MalwareUsed by 1 actor

FastViewer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kimsuky

FastViewer malware disguises itself as “Hancom Viewer”, a mobile viewer program... and downloads additional malware after stealing information from an infected device. The FastViewer malware downloads FastSpy...

via medium s2wblogmedium.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The group mainly attempts to collect by distributing malware and taking over accounts through spear-phishing attacks.

Privilege Escalation

1 technique

T1548Abuse Elevation Control MechanismEvidence1

FastViewer requests additional permissions from users for malicious actions such as receiving commands, persistence, and spying.

Stealth

3 techniques

T1036MasqueradingEvidence1

The FastFire malware is disguised as a Google security plugin, and the FastViewer malware disguises itself as “Hancom Office Viewer”

T1497.001System ChecksEvidence1

FastViewer abuses accessibility, so it is checked whether accessibility is enabled before performing malicious behaviors.

T1620Reflective Code LoadingEvidence1

FastViewer additionally downloads FastSpy malware and executes it in memory to perform additional malicious actions.

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

Malicious behavior operates when a special document file created by an attacker is read, by checking whether the first 4 bytes of the file are “EDC%”.

T1497.001System ChecksEvidence1

FastViewer abuses accessibility, so it is checked whether accessibility is enabled before performing malicious behaviors.

Collection

1 technique

T1005Data from Local SystemEvidence1

if the conditions are met, device information is transmitted to the C&C server.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

FastViewer additionally downloads FastSpy malware and executes it in memory to perform additional malicious actions.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

if the conditions are met, device information is transmitted to the C&C server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

medium s2wblogNews

Mar 21, 2023

Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware | by S2W | S2W BLOG | Medium

A repackaged malicious Android app impersonating Hancom Office Viewer. It behaves like a document viewer but, when opening attacker-crafted files, steals device information, requests intrusive permissions including accessibility-related access, contacts C2, and downloads/executes FastSpy in memory.

sekoia blogNews

Dec 16, 2022

The DPRK delicate sound of cyber - Sekoia.io Blog

Android malware used by Kimsuky.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

FastViewer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kimsuky

via medium s2wblogmedium.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The group mainly attempts to collect by distributing malware and taking over accounts through spear-phishing attacks.

Privilege Escalation

1 technique

T1548Abuse Elevation Control MechanismEvidence1

FastViewer requests additional permissions from users for malicious actions such as receiving commands, persistence, and spying.

Stealth

3 techniques

T1036MasqueradingEvidence1

The FastFire malware is disguised as a Google security plugin, and the FastViewer malware disguises itself as “Hancom Office Viewer”

T1497.001System ChecksEvidence1

FastViewer abuses accessibility, so it is checked whether accessibility is enabled before performing malicious behaviors.

T1620Reflective Code LoadingEvidence1

FastViewer additionally downloads FastSpy malware and executes it in memory to perform additional malicious actions.

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

Malicious behavior operates when a special document file created by an attacker is read, by checking whether the first 4 bytes of the file are “EDC%”.

T1497.001System ChecksEvidence1

FastViewer abuses accessibility, so it is checked whether accessibility is enabled before performing malicious behaviors.

Collection

1 technique

T1005Data from Local SystemEvidence1

if the conditions are met, device information is transmitted to the C&C server.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

FastViewer additionally downloads FastSpy malware and executes it in memory to perform additional malicious actions.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

if the conditions are met, device information is transmitted to the C&C server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

medium s2wblogNews

Mar 21, 2023

Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware | by S2W | S2W BLOG | Medium

sekoia blogNews

Dec 16, 2022

The DPRK delicate sound of cyber - Sekoia.io Blog

Android malware used by Kimsuky.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.