Kimsuky has decoded malicious VBScripts using Base64.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Kimsuky has used QuickZip to archive stolen files before exfiltration.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Kimsuky can gather a list of all processes running on a victim's machine.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew,

Mimikatz, and

PsExec.(Citation: Netscout Stolen Pencil Dec 2018)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.(Citation: Malwarebytes Kimsuky June 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

Kimsuky has packed malware with UPX.(Citation: Malwarebytes Kimsuky June 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

Kimsuky has used tools that are capable of obtaining credentials from saved mail.(Citation: Netscout Stolen Pencil Dec 2018)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|