From 1d89d0daac81551b88370eee91ac0011ef963ab0 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Sun, 29 Dec 2024 07:26:11 -0500
Subject: [PATCH] Update README.md

---
 Chinese APT/Wicked Panda/README.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Chinese APT/Wicked Panda/README.md b/Chinese APT/Wicked Panda/README.md
index 92eaaa4..4ee9279 100644
--- a/Chinese APT/Wicked Panda/README.md	
+++ b/Chinese APT/Wicked Panda/README.md	
@@ -96,3 +96,6 @@ Why the attackers Use Hashing?
 ## The third stage (MoonWalk backdoor)
 
 This payload is a malicious program that establishes a reverse shell to an attacker's machine, enabling them to remotely execute commands on the victim's system via cmd.exe. It communicates with the attacker's system using an unencrypted TCP connection. The shell receives commands, executes them, and sends the output back to the attacker. To ensure persistence, it modifies the Windows Registry under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, adding a key named MoonWalkBackdoor. This key points to a file path intended to make the payload launch automatically on user login. However, the path specified (C:\\Windows\\System32\\payload.dll).
+
+![Screenshot From 2024-12-29 07-24-47](https://github.com/user-attachments/assets/e4a1d6c4-923d-4a40-a179-e07e2a4fae9e)
+