TOUCHHUBTouchHub

Installer reported and named by Kaspersky in Operation FlashHole, a Lazarus Group espionage campaign against South Korean companies, retrieved by TechHub from its private GitHub repository. It copies the legitimate printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe, drops an embedded TOUCHSHIFT payload beside it as mscoree.dll for DLL side-loading together with the TechHub configuration file ActivationStore.dat, timestomps the files from monitor.sys, and registers a service named after a random netsvcs service plus two random letters so that TOUCHSHIFT runs with SYSTEM privileges and relaunches TechHub. Not to be confused with TOUCHSHIFT (misp-galaxy:malpedia="TOUCHSHIFT"), the loader it installs.