfd6279d99e374085227b3eb379cf2168684e594732a2c5b7/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-02-04 16:14:56 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
8 of 24 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rhcpaqokikzgx7lcphmz4n2aqurhwpvtphhsc2dijzmuomvcyw3q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution
Link:
https://tria.ge/reports/250205-l2awns1pdy/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/89c4f041ca42b26bfd6279d99e374085227b3eb379cf2168684e594732a2c5b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Kimsuky

zip 89c4f041ca42b26bfd6279d99e374085227b3eb379cf2168684e594732a2c5b7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3428530/
  
Delivery method
Distributed via web download

Comments