The report analyzes a Kimsuky phishing-mail tool called MailSending that is intended to automate phishing messages against South Korean users. It provides hashes including SHA-256 bb9c0396a61fa16d8c482a4a17e520fae908aa826e54243da6473494fa5f2305 and frames the malware as infrastructure supporting credential or personal-information theft by a North Korea-linked threat actor.