From 7e06e47d682c5c36ea53a13403194172a6ffbcfc Mon Sep 17 00:00:00 2001 From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com> Date: Tue, 23 Dec 2025 05:48:19 -0500 Subject: [PATCH] Update README.md --- North Koreans APT/Silent Chollima/README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/North Koreans APT/Silent Chollima/README.md b/North Koreans APT/Silent Chollima/README.md index ece89d2..ac50f5f 100644 --- a/North Koreans APT/Silent Chollima/README.md +++ b/North Koreans APT/Silent Chollima/README.md @@ -34,4 +34,10 @@ GOVERSHELL is a stealthy Windows implant that communicates over HTTPS with a rem Screenshot From 2025-12-23 05-43-30 +This function creates a hidden scheduled task named "SystemHealthMonitor" using schtasks.exe executed silently via CreateProcessA. +It builds a command string that runs the copied malware with -SilentChollima every 5 minutes at highest privileges. The process is launched with CREATE_NO_WINDOW and SW_HIDE flags to prevent any visible console or window. It safely copies the command into a fixed buffer, null-terminates it, and waits up to 5 seconds for completion. Returns true on success, ensuring stealthy, self-healing persistence without dropping additional files. + +Screenshot From 2025-12-23 05-45-16 + +