Malwarebytes Kimsuky June 2021

AppleSeed can collect data on a compromised host.

AppleSeed can use a second channel for C2 when the primary channel is in upload mode.

AppleSeed can identify the IP of a targeted system.

AppleSeed can find and collect data from removable media devices.

AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.

Kimsuky has packed malware with UPX.

AppleSeed has used UPX packers for its payload DLL.

AppleSeed can disguise JavaScript files as PDFs.

AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.

AppleSeed can exfiltrate files via the C2 channel.

AppleSeed can use GetKeyState and GetKeyboardState to capture keystrokes on the victim’s machine.

AppleSeed can enumerate the current process on a compromised host.

AppleSeed has the ability to execute its payload via PowerShell.

AppleSeed has the ability to use JavaScript to execute PowerShell.

AppleSeed can delete files from a compromised host after they are exfiltrated.

AppleSeed has the ability to communicate with C2 over HTTP.

AppleSeed can stage files in a central location prior to exfiltration.

AppleSeed can identify the OS version of a targeted system.

AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.

AppleSeed has the ability to use multiple dynamically resolved API calls.

AppleSeed can take screenshots on a compromised host by calling a series of APIs.

AppleSeed can pull a timestamp from the victim's machine.

AppleSeed can gain system level privilege by passing SeDebugPrivilege to the AdjustTokenPrivilege API.

AppleSeed can decode its payload prior to execution.

AppleSeed can achieve execution through users running malicious file attachments distributed via email.

Kimsuky has used spearphishing attachments to entice victims into opening malicious files, including LNK files disguised with tailored filenames and fake extensions. Kimsuky has also delivered malicious payloads within archive files (e.g., ZIP), which display decoy documents upon execution while running malicious code in the background.

AppleSeed can call regsvr32.exe for execution.

AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.

AppleSeed can zip and encrypt data collected on a target system.

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns. Kimsuky has also distributed emails with attached compressed zip files that contained malicious .LNK files masquerading as legitimate files. Kimsuky has delivered tailored PDF documents that contain malicious links.

AppleSeed has been distributed to victims through malicious e-mail attachments.

Kimsuky has registered domains to spoof targeted organizations and trusted third parties including search engines, web platforms, and cryptocurrency exchanges.

Kimsuky has compromised email accounts to send spearphishing e-mails.

Kimsuky has collected valid email addresses including personal accounts that were subsequently used for spearphishing and other forms of social engineering.

Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.

Kimsuky has used links in e-mail to steal account information including web beacons for target profiling. Kimsuky has also utilized QR codes (also known as Quishing) to direct victims to malicious links through the reliance of a mobile device to scan a code with an embedded malicious URL.