Malware Disguised as Installer from Korean Public Institution (Kimsuky Group)

AhnLab ASEC details Kimsuky distributing a signed dropper masquerading as a Korean public-institution installer that unpacks a passworded archive to deploy the Endoor backdoor (Golang); Endoor provides remote command execution, file transfer, SOCKS5 proxy and was observed with Nikidoor, Mimikatz usage, and a screenshot-capture/exfiltration component. The report includes attack logs, MD5s, C2 domains/URLs (including ngrok-free.app and specific download URLs), file detections, and a recommendation to update V3 to block infection.