MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kimsuky


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885
SHA3-384 hash: 90d942628f25a524142f561d6a5a6a50f0cef9d5eb0188a2a318c68dafe98c3e95327899a27ed3390bb827d07c3e479a
SHA1 hash: 576b953cb4fe71adb71a338a42524b0e424824c1
MD5 hash: c861f25bb943f77a909b33d62bb71926
humanhash: neptune-beryllium-violet-blue
File name:fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885
Download: download sample
Signature Kimsuky
Create hunting rule
File size:485'888 bytes
First seen:2021-11-03 12:04:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 135958949bbabf35c044a2b7dd89f880 (2 x Kimsuky)
ssdeep 6144:xE/Np5g0cqbMwItonwEW9m37Z1BsJOtYVOP/7OXohDxL4W587isn2:OMSnwEJ37ZbOOL7OXocW58j
TLSH T171A44B2D59A5027DD0BBD178C5974983F675380A23BADDAF03C042B31E53BE1AE7A718
Reporter JAMESWT_WT
Tags:exe Kimsuky


Avatar
JAMESWT_WT
#Kimsuky

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885_kimsuky.dll
Verdict:
No threats detected
Analysis date:
2021-05-25 12:21:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/39e57b84-b300-4d61-8f5b-f00a34c592fa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/201762/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Running batch commands
Self-deleting of the BAT file
Launching a process
Creating a process with a hidden window
Deleting a recently created file
DNS request
Setting a single autorun event
Deleting of the original file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61827af6bf51178dbe4c4eba/reports/4aec4b79-8682-4810-b90a-299acbf8a40b/overview
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e96e7b2c-cc40-428a-ae20-6938d1b7cdad
Result
Threat name:
Kimsuky
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/882158
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Writes many files with high entropy
Yara detected Kimsuky
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 514591 Sample: 5HCF3LLFe5 Startdate: 03/11/2021 Architecture: WINDOWS Score: 100 74 anto.shore.ml 2->74 84 Multi AV Scanner detection for domain / URL 2->84 86 Antivirus detection for dropped file 2->86 88 Antivirus / Scanner detection for submitted sample 2->88 90 3 other signatures 2->90 9 regsvr32.exe 2->9         started        13 loaddll64.exe 16 2->13         started        15 regsvr32.exe 2->15         started        signatures3 process4 dnsIp5 76 anto.shore.ml 9->76 78 192.168.2.1 unknown unknown 9->78 60 C:\ProgramData\temp\FD2F.tmp.zip, Zip 9->60 dropped 62 C:\ProgramData\temp\FD2F.tmp.enc, data 9->62 dropped 64 C:\ProgramData\temp\FD2F.tmp, JPEG 9->64 dropped 66 21 other malicious files 9->66 dropped 17 regsvr32.exe 1 23 13->17         started        21 iexplore.exe 1 55 13->21         started        23 rundll32.exe 15 13->23         started        25 6 other processes 13->25 file6 process7 file8 54 unknown (copy), PE32+ 17->54 dropped 56 C:\ProgramData\Software\...\WDFSync.dll, PE32+ 17->56 dropped 58 C:\...\WDFSync.dll:Zone.Identifier, ASCII 17->58 dropped 80 System process connects to network (likely due to code injection or exploit) 17->80 82 Writes many files with high entropy 17->82 27 cmd.exe 1 17->27         started        29 cmd.exe 1 17->29         started        31 regsvr32.exe 17->31         started        33 iexplore.exe 137 21->33         started        36 cmd.exe 1 23->36         started        38 cmd.exe 23->38         started        42 2 other processes 23->42 40 rundll32.exe 25->40         started        44 2 other processes 25->44 signatures9 process10 dnsIp11 46 conhost.exe 27->46         started        48 conhost.exe 29->48         started        68 anto.shore.ml 33->68 70 geolocation.onetrust.com 104.20.184.68 CLOUDFLARENETUS United States 33->70 72 7 other IPs or domains 33->72 50 conhost.exe 36->50         started        52 conhost.exe 38->52         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885/
Threat name:
Win64.Spyware.Xegumumune
Create hunting rule
Status:
Malicious
First seen:
2021-05-24 21:12:13 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  2/5
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/211103-n869kadff9/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
Enumerates connected drives
Deletes itself
Loads dropped DLL
Unpacked files
SH256 hash:
fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885
MD5 hash:
c861f25bb943f77a909b33d62bb71926
SHA1 hash:
576b953cb4fe71adb71a338a42524b0e424824c1
Detections:
win_kimsuky_auto
Create hunting rule
Link:
https://www.unpac.me/results/0e6ac610-abc7-4d3d-b5db-71a470650a14/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_RAT
Create hunting rule
Rule name:APT_RAT
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/201762/

Comments