Skip to main content

Kimsuky

Malware Family

671 indicators of compromise attributed to Kimsuky across abuse.ch threat intelligence feeds.

Domains

32

IPs

24

URLs

228

Hashes

387

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (32)IPs (24)URLs (228)Hashes (387)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CPayload Delivery

Sample indicators

IndicatorType
user-kakao.login-accounts.dynv6.netdomain
expireddomain.storedomain
mobileokgroup.sitedomain
drive.shadredin.storedomain
eastasiagroup.onlinedomain
ndocawverify.dynv6.netdomain
ndocazverify.dynv6.netdomain
nidlogins.ndocatverify.dynv6.netdomain
nid.ncodbvverify.dynv6.netdomain
nid.ndocazverify.dynv6.netdomain
ncodbvverify.dynv6.netdomain
ndocadverify.dynv6.netdomain
ndocauverify.dynv6.netdomain
check.nid-log.comdomain
workspaces.dynv6.netdomain
taxhelp6.dynv6.netdomain
nid.naver.courter.comdomain
email-service.prodomain
billmatedoc.mydns.bzdomain
inini.kesug.comdomain
38.60.220.73ip
51.79.185.184ip
118.194.248.158ip
176.111.220.168ip
118.193.69.245ip
118.194.249.154ip
27.102.138.45ip
27.102.138.52ip
27.102.138.49ip
118.194.249.109ip
118.194.249.32ip
118.193.68.95ip
101.36.114.66ip
152.32.138.146ip
118.194.248.183ip
152.32.243.215ip
152.32.139.149ip
167.88.166.204ip
118.193.69.19ip
27.102.137.140ip
https://docviews43.dynv6.net/url
http://ifrdr.dns.army/url
http://inini.kesug.com/maith.phpurl
http://7ieub.dns.army/url
https://fetch89s.dynv6.net/url
http://check.nid-log.com/pc/checkservice.phpurl
https://nids0.dynv6.net/url
https://join86s.dynv6.net/url
https://fetch23s.dynv6.net/url
http://ch.10001mb.com/mort.phpurl
http://ndocaoverify.dynv6.net/url
http://ndocaipass.dynv6.net/url
https://27.102.137.140url
https://152.32.138.146/url
https://police84s.dynv6.net/url
https://docviews35.dynv6.net/url
https://docviews34.dynv6.net/url
https://nids7.dynv6.net/url
https://docviews64.dynv6.net/url
https://docviews68.dynv6.net/url

Another file to check? Run a file hash reputation check.