Based on the function names used by the malware and the downloaded URL parameters, it is suspected to have been distributed by the Kimsuky group. This malware is designed to download various scripts based on the anti-malware process, including AhnLab products, installed in the user’s environment. The threat actor downloads different scripts based on the type of anti-malware process that is running in the user’s environment. Although the exact distribution path of the malware has not been confirmed, it appears that it is being distributed via email.