The malware in question is a dropper that creates the Endoor backdoor, which was also used in the attack covered in the previous post, “TrollAgent That Infects Systems Upon Security Program Installation Process (Kimsuky Group)”. Nikidoor is a backdoor used by the Kimsuky group and was mentioned in the post “Kimsuky Targets South Korean Research Institutes with Fake Import Declaration” [4]. [2] The AhnLab Smart Defense (ASD) infrastructure showed a record of Endoor having been used in an attack, but it is not certain whether the backdoor was installed using the dropper covered above or through a different route. This backdoor can steal information about the infected system and perform malicious actions through the commands it receives like other malware such as AppleSeed and Endoor.