External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2025-08-07 13:33:48 -04:00
committed by GitHub
parent 1336202617
commit 2b2359751b
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
North Koreans APT/Stardust Chollima/README.md
+3 -2
View File
@@ -21,7 +21,7 @@ PowerRatankba in the background by useing (Base64).
Zdnet resources: https://www.zdnet.com/article/north-korean-hackers-infiltrate-chiles-atm-network-after-skype-job-interview/ Zdnet resources: https://www.zdnet.com/article/north-korean-hackers-infiltrate-chiles-atm-network-after-skype-job-interview/
The PowerRatankba sample used in the Chilean interbank attack, differently from other variants, communicates to The PowerRatankba sample used in the Chilean interbank attack, differently from other variants, communicates to
the C&C server on TCP, This latter code is registered as a service through the “sc create” command as, the C&C server on HTTPS, This latter code is registered as a service through the “sc create” command as,
the malware gain persistence by setting an autostart. the malware gain persistence by setting an autostart.
@@ -40,7 +40,7 @@ PowerRatankba in the background by useing (Base64).
control via C2 server and latter code is registered as a service through the “sc create” command as,“ the malware gain control via C2 server and latter code is registered as a service through the “sc create” command as,“ the malware gain
persistence by setting an autostart . persistence by setting an autostart .
4. C&C server on TCP: When a command is received, it is executed using the PowerShell command in Windows. 4. C&C server on HTTPS: When a command is received, it is executed using the PowerShell command in Windows.
The output of the command is captured and sent back to the C2 server. The output of the command is captured and sent back to the C2 server.
@@ -110,3 +110,4 @@ Persistence (Runs at Startup): The script modifies the Windows Registry (Run key
Every time the user logs in, the malicious script executes again, ensuring the attacker regains control. Every time the user logs in, the malicious script executes again, ensuring the attacker regains control.