From 92f77a316bc5ec4e4cd1710c8b761efecc32c7f9 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Fri, 14 Feb 2025 18:06:34 -0500
Subject: [PATCH] Update README.md

---
 North Koreans APT/Velvet Chollima/README.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/North Koreans APT/Velvet Chollima/README.md b/North Koreans APT/Velvet Chollima/README.md
index 74f756d..0144177 100644
--- a/North Koreans APT/Velvet Chollima/README.md	
+++ b/North Koreans APT/Velvet Chollima/README.md	
@@ -57,7 +57,17 @@ This function displays a popup instructing the user to execute specific commands
 The script automatically copies a PowerShell command to the clipboard.
 If the user follows the instructions and executes the code, it:
 Establishes a reverse shell connection to IP:PORT.
+
+![Screenshot From 2025-02-14 18-05-33](https://github.com/user-attachments/assets/f386c2ef-3d96-474b-90ca-766f6d89a672)
+
+
 Allows the attacker to remotely execute commands on the victim’s machine.
 Persists by adding itself to the Windows registry (Run Key), ensuring execution every time the system starts.
 
 ## The third stage (Reverse shell by PowerShell)
+
+The final result of this fake CAPTCHA attack is that the attacker gains remote access to the victim's machine through a reverse shell connection. Once the victim unknowingly runs the copied PowerShell command, their system establishes a connection to the attacker's server, allowing remote command execution.
+
+This access enables the attacker to control the system, extract sensitive data, install additional malware, and potentially spread within a network if the victim is part of a corporate environment. To ensure persistence, the script modifies the Windows registry so that the malicious command runs every time the system starts. Even after a reboot, the attack remains active.
+
+Ultimately, the victim's device is fully compromised, and the attacker can manipulate it as they wish.