RAT
Tiger RAT
This is third stage backdoor mentioned in the Kaspersky blog, "Andariel evolves to target South Korea with ransomware".
Tiger RAT is a Windows rat operated by Silent Chollima.
Background
This is the third-stage backdoor referenced in the Kaspersky blog "Andariel evolves to target South Korea with ransomware". Built by the second-stage payload, the third-stage component is run interactively during the operation and comes in both x64 and x86 builds. Most samples masquerade as legitimate web browsers by adopting Internet Explorer or Google Chrome icons and matching file names. At runtime the malware decrypts its embedded payload, using an embedded 16-byte XOR key to decode the base64-encoded data; the result is a further portable executable that runs in memory. Before decrypting with the hardcoded XOR key, the backdoor also checks whether it is in a sandbox environment. It shares some code with the known malware family PEBBLEDASH, which is attributed to Lazarus/LABYRINTH CHOLLIMA.
Source: Malpedia (Fraunhofer FKIE).