CSPY Downloader — Malware Profile

CSPY Downloader is a tool designed to evade analysis and download additional payloads used by Kimsuky.

MITRE ATT&CK techniques (12)

• T1027.002 Software Packing
• T1036.004 Masquerade Task or Service
• T1053.005 Scheduled Task
• T1070 Indicator Removal
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1105 Ingress Tool Transfer
• T1112 Modify Registry
• T1204.002 Malicious File
• T1497.001 System Checks
• T1548.002 Bypass User Account Control
• T1553.002 Code Signing

Attributed threat actors

• Kimsuky

Read the full analysis on IntelFusions