Loading malware…
KimJongRAT is a long-running information-stealing malware family active since at least the 2010s and consistently linked in the provided reporting to the DPRK-nexus threat actor Kimsuky. It primarily targets Windows systems and is commonly delivered through spear-phishing and phishing emails using lures such as tax notices or impersonation of South Korean public institutions and services. Reported initial access vectors include malicious ZIP archives, LNK files disguised as documents or PDFs, HTA files executed via mshta, and malicious DOC files with macros. Multiple reports describe the malware being staged through legitimate or abused services including GitHub Releases, Google Drive, Korean URL shorteners, and cdn.glitch[.]global.
The malware is modular and focused on data theft. Across the provided sources, KimJongRAT variants collect system information, browser credentials, cookies, browser artifacts, process lists, installed software, mail account data, FTP and email client credentials, recent files, GPKI/NPKI files, clipboard contents, and keystrokes. Newer variants also target Telegram and Discord data and place special emphasis on cryptocurrency theft by harvesting browser extension data and wallet artifacts associated with MetaMask, Trust Wallet, TronLink, Exodus, Binance, OKX, Phantom, Kaia, Rabby, Ronin, Coinbase, Solflare, and others. Several reports state that KimJongRAT includes or downloads a dedicated module to extract Chromium-based browser master keys, including App-Bound Encryption keys, in order to decrypt protected browser data.
The family has been observed in both PE/DLL-based and PowerShell-based branches. In multiple 2025 reports, the infection chain checks Windows Defender status and switches payload type accordingly: one path launches a PE-based chain using DLL components executed with rundll32, while the other launches a PowerShell chain using staged scripts and encoded modules. Reported capabilities in the PE branch include anti-VM checks, mutex creation, persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run, local staging of stolen data into archives such as %localappdata%\micro.log.zip, and backdoor functions including file upload/download, command execution, directory listing, malware updates, clipboard capture, and keylogging. The PowerShell branch similarly performs browser and wallet theft, keylogging, clipboard collection, persistence, and exfiltration.
Some reporting describes KimJongRAT as evolving beyond pure infostealing. A newer variant retained information theft while expanding collection targets to Telegram and Discord and, in its final stage, installed a MeshCentral-based agent to obtain remote access to the victim system. This was characterized as an expansion from information theft toward securing persistent remote access.
KimJongRAT has also appeared as a secondary payload in BabyShark-related activity, where Unit 42 assessed it was used primarily for password extraction and information stealing while other malware handled active C2 communications. In that context, it stole credentials from Microsoft Outlook, Mozilla Thunderbird, and web browsers including Internet Explorer, Chrome, Firefox, Yandex Browser, and accounts such as Google, Facebook, and Yahoo, storing stolen data in %APPDATA%\Microsoft\ttmp.log.
High-confidence infrastructure and artifacts mentioned in the content include phishing and delivery domains such as natezlx.myvnc[.]com, GitHub account microstrategy743, C2 domains kzloly.nmailhub[.]com and quemr.mailhubsec[.]com, additional C2 base URLs including 131.153.13[.]235/sp/, 131.153.13[.]235/service/, secservice.ddns[.]net/service2/, and srvdown.ddns[.]net/service3/, and staging paths involving files such as pw.hta, doc.hta, kyc.hta, pdf.hta, v3.log, pipe.log, main64.log, net64.log, app64.log, 1.ps1, 1.log, 2.log, and 1.vbs. Reported mutexes include gjurkn and co_sys_co. Overall, the provided content consistently characterizes KimJongRAT as an evolving Kimsuky-associated Windows malware family centered on credential theft, browser decryption, cryptocurrency-related data theft, and in newer variants, remote access enablement.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Variants of the KimJongRAT malware family have been consistently identified since the 2010s. Upon execution via phishing emails, modular malware components exfiltrate sensitive victim data, including system configuration and browser artifacts.
Tools BabyShark, KONNI, FastFire, FireViewer, FastSpy, ReconShark, KimJongRAT, Kimsuky ... Malware families such as Kimsuky RAT, KimJongRAT, KONNI, and BabyShark have been linked to NICKEL KIMBALL activity.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
"The threat actors conduct extensive spearphishing operations, using typosquatting or domains thematically aligned with their target."
The obfuscated VBScript script invokes a Base64-encoded PowerShell script using the powershell -e option.
After opening "password.txt", the script runs the command "cmd /c sc query WinDefend"
Executing "password.txt.lnk" runs a command encoded in Base64... The obfuscated VBScript script invokes a Base64-encoded PowerShell script
The malware then downloads "app64.log" and "net64.log" in sequence, injecting each into chrome.exe and into itself, respectively.
After "sys.dll" starts, anti-VM checks run; if any condition is met, the malware deletes itself and terminates
Based on the service state, the flow branches to download and AES-decrypt either "v3.log" or "pipe.log"... The file "1.ps1" Base64-decodes the file specified via the FileName argument and executes the decoded content.
The malware enumerates the full process list, then filters out processes owned by the SYSTEM account
During system information collection, the malware queries the Windows version... Finally, the GetCPUInfo function issues the cpuid instruction to collect the CPU name.
The file "netlist.log" contains a list of file extensions and file system information collected via hard-coded cmd commands. The commands traverse drives, enumerate files matching specific extensions or keywords.
The malware queries registry values for each mail client type to collect account and profile information.
It then extracts the encrypted master key from each browser’s Local State file... Browser Credential and Cookie Collection
For C&C communications, the malware uses specific endpoints... Requests are formatted as "[C&C domain]/[victim_id]/[endpoint]"
The attacker abused GitHub to distribute malware... Upon execution, "pw.hta" downloads "password.txt" from Google Drive
For file uploads, the malware XORs the entire file with 0xFE... As an exception, the "netkey" file is sent via a regular POST
58 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A long-running DPRK-linked modular malware family attributed in the report to Kimsuky. It is delivered via phishing and uses PE and PowerShell branches to steal browser data, credentials, cookies, system and process information, mail client data, cryptocurrency wallet artifacts, Telegram/Discord/Exodus data, and to perform persistence, keylogging, clipboard capture, file collection, C2 tasking, and remote command execution. Recent variants also include a Chrome App-Bound Encryption master-key extraction component.
A named remote access trojan discussed as continuing to evolve, with the post indicating use of LOTS techniques/tools.
The content references a KimjongRAT variant described as expanding from information theft to securing remote access, indicating credential/data theft capabilities and remote access trojan functionality.
An updated KimjongRAT variant disguised as a tax notice. It retains information-stealing capabilities, expands collection targets to Telegram and Discord, and in the final stage installs a MeshCentral-based agent to obtain remote access and persistence-like control over the system.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.