Rewterz Threat Alert – Kimsuky APT Group – Active IOCs

Severity

High

Analysis Summary

Kimsuky is a North Korean threat actor that has been active since 2012, primarily focuses on government entities in South Korea, and conducts espionage campaigns against targets in the U.S. and Japan. The Kimsuky group can set up phishing infrastructure to effectively mimic well-known websites and trick victims to enter their credentials. “This is one of the main methods used by this actor to collect email addresses that later will be used to send spear-phishing emails.” Earleir this year, a mobile malware researcher has shared information about a fake KISA vaccine or a security android app disguised as the KISA security program deployed by Kimsuky group. When the target downloads the APK implanted file from the email and installs the application on his device, the malicious code does its job. It executes in the background without the target’s knowledge and collects sensitive information from his device.

Impact

• Information theft and espionage
• Exposure of sensitive data

Indicators of Compromise

Filename

• version[.]dll
• AutoCheckUpdate[.]dll
• KaoUpdate[.]ini
• 210927 코로나 대응(보령-태안1)취합수정[.]PIF
• Icon[.]pif

MD5

• 1976fe2bc1011c02ff50c807f97cb230
• 3c47e1074f0845f50b615f1fb99b3bd8
• caa1a847d0ae3f3d647474f5db9069bf
• c019e4bd1d192e08c56135a501a828fe
• 946f787c129bf469298aa881fb0843f4
• e33a34fa0e0696f6eae4feba11873f56

SHA-256

• 8e263345cfeda4eb6720c47d4eaaee236be294fda693d840199f221d6e1412c6
• 82067ef8b907888f9fc27dd0630c37c95b0a55a7c225fb2d693115c41c7dd5be
• 324b2e2c0471e49c7cc07725a7d748041479714d265ec6dbf386edd3f619f03c
• db88dc539bccce8c30e3ba6897171989c9a340f23075c614f3c5a73ae0160db1
• 32beeda8cffc2ecc689ea2529194cf806955879a334ec68176864d1e6c09800c
• 2c7f26d99229d7166692c8f311fc5abfb915789ba4bfefb217fc01415fafc69c

SHA-1

• b2a7a51e635574e183f88008f21f98be67e23f85
• 27d24f3015a90b4621dc83230ad4157a0c8a4548
• 2e9175a3c23582d4da1368c044ffe565d5edb0f7
• 9627869159bda2174f75ed5ae41b487f91b0320e
• d3b233d6d8b11235929e4a0cbdb12eefdd47d927
• e9cf98a00cad3499bbc07c3cc3d9029593295bd5

URL

• http[:]//beast[.]16mb[.]com/
• http[:]//greatname[.]000webhostapp[.]com/
• http[:]//ping[.]requests[.]p-e[.]kr/
• http[:]//ppahjcz[.]tigerwood[.]tech/
• http[:]//movie[.]youtoboo[.]kro[.]kr/test[.]php

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.
• Do not download software and files from unofficial and untrusted sources.