intel.breakglass.techPublished
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerSh
By Breakglass Intelligence
Excerpt
#Infrastructure: 79 Domains Across 5 IPs
##The DAOU Staging Server (27.102.137.38 — 37 domains)
##The Fast-Flux Farm (118.194.249.109 — 40 domains)
##The Naver Phishing Farm (27.102.137.150 — 12+ domains, LIVE) #Related Kimsuky Sample
#Detection Guidance
##Network Signatures
##Host Indicators
#…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by intel.breakglass.tech on intel.breakglass.tech.
Mentioned in the excerpt
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
