.The analysis primarily focuses on the technical intricacies of two new variants of KimJongRAT, a prevalent stealer malware. Both variants—one using a Portable Executable (PE) file and the other utilizing PowerShell—are initiated via a Windows shortcut (LNK) file, which downloads a dropper file from an attacker-owned content delivery network (CDN). The dropper facilitates the introduction of further malicious files, including a loader, a decoy PDF, and additional scripts. The PE variant employs HTTP POST requests for data uploads using multipart/form-data or application/x-www-form-urlencoded methods, while it utilizes HTTP GET requests to download data. Furthermore, it continuously loops to maintain communication with its command and control (C2) server, allowing for data exfiltration and receiving instructions.