Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
9 malicious · 1020 files
ZIPa35009c5658f9170a51ae32095547398ZIP Archive
ZIPKimsuky-Android-RAT-Client-main.zipextracted from ZIP Archive · ZIP Archive
ZIPencase_keyword_kimsuky-main.zipextracted from ZIP Archive · ZIP Archive
BINencase_keyword_kimsuky-main
MDREADME.mdextracted from ZIP Archive
PS1keywordextracted from ZIP Archive · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
ZIPkimsuky-main (1).zipextracted from ZIP Archive · ZIP Archive
ZIPKimsuky-main.zipextracted from ZIP Archive · ZIP Archive
ZIPKimsuky_leak_rksrc_20230201_rootkit-main.zipextracted from ZIP Archive · ZIP Archive
BINKimsuky_leak_rksrc_20230201_rootkit-main
BIN.~lock.技术说明书 - 22.docx#extracted from ZIP Archive
TXT0. 使用.txtextracted from ZIP Archive
TXT1. build ko .txtextracted from ZIP Archive
OFF1.ko 图文编译 .docextracted from ZIP Archive · MS Office Document
OFF[Repaired @0x0000D4A2]sub-stream · MS Office Document
XML[Content_Types].xmlextracted from MS Office Document · XML
BINDataextracted from MS Office Document
OFF1Tableextracted from MS Office Document · MS Office Document
OFF[Repaired @0x000006A2]sub-stream · MS Office Document
BINCompObjextracted from MS Office Document
BINWordDocumentextracted from MS Office Document
BINSummaryInformationextracted from MS Office Document
BINDocumentSummaryInformationextracted from MS Office Document
TXT1.ko_compile.txtextracted from ZIP Archive
TXT1111.txtextracted from ZIP Archive
MDREADME.mdextracted from ZIP Archive
ELFclientextracted from ZIP Archive · ELF Executable
TXTre 正向工具修改建议 1.0 .txtextracted from ZIP Archive
DOC~$ko 图文编译 .docextracted from ZIP Archive
DOCX~$说明书 - 22.docxextracted from ZIP Archive
DOC技术说明书 - 22.docxextracted from ZIP Archive · MS Word Document
TXT技术说明书_22.txtextracted from ZIP Archive
MD源码注释说明.mdextracted from ZIP Archive
ZIPKimsuky-PS-Backdoor-main.zipextracted from ZIP Archive · ZIP Archive
ZIPKimsuky-master.zipextracted from ZIP Archive · ZIP Archive
Deobfuscated PowerShell
UNKNWOWNmalicious
frombahuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
9 malicious · 1020 files
ZIPa35009c5658f9170a51ae32095547398ZIP Archive
ZIPKimsuky-Android-RAT-Client-main.zipextracted from ZIP Archive · ZIP Archive
ZIPencase_keyword_kimsuky-main.zipextracted from ZIP Archive · ZIP Archive
BINencase_keyword_kimsuky-main
MDREADME.mdextracted from ZIP Archive
PS1keywordextracted from ZIP Archive · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
ZIPkimsuky-main (1).zipextracted from ZIP Archive · ZIP Archive
ZIPKimsuky-main.zipextracted from ZIP Archive · ZIP Archive
ZIPKimsuky_leak_rksrc_20230201_rootkit-main.zipextracted from ZIP Archive · ZIP Archive
BINKimsuky_leak_rksrc_20230201_rootkit-main
BIN.~lock.技术说明书 - 22.docx#extracted from ZIP Archive
TXT0. 使用.txtextracted from ZIP Archive
TXT1. build ko .txtextracted from ZIP Archive
OFF1.ko 图文编译 .docextracted from ZIP Archive · MS Office Document
OFF[Repaired @0x0000D4A2]sub-stream · MS Office Document
XML[Content_Types].xmlextracted from MS Office Document · XML
BINDataextracted from MS Office Document
OFF1Tableextracted from MS Office Document · MS Office Document
OFF[Repaired @0x000006A2]sub-stream · MS Office Document
BINCompObjextracted from MS Office Document
BINWordDocumentextracted from MS Office Document
BINSummaryInformationextracted from MS Office Document
BINDocumentSummaryInformationextracted from MS Office Document
TXT1.ko_compile.txtextracted from ZIP Archive
TXT1111.txtextracted from ZIP Archive
MDREADME.mdextracted from ZIP Archive
ELFclientextracted from ZIP Archive · ELF Executable
TXTre 正向工具修改建议 1.0 .txtextracted from ZIP Archive
DOC~$ko 图文编译 .docextracted from ZIP Archive
DOCX~$说明书 - 22.docxextracted from ZIP Archive
DOC技术说明书 - 22.docxextracted from ZIP Archive · MS Word Document
TXT技术说明书_22.txtextracted from ZIP Archive
MD源码注释说明.mdextracted from ZIP Archive
ZIPKimsuky-PS-Backdoor-main.zipextracted from ZIP Archive · ZIP Archive
ZIPKimsuky-master.zipextracted from ZIP Archive · ZIP Archive
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
frombahuhuhuhuhuhuhuhuhuhuhu
a35009c5658f9170a51ae32095547398 › encase_keyword_kimsuky-main.zip › encase_keyword_kimsuky-main › keyword
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.
