Cybereason Kimsuky November 2020

KGH_SPY can send a file containing victim system information to C2.

CSPY Downloader has been packed with UPX.

KGH_SPY has used encrypted strings in its installer.

CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.

KGH_SPY has masqueraded as a legitimate Windows tool.

KGH_SPY has the ability to set the HKCU\Environment\UserInitMprLogonScript Registry key to execute logon scripts.

KGH_SPY can exfiltrate collected information from the host to the C2 server.

CSPY Downloader can use the schtasks utility to bypass UAC.

KGH_SPY can perform keylogging by polling the GetAsyncKeyState() function.

KGH_SPY can execute PowerShell commands on the victim's machine.

KGH_SPY has the ability to set a Registry key to run a cmd.exe command.

CSPY Downloader has the ability to remove values it writes to the Registry.

CSPY Downloader has the ability to self delete.

Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.

KGH_SPY can send data to C2 with HTTP POST requests.

CSPY Downloader can use GET requests to download additional payloads from C2.

KGH_SPY can save collected system information to a file named "info" before exfiltration.

KGH_SPY can enumerate files and directories on a compromised host.

KGH_SPY has the ability to download and execute code from remote servers.

CSPY Downloader can download additional tools to a compromised host.

CSPY Downloader can write to the Registry under the %windir% variable to execute tasks.

KGH_SPY can harvest data from mail clients.

KGH_SPY can decrypt encrypted strings and write them to a newly created folder.

KGH_SPY has been spread through Word documents containing malicious macros.

CSPY Downloader has been delivered via malicious documents with embedded macros.

Kimsuky has used spearphishing attachments to entice victims into opening malicious files, including LNK files disguised with tailored filenames and fake extensions. Kimsuky has also delivered malicious payloads within archive files (e.g., ZIP), which display decoy documents upon execution while running malicious code in the background.

CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.

KGH_SPY can collect information on installed applications.

CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.

CSPY Downloader has come signed with revoked certificates.

KGH_SPY can collect credentials from WINSCP.

KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.

KGH_SPY can collect credentials from the Windows Credential Manager.

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns. Kimsuky has also distributed emails with attached compressed zip files that contained malicious .LNK files masquerading as legitimate files. Kimsuky has delivered tailored PDF documents that contain malicious links.

Kimsuky has registered domains to spoof targeted organizations and trusted third parties including search engines, web platforms, and cryptocurrency exchanges.

KGH_SPY can collect drive information from a compromised host.