3.1. PowerShell Scripts

The VBE malware registered as a scheduled task during initial access downloads PowerShell scripts from the C&C server and runs them. These scripts fall into two types, ones that carry out malicious activity directly such as stealing system information or logging keystrokes, and ones that install remote control tools like Chrome Remote Desktop and AnyDesk. The latter are covered in the analysis sections for each tool.

3.1.1. System information exfiltration script

The first PowerShell script delivered and executed after the task is registered queries the victim machine for installed security software and system information, then saves the results to C:\users\public\music\aaa.tmp. The collected data is Base64 encoded, the "=" characters are replaced with "%", and the result is POSTed to the URL below.

• Exfiltration C&C server URL: hxxp://103.77.242[.]187/receive.php

caption - System information exfiltration script

3.1.2. Email collection scripts

The threat actor also delivered scripts that pull mail data out of local mailboxes. We identified two, one for each mail client, targeting Thunderbird and Outlook.

The Thunderbird script reads the mail archive files stored locally in mbox format, splits them on the From - * string to pull out individual messages, and saves each one as an eml file.

caption - Thunderbird email collection script 1

From the inbox it takes roughly 55MB of recent mail and saves it to C:\Users\Public\Music\Inbox\. From the sent folder it reads about 100MB of recent mail and saves it to C:\Users\Public\Music\Sent\.

caption - Thunderbird email collection script 2

The Outlook script collects every message sent or received since January 1, 2026 from the local inbox and sent folder, separates the attachments from the message bodies, and saves everything to C:\users\public\music\mail\.

caption - Outlook email collection script 1

The script sorts what it saves into subdirectories named after each account. Message bodies and metadata go into a single email.csv file per account rather than individual eml files, while attachments are separated from the message body and stored in an attachment directory for each account.

caption - Outlook email collection script 2

3.1.3. Keylogger script

We also found a keylogger script the threat actor used to steal keystrokes, including victim passwords. The script compiles inlined C# code directly in memory and runs it. That C# code hooks the keyboard and writes every keystroke to %AppData%\Microsoft\ttmp1.log.

caption - Keylogger script 1

The keylogger itself has no function for sending data to the C&C server, so the collected log file was most likely uploaded by a separate script. The C# code in the script uses the namespace Masakoyoji.Komori.

caption - Keylogger script 2

3.2. Chrome Remote Desktop

The threat actor installed Chrome Remote Desktop on compromised systems to get GUI level remote control. The installation script we obtained drops the files listed below.

| Install path | URL | Description |
| --- | --- | --- |
| c:\users\public\music\1.msi | hxxp://dl[.]google[.]com/edgedl/chrome-remote-desktop/chromeremotedesktophost.msi | Official Chrome Remote Desktop Installer |
| c:\users\public\music\1.bat | hxxp://103.249.117[.]183/1.bat | Batch file for Chrome Remote Desktop installation & attacker account binding |

| Install path | URL | Description |
| --- | --- | --- |
| c:\users\public\music\1.msi | hxxp://dl[.]google[.]com/edgedl/chrome-remote-desktop/chromeremotedesktophost.msi | Official Chrome Remote Desktop Installer |
| c:\users\public\music\1.bat | hxxp://103.249.117[.]183/1.bat | Batch file for Chrome Remote Desktop installation & attacker account binding |

| Install path | URL | Description |
| --- | --- | --- |
| c:\users\public\music\1.msi | hxxp://dl[.]google[.]com/edgedl/chrome-remote-desktop/chromeremotedesktophost.msi | Official Chrome Remote Desktop Installer |
| c:\users\public\music\1.bat | hxxp://103.249.117[.]183/1.bat | Batch file for Chrome Remote Desktop installation & attacker account binding |

caption - Files related to the Chrome Remote Desktop installation

The installation script uses fodhelper.exe to bypass UAC and run the batch file downloaded from the C&C server with administrator privileges. fodhelper.exe is a Windows binary that runs elevated without showing a UAC prompt, and on launch it looks up the ms-settings protocol handler. Windows checks HKCU\Software\Classes before HKLM\Software\Classes when resolving that handler.

Since a standard user can write to HKCU\Software\Classes, setting up Curver chaining on ms-settings so that .fax\Shell\Open\command ultimately points to 1.bat means running fodhelper.exe bypasses UAC and launches 1.bat with administrator privileges.

caption - UAC bypass routine using fodhelper.exe

Once UAC is bypassed, 1.bat runs with administrator privileges. It executes the Chrome Remote Desktop installer 1.msi that was already dropped and starts Chrome Remote Desktop. The command line arguments used as authentication data during binding are listed below.

| Command line argument | Value |
| --- | --- |
| code | 4/0AdkVLPzBKUSDVADc4Ru8idnLfXfKe6n0fpQrCTSXpbc3V5PSKEafp952MzQsKmOEr-bPGQ |
| redirect-url | hxxps://remotedesktop.google[.]com/\_/oauthredirect |
| name | okuta |
| pin | 001100

| Command line argument | Value |
| --- | --- |
| code | 4/0AdkVLPzBKUSDVADc4Ru8idnLfXfKe6n0fpQrCTSXpbc3V5PSKEafp952MzQsKmOEr-bPGQ |
| redirect-url | hxxps://remotedesktop.google[.]com/\_/oauthredirect |
| name | okuta |
| pin | 001100

| Command line argument | Value |
| --- | --- |
| code | 4/0AdkVLPzBKUSDVADc4Ru8idnLfXfKe6n0fpQrCTSXpbc3V5PSKEafp952MzQsKmOEr-bPGQ |
| redirect-url | hxxps://remotedesktop.google[.]com/\_/oauthredirect |
| name | okuta |
| pin | 001100

caption - Chrome Remote Desktop binding command line arguments

After the batch file runs, the installation script checks whether Chrome Remote Desktop installed correctly by saving a directory listing of C:\Program Files (x86)\Google to C:\users\public\music\bbb.tmp. The file is Base64 encoded, the "=" characters are replaced with "%", and the result is POSTed to the C&C server at the URL below.

• C&C Server URL: hxxp://103.249.117[.]183/receive.php

3.3. Gmail Exfiltration Chrome Extension

The threat actor installed a malicious Chrome extension that automatically sends the victim's Gmail data to the C&C server. Detailed Korean descriptions and debug strings run throughout the JavaScript and JSON files that make up the extension, strongly suggesting the threat actor wrote most of the code with generative AI. The manifest.json file from the extension we obtained is shown below.

{
  "manifest_version": 3,
  "name": "Gmail 자동 서버 업로더",
  "version": "2.2",
  "description": "새로 읽은 Gmail 이메일과 첨부파일을 안전한 HTTPS 서버로 전송합니다.",
  "permissions": [],
  "host_permissions": [
    "<all_urls>"
  ],
  "content_scripts": [
    {
      "matches": [
        "<all_urls>"
      ],
      "js": [
        "content.js"
      ]
    }
  ],
  "background": {
    "service_worker": "background.js"

{
  "manifest_version": 3,
  "name": "Gmail 자동 서버 업로더",
  "version": "2.2",
  "description": "새로 읽은 Gmail 이메일과 첨부파일을 안전한 HTTPS 서버로 전송합니다.",
  "permissions": [],
  "host_permissions": [
    "<all_urls>"
  ],
  "content_scripts": [
    {
      "matches": [
        "<all_urls>"
      ],
      "js": [
        "content.js"
      ]
    }
  ],
  "background": {
    "service_worker": "background.js"

{
  "manifest_version": 3,
  "name": "Gmail 자동 서버 업로더",
  "version": "2.2",
  "description": "새로 읽은 Gmail 이메일과 첨부파일을 안전한 HTTPS 서버로 전송합니다.",
  "permissions": [],
  "host_permissions": [
    "<all_urls>"
  ],
  "content_scripts": [
    {
      "matches": [
        "<all_urls>"
      ],
      "js": [
        "content.js"
      ]
    }
  ],
  "background": {
    "service_worker": "background.js"

The extension's operations are divided into two Javascript files: content.js and background.js.

First, content.js runs inside the Gmail page and watches the "Send" button and the message reading pane. When the user clicks "Send", it pulls the recipient, subject, body and attachments out of the compose window and passes them to the background. Attachments are downloaded from their links via fetch, Base64 encoded, then passed along the same way.

caption - Sent Gmail collection routine

When a message reading pane appears, the extension pulls out the sender, subject, body and attachments and passes them to the background. Attachments are handled with fetch exactly as they are for sent mail.

caption - Read Gmail collection routine

background.js runs in the background and sends the email data from content.js to the C&C server. Message bodies and attachments are distinguished by a type parameter, and a free Japanese hosting service was used as the C&C server.

• C&C Server: hxxps://sweet-iki-4263.holy[.]jp/gmail.php

caption - Gmail data C&C transmission routine

3.4. AnyDesk

During analysis we found a batch script that installs and runs the remote control tool AnyDesk in the victim environment. Like Chrome Remote Desktop, AnyDesk is a legitimate tool, but Kimsuky and other threat actors are known to abuse it for detection evasion and remote control. The batch script we obtained is shown below.

caption - Batch script used to install AnyDesk

The batch script downloads the additional files it needs for the AnyDesk installation from 160.187.147[.]119, the same C&C server used by 5月9日資料.pdf.lnk covered earlier in the additional malware section. The files are listed below.

| File Name | Description |
| --- | --- |
| app.vmd | VBScript that executes default_an.ps1 |
| mnfst.vmd | PowerShell script that runs and hides AnyDesk |
| attach.vmd | Legitimate AnyDesk executable |
| sch.vmd | AnyDesk certificate, password and salt |
| vpost.vmd | AnyDesk connection information |
| bimage.vmd | Task XML file that executes default_an.vbs

| File Name | Description |
| --- | --- |
| app.vmd | VBScript that executes default_an.ps1 |
| mnfst.vmd | PowerShell script that runs and hides AnyDesk |
| attach.vmd | Legitimate AnyDesk executable |
| sch.vmd | AnyDesk certificate, password and salt |
| vpost.vmd | AnyDesk connection information |
| bimage.vmd | Task XML file that executes default_an.vbs

| File Name | Description |
| --- | --- |
| app.vmd | VBScript that executes default_an.ps1 |
| mnfst.vmd | PowerShell script that runs and hides AnyDesk |
| attach.vmd | Legitimate AnyDesk executable |
| sch.vmd | AnyDesk certificate, password and salt |
| vpost.vmd | AnyDesk connection information |
| bimage.vmd | Task XML file that executes default_an.vbs

caption - Files related to the AnyDesk installation

Using the task definition in bimage.vmd, the batch script registers a scheduled task named User_Feed_Synchronization-{0DDC1BD9-E733-425C-B92B-ABAC149AB11232}. The task runs default_an.vbs every five minutes, and default_an.vbs in turn calls default_an.ps1. That script uses the MyAnyMutexName mutex to prevent duplicate execution, then launches AnyDesk and hides it through the steps below.

1. Enumerates every window title and hides any window whose title contains anydesk, Windows Security Alert or Windows 보안 경고 (Windows Security Alert).

2. Removes the AnyDesk button from the taskbar.

3. Scans the system tray area and removes the AnyDesk icon.