Skip to main content

Kimsuky

Malware Family

669 indicators of compromise attributed to Kimsuky across abuse.ch threat intelligence feeds.

Domains

31

IPs

24

URLs

227

Hashes

387

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (31)IPs (24)URLs (227)Hashes (387)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CPayload Delivery

Sample indicators

IndicatorType
user-kakao.login-accounts.dynv6.netdomain
account-login.userauth.o-r.krdomain
log.kakao.com-nts.dns.armydomain
expireddomain.storedomain
smadison.onlinedomain
eastasiagroup.onlinedomain
ndocawverify.dynv6.netdomain
ndocazverify.dynv6.netdomain
nid.ncodbvverify.dynv6.netdomain
ncodbsverify.dynv6.netdomain
ncodbvverify.dynv6.netdomain
ndocadverify.dynv6.netdomain
ndocatverify.dynv6.netdomain
ndocavverify.dynv6.netdomain
check.nid-log.comdomain
accounts.google.seclogistic.comdomain
taxhelp6.dynv6.netdomain
nid.naver.courter.comdomain
nid-log.comdomain
email-service.prodomain
51.79.185.184ip
118.194.248.158ip
176.111.220.168ip
27.102.137.32ip
118.193.69.245ip
118.194.248.134ip
118.194.249.154ip
27.102.138.45ip
27.102.138.52ip
27.102.138.49ip
118.194.249.112ip
118.194.249.32ip
118.194.248.246ip
118.193.68.95ip
101.36.114.66ip
152.32.138.146ip
152.32.243.215ip
152.32.139.149ip
118.193.69.19ip
27.102.137.140ip
https://docviews43.dynv6.net/url
https://docviews37.dynv6.net/url
http://join86s.dynv6.net/url
http://nid.naver.adworldlog.com/url
https://nids14.dynv6.net/url
http://u3yte.v6.rocks/url
https://elecviews69.dynv6.net/url
http://118.194.248.95/url
https://3tg8i.dns.army/url
http://g24.bng0e.dns.army/url
http://search38s.dynv6.net/url
https://nids25.dynv6.net/url
https://myblog78s.dynv6.net/url
https://myblog2s.dynv6.net/url
http://2ebq4.dns.army/url
https://elecviews39.dynv6.net/url
https://nids19.dynv6.net/url
http://ct.ndoc-verify.dns.army/url
http://kinyz.v6.navy/?naps/url
http://ia3lp.v6.rocks/url

Another file to check? Run a file hash reputation check.