1200KM / tool
CSPY Downloader — Attack Tool
CSPY Downloader is a tool designed to evade analysis and download additional payloads used by Kimsuky.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: CSPY Downloader
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Kimsuky · G0094 · Pinned relationship source (relationship--5a85a31a-f5dd-4058-87d3-bb0b6fcfffb3)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
- T1027.002 · Software Packing · Detection rules & anomalies
- T1036.004 · Masquerade Task or Service · Detection rules & anomalies
- T1053.005 · Scheduled Task · Detection rules & anomalies
- T1070 · Indicator Removal · Detection rules & anomalies
- T1070.004 · File Deletion · Detection rules & anomalies
- T1071.001 · Web Protocols · Detection rules & anomalies
- T1105 · Ingress Tool Transfer · Detection rules & anomalies
- T1112 · Modify Registry · Detection rules & anomalies
- T1204.002 · Malicious File · Detection rules & anomalies
- T1497.001 · System Checks · Detection rules & anomalies
- T1548.002 · Bypass User Account Control · Detection rules & anomalies
- T1553.002 · Code Signing · Detection rules & anomalies
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
- Application Log Content · DC0038
- Command Execution · DC0064
- File Access · DC0055
- File Creation · DC0039
- File Deletion · DC0040
- File Metadata · DC0059
- File Modification · DC0061
- Logon Session Metadata · DC0088
- Module Load · DC0016
- Network Connection Creation · DC0082
- Network Traffic Content · DC0085
- Network Traffic Flow · DC0078
- Process Access · DC0035
- Process Creation · DC0032
- Process Modification · DC0020
- Scheduled Job Creation · DC0001
- Scheduled Job Metadata · DC0005
- Scheduled Job Modification · DC0012
- Service Creation · DC0060
- Service Metadata · DC0041
- Windows Registry Key Modification · DC0063
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.