KANDYKORNMalware
Last reported 2 years ago, by Elastic Security Labs2 reports
ATT&CK techniques
6 of 15 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing”
- T1036Masquerading
“Stage 3 (HLOADER) - HLOADER/Discord(fake) is a simple loader used as a persistence mechanism masquerading as the legitimate Discord app for the loading of SUGARLOADER.”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Python”
- T1059.004Unix Shell
“Command and Scripting Interpreter: Unix Shell”
What the reports say
2 reports, newest first · the exact sentence from each-
Sinking macOS Pirate Ships with Elastic Behavior Detections“Our report on the DPRK malware KANDYKORN shows that these campaigns are modular, encompassing multiple stages of payloads with capabilities and functionality distributed between these payloads to avoid detection.”
-
Elastic catches DPRK passing out KANDYKORN“Elastic catches DPRK passing out KANDYKORN”
Indicators in its reports
named in the reports above- com[.]applein 1 report
- objective-see[.]orgin 1 report
- persistence[.]namein 1 report
- hxxps://objective-see[.]org/blog/blog_0x79.htmlin 1 report
- hxxps://jamf[.]com/blog/jtl-malware-pirated-applicationsin 1 report
- jamf[.]comin 1 report
- hxxps://developer.apple[.]com/documentation/endpointsecurityin 1 report
- 23.254.226[.]90in 1 report
- 2360a69e5fd7217e…0234f7762df1in 1 report
- discord[.]appin 1 report
- 5555494485b460f1…b94d01136320in 1 report
- hxxps://drive.google[.]com/file/d1KW5nQ8MZccug6Mp4QtKyWLT3HIZzHNIL2in 1 report
- 192.119.64[.]43in 1 report
- pesnam.publicvm[.]comin 1 report
- bitscrunnch.linkpc[.]netin 1 report
- jobintro.linkpc[.]netin 1 report
- jobdescription.linkpc[.]netin 1 report
- docsenddata.linkpc[.]netin 1 report
- docsendinfo.linkpc[.]netin 1 report
- datasend.linkpc[.]netin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.