Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery

by Robin Dost Actor tracking: APT43 (Kimsuky) / MB-0010 I can t sleep right now, because it s too hot in Germany, so i thought why not finishing an analysis i almost forgot about. In this analysis i am using Malwarebox Tooling for most of my work. Everything started with a suspicious CHM sample arriving in MANTIS.SHA256: 0efbd18c77479b458078521c18bdad84852b71250122a17cb8105c10d3df38d4 [ ] The post…