KimJongRAT Initial Execution and Stealer Activity

Berkay Soylu@Hunter

•updated Jun 28, 2025•2•5•169

Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.