Loading malware…
MemLoad is a Windows loader used by the North Korean threat actor Kimsuky as an intermediate stage in multistep intrusion chains, particularly within the PebbleDash-related cluster. It is deployed after an initial dropper and before a final backdoor, most notably HttpTroy. Observed campaigns used spear-phishing lures themed as business documents, including a VPN invoice delivered in a ZIP archive containing an executable masquerading as a document. The initial dropper unpacked and launched MemLoad while displaying a decoy document to the victim.
MemLoad is designed to reduce exposure of the final payload and to assess victim value before full backdoor deployment. Multiple 2025 variants performed anti-virtualization checks and host reconnaissance, then retrieved an additional encrypted payload from command-and-control infrastructure. It decrypted the downloaded payload with RC4 and reflectively loaded it directly into memory by invoking an exported function, enabling fileless execution of the next stage. In documented chains, that next stage was the HttpTroy backdoor.
Persistence has been observed through scheduled tasks, with different variants using task names intended to resemble legitimate software updates. One reported variant recreated a scheduled task through COM interfaces and configured frequent execution via regsvr32, while other reporting tied MemLoad to similarly themed scheduled-task persistence. The malware has been associated with campaigns primarily targeting South Korean users and organizations, consistent with Kimsuky’s longstanding focus on South Korean government, private-sector, and defense-related entities. MemLoad’s role is best understood as a stealth-oriented staging component that combines reconnaissance, anti-analysis checks, persistence, payload retrieval, and in-memory loading to support follow-on compromise by Kimsuky backdoors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The first campaign, attributed to Kimsuky, leveraged a VPN-invoice themed ZIP lure to drop a loader (“MemLoad”) and a new backdoor dubbed “HttpTroy”.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Reger Dropper (.SCR) and Pidoc Dropper (.PIF) also contain benign lure files and malicious payloads that, in both cases, are encrypted using XOR operations... Pidoc Dropper is fully obfuscated using dummy data and encrypted strings.
These attachments often consist of compressed files containing droppers in formats such as .JSE, .EXE, .PIF, or .SCR. The filenames are consistent with the message content and are meant to convince the recipient to open the attachment.
Ultimately, the malicious payload is executed via command-line instructions such as regsvr32.exe /s [file path]
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader used in a Kimsuky-attributed espionage campaign and delivered via a VPN-invoice themed ZIP lure.
MemLoad is a loader used in the Kimsuky attack chain to load the HttpTroy backdoor into memory, aiding in stealth and anti-analysis by avoiding disk writes.
Stage-1 component that establishes persistence via a scheduled task (“AhnlabUpdate”) executing regsvr32, then decrypts (RC4) and reflectively loads the final payload into memory and executes it via an exported function.
A loader used by Kimsuky to evade detection and assess victim systems. It creates a flag file, generates an ID based on privilege level, establishes persistence via scheduled tasks, downloads an additional payload from C2, decrypts it with RC4, and reflectively loads it into memory. The downloaded payload is httpTroy.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.