This backdoor software shares multiple characteristics with historical attack samples from the Kimsuky organization, leading us to believe that both types of malicious software are associated with the Kimsuky group. These two points indicate that the backdoor is started by other malware. The group typically employs social engineering, spear-phishing emails, watering hole attacks, and other methods to deliver malicious software, with a variety of attack techniques and weapons targeting both Windows and Android platforms. Kimsuky, also known as Mystery Baby, Baby Coin, Smoke Screen, Black Banshe, etc., internally tracked as APT-Q-2 by QiAnXin.