Rewterz Threat Alert – Kimsuky APT Group – Active IOCs

Severity

High

Analysis Summary

The North Korean advanced persistent threat (APT) group Kimsuky has been found to be distributing a fake Korean Internet and Security Agency (KISA) app via malicious emails. A mobile malware researcher has shared information about a fake KISA vaccine or a security android app disguised as the KISA security program. When the target downloads the APK implanted file from the email and installs the application on his device, the malicious code does its job. It executes in the background without the target’s knowledge and collects sensitive information from his device

Impact

• Information theft and espionage
• Exposure of sensitive data

Indicators of Compromise

Hostname

• texts[.]letterpaper[.]press

MD5

• c688c60c94ead98f772c20cf18fb02d1
• 609f8450e024ed88b130f13d6d7b213f
• 8b274243a5179028388a2c17c75afb9f
• 14e01ed4d086206d3c4b7159dc887f25

SHA-256

• ae50cf4339ff2f2b3a50cf8e8027b818b18a0582e143e842bf41fdb00e0bfba5
• a30afeea0bb774b975c0f80273200272e0bc34e3d93caed70dc7356fc156ffc3
• 20eff877aeff0afaa8a5d29fe272bdd61e49779b9e308c4a202ad868a901a5cd
• 0a4f2cff4d4613c08b39c9f18253af0fd356697368eecddf7c0fa560386377e6

SHA-1

• 9a33d27e403a5f0cf9560d3d3fcf715f4ce950d5
• bc74f9124872569b17a07add9cab82efb7eea843
• d5c09a6fff4dee7dee7f302c1d4d586ba6bc83f2
• 2918b5af300e979593df44696e947da396018532

Remediation

• Search for IOCs in your environment.
• Block all threat indicators at their respective controls.
• Always be suspicious about emails sent by unknown senders.