Kimsuky Deploys HttpTroy Backdoor via VPN Invoice Lure: Three-Stage Chain Using MemLoad and COM-Based Persistence

Researchers at Gen Threat Labs documented a Kimsuky intrusion targeting a South Korean victim using a phishing ZIP archive disguised as a VPN service invoice, deploying a three-stage infection chain culminating in a new backdoor named HttpTroy. Attribution indicators include a Korean-language lure, a persistence mechanism mimicking AhnLab's scheduled task naming convention, and command patterns consistent with prior Kimsuky activity.

Stage 0: GO-Based Dropper via Fake VPN Invoice

The initial sample arrives as a .scr file inside a ZIP archive named to resemble a VPN service quote from a Korean IT vendor. The .scr file is a lightweight Go binary containing three XOR-encrypted embedded files (key: 0x39). Upon execution it decrypts and writes all three to disk, displays a decoy PDF showing a fake VPN billing document to maintain victim deception, and registers the first-stage backdoor as a COM server using regsvr32.exe.

Stage 1: MemLoad_V3 — Persistence and In-Memory Payload Execution

The first backdoor DLL, internally named Memload_V3.dll, performs two actions. First, it re-creates a scheduled task named "AhnlabUpdate" — deliberately imitating a legitimate AhnLab antivirus task name common in South Korean enterprise environments — configured to execute the current DLL silently via regsvr32.exe /s <CURRENT_FILENAME> on a one-minute repetition interval (PT1M). The task is registered using COM interfaces instantiated via CoCreateInstance. Second, MemLoad_V3 decrypts the third dropped file using RC4, loads it directly into memory, and triggers execution via the exported function hello — leaving no additional file on disk for the final payload stage.

Stage 2: HttpTroy Backdoor — Full System Control with Layered Obfuscation

The final payload, httptroy_dll.dll, is a heavily obfuscated backdoor providing the operator with comprehensive remote control capabilities: file upload and download, screenshot capture and exfiltration, privileged command execution, in-memory executable loading, reverse shell, and process termination with trace cleanup.

HttpTroy employs several obfuscation layers to resist analysis. API calls are hidden via custom hashing; strings are obfuscated through XOR combined with SIMD instructions. Critically, the backdoor avoids static API hash or string reuse — each instance is dynamically reconstructed at runtime through varied combinations of arithmetic and logical operations, defeating both signature-based detection and static reverse engineering.

All C2 communication occurs exclusively via HTTP POST requests to hxxp[://]load[.]auraria[.]org/index[.]php. Transmitted data is obfuscated in two steps: XOR with key 0x56, followed by Base64 encoding. Each query carries a specific ID: ID 1 requests a new command; ID 2 reports execution results (ok, fail, or connect ok for reverse shell). Commands from the server follow a <command> <parameters> structure.

Indicators of Compromise

Read the full analysis on IntelFusions