[rightbyte]

Seems to be some dll:s included. Maybe there?

"But the tool also has the ability to download and execute arbitrary code from an attacker-controlled domain."

Sounds like most software nowadays to be honest. The blog author does not really point out why this code would be more malicious than "normal" or how the code author is known to be Korean.