KimJongRAT PE Variant

Stephen Lincoln@s2s_stephen

•updated Jul 25, 2025•1•4•34

Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.