SLICKSHOES is a Windows Trojan used by the North Korean government and tracked by U.S. authorities under HIDDEN COBRA. Its Themida-packed dropper decodes an embedded file and writes it as C:\Windows\Web\taskenc.exe without executing it or creating an autorun mechanism. The dropped Themida-packed implant beacons to its operator using a custom network-encoding algorithm. It can survey the compromised system, upload and download files, execute processes and commands, and capture screenshots, providing broad remote-access capability after another mechanism launches the implant.