From c35af7c02dc47b6ee28d246dcc3f3d0247bae695 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Sat, 21 Sep 2024 12:59:10 -0400
Subject: [PATCH] Update README.md

---
 North Koreans APT/Labyrinth Chollima/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/North Koreans APT/Labyrinth Chollima/README.md b/North Koreans APT/Labyrinth Chollima/README.md
index b1c7fb0..9f8e68b 100644
--- a/North Koreans APT/Labyrinth Chollima/README.md	
+++ b/North Koreans APT/Labyrinth Chollima/README.md	
@@ -23,7 +23,7 @@ When accessed this way, the DLL files are loaded by the SumatraPDF.exe executabl
 4. Waits for the incoming connection from the backdoor to data exfiltration when it is executed on the target machine.
 
 
-
+5. Executing an encrypted payload stored in a file and writing it to disk by BURNBOOK launcher