Logpresso_CTI_Monthly_Report_2024.03.pdf (3 MB)

Kimsuky TrollAgent analysis focuses on malware traits that can be converted into YARA detections, including mutex creation and rundll32-based DLL loading. The source says the observed mutex value matches values used by earlier Kimsuky malware, strengthening actor-level linkage. The malware masquerades as security-program installers such as TrustPKI or NX PRNMAN while a Go-based DLL runs in the background. That DLL collects system data, selected files, SSH and FileZilla artifacts, browser data, screenshots, and GPKI directory contents before sending them to C2 infrastructure.