#TOUCHMOVE

Malware/Tool

2023-03-09 • Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970

TOUCHMOVE is a loader that derives a victim-specific RC6 key from BIOS properties, decrypts an on-disk configuration and payload, and executes the recovered payload.

Tagged Reports

« Back