KimJongRAT Loader Execution

Aaron Mog@AaronMogS2S

•updated Jun 20, 2025•4•28

Detects the execution patterns of the KimJongRAT PE or PowerShell variant loaders, specifically rundll32 executing a DLL from AppData\Local with export 's' or powershell executing '1.ps1' from AppData\Local with '1.log' as an argument.