Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Exploring a New Kim JongRAT Stealer Variant and Its Power Shell Implementation

Summary: Unit 42 documented two new KimJongRAT stealer variants, one a PE file and one a PowerShell implementation, both launched by a Windows LNK shortcut that downloads a dropper from an attacker-controlled CDN account. The PE variant's chain uses curl.exe to pull an HTA file from cdn.glitch[.]global, drops a decoy PDF named sexoffender.pdf plus user.txt and sys.dll, and the loader then fetches RC4-encrypted net64.log and main64.log to steal browser, crypto-wallet extension, FTP and email client data.

What's compelling: The malware hides its staging behind a legitimate CDN service and a multi-file chain, and its main orchestrator carries a PDB path reading \research\Spyware\Advanced\Covaware with a December 3, 2024 build timestamp - a stealer family tracked since 2013 that is still being rebuilt and shipped.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related