diff --git a/North Koreans APT/Silent Chollima/README.md b/North Koreans APT/Silent Chollima/README.md index ece89d2..ac50f5f 100644 --- a/North Koreans APT/Silent Chollima/README.md +++ b/North Koreans APT/Silent Chollima/README.md @@ -34,4 +34,10 @@ GOVERSHELL is a stealthy Windows implant that communicates over HTTPS with a rem Screenshot From 2025-12-23 05-43-30 +This function creates a hidden scheduled task named "SystemHealthMonitor" using schtasks.exe executed silently via CreateProcessA. +It builds a command string that runs the copied malware with -SilentChollima every 5 minutes at highest privileges. The process is launched with CREATE_NO_WINDOW and SW_HIDE flags to prevent any visible console or window. It safely copies the command into a fixed buffer, null-terminates it, and waits up to 5 seconds for completion. Returns true on success, ensuring stealthy, self-healing persistence without dropping additional files. + +Screenshot From 2025-12-23 05-45-16 + +