Kimsuky

Malware Family

669 indicators of compromise attributed to Kimsuky across abuse.ch threat intelligence feeds.

Domains

31

IPs

24

URLs

227

Hashes

387

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (31)IPs (24)URLs (227)Hashes (387)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CPayload Delivery

Sample indicators

IndicatorType
user-kakao.login-accounts.dynv6.netdomain
account-login.userauth.o-r.krdomain
account-auth.userlogin.kro.krdomain
log.kakao.com-nts.dns.armydomain
mobileokgroup.sitedomain
smadison.onlinedomain
nidlogins.ndocatverify.dynv6.netdomain
nid.ndocazverify.dynv6.netdomain
ncodbsverify.dynv6.netdomain
ndocadverify.dynv6.netdomain
ndocatverify.dynv6.netdomain
ndocauverify.dynv6.netdomain
ndocavverify.dynv6.netdomain
check.nid-log.comdomain
workspaces.dynv6.netdomain
taxhelp6.dynv6.netdomain
nid-log.comdomain
email-service.prodomain
billmatedoc.mydns.bzdomain
nid-naver-login.comdomain
51.79.185.184ip
176.111.220.168ip
27.102.137.32ip
118.193.69.245ip
118.194.248.134ip
118.194.249.154ip
27.102.138.45ip
27.102.138.49ip
118.194.249.109ip
118.194.249.112ip
118.194.249.32ip
118.194.248.246ip
118.193.68.95ip
101.36.114.66ip
152.32.138.146ip
118.194.248.183ip
152.32.139.149ip
167.88.166.204ip
118.193.69.19ip
27.102.137.140ip
http://ndocalpass.dynv6.net/url
http://118.194.248.183/url
https://fetch25s.dynv6.net/url
https://elecviews52.dynv6.net/url
https://fetch81s.dynv6.net/url
https://myblog78s.dynv6.net/url
https://fetch33s.dynv6.net/url
http://ndocs2mai1.dns.army/url
http://nid.naver.corporateadworld.com/url
http://yv3ie.dns.army/url
https://fetch4s.dynv6.net/url
https://docviews37.dynv6.net/url
https://nids33.dynv6.net/url
https://elecviews56.dynv6.net/url
http://118.194.248.95/url
https://nids59.dynv6.net/url
http://dt.ndoc-verify.dns.army/url
https://police41s.dynv6.net/url
http://link-nid-log.oc9bk.dynv6.net/url
https://myblog57s.dynv6.net/url