Kimsuky Uses Quasar RAT to Deploy Funhouse Ransomware Through Multi-Stage Scripts

A Kimsuky campaign that delivers Funhouse ransomware through a malicious Hangul document disguised as a resume.

The operation combines embedded OLE objects, sequential scripts, a Python backdoor, and Quasar RAT, linking the September 2026 activity to earlier Endpoint ransomware deployments attributed to the group.

The findings indicate continuity rather than an entirely new ransomware operation. Although delivery files, infrastructure, configuration versions, and contact addresses changed, the attackers retained distinctive implementation details across successive campaigns.

The initial document, resume.hwp, contains malicious OLE data. When opened, the Hangul process extracts pdf.exe and pdf. exe. manifestmanifest into the Windows temporary directory without requiring additional user interaction.

However, extraction alone does not trigger the subsequent infection sequence described by ASEC.

The document presents a hyperlink purporting to open resume_{name}.pdf. Clicking that link launches pdf.exe, a VBScript editor, which processes the malicious pdf.exe.manifest script.

That script creates a batch file named lpe{random value}.bat in the temporary directory, initiating the next stage.

This distinction is operationally important: the lure first deposits executable components, then relies on a document interaction to activate them.

ASEC also connected the executor and manifest pairing to an earlier Kimsuky distribution case using similarly arranged files.

Successive Batch, VBS, and PowerShell scripts establish the infection chain, followed by deployment of a Python backdoor and installation of Quasar RAT.

The attackers subsequently use Quasar RAT to execute Funhouse ransomware, making the remote access component the bridge between initial compromise and encryption.

Funhouse Ransomware Attack

ASEC identified that, similarities between the campaign’s batch script and its earlier analysis of Kimsuky LNK campaigns distributing Python backdoors.

Those earlier operations used layered scripts and scheduled tasks, demonstrating how the group repeatedly modifies intermediate execution stages while preserving its broader delivery architecture.

The current Quasar variant stores its configuration in dog.dwg, replacing se.dwg observed in February and June.

Its configured VERSION value increased to 4.4.3 from 1.1.8, while its command and control endpoint changed to 70.36.97[.]236:443.

Despite these changes, all three configurations retained the mutex _QQ_XCZ_VCXZ.

The September TAG also incorporated a victim company identifier followed by _it1, providing another comparison point within the campaign lineage.

Funhouse matches the June Endpoint sample across its .Funhouse extension, How To Restore Your Files.Txt ransom note, ransomware mutex, encryption approach, footer size, and embedded marker.

Both use CryptGenRandom, Curve25519, and SHA-512 for key generation, HC-128 encryption, and a 72-byte encryption footer.

By comparison, the February Endpoint sample used the .Endpoint extension, ChaCha20 encryption, and a 1,592-byte footer in normal mode.

ASEC’s earlier Endpoint analysis documents that family’s encryption behavior and recovery interference, providing context for the later variant comparison.

The September contact address changed to Funhouse8764@tutamail.com, replacing June’s FunhouseRaaS@proton.me.

This update, alongside infrastructure rotation, shows changed operational identifiers without equivalent changes to the ransomware’s core technical characteristics.

The retained traits support ASEC’s assessment of a related, continuously updated attack chain.

The campaign shifts initial delivery from recently favored LNK files to a familiar HWP resume lure.

Its observable sequence includes temporary executable extraction, VbsEdit execution, chained scripting, backdoor installation, and eventual ransomware deployment.

Correlating these behaviors with the reused Quasar mutex and DWG configuration artifacts offers more durable investigative context than relying on filenames, contact addresses, or network indicators alone.

IOCs

Type	Indicator
MD5	17d97e3ee3185d82812a4014444c36f3
MD5	327617e977eefd15708568f43140e595
MD5	3d802ceaf891ea57ecd7d1d786d96a0d
URL	http[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/adminer/logo[.]php?au=tt
URL	http[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/enter/logo[.]php
URL	http[:]//kgbrazing[.]makeway2017[.]gethompy[.]com/skin/board/pym/logo-man[.]php

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.