From d7ffebbe8a3b53a05f66b3f7529bdf10708562e0 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Sun, 29 Dec 2024 07:22:28 -0500
Subject: [PATCH] Update README.md

---
 Chinese APT/Wicked Panda/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Chinese APT/Wicked Panda/README.md b/Chinese APT/Wicked Panda/README.md
index 2ec893c..92eaaa4 100644
--- a/Chinese APT/Wicked Panda/README.md	
+++ b/Chinese APT/Wicked Panda/README.md	
@@ -94,3 +94,5 @@ Why the attackers Use Hashing?
 3.Memory-Only Execution: Useful in memory-resident malware that avoids writing cleartext strings to disk.
 
 ## The third stage (MoonWalk backdoor)
+
+This payload is a malicious program that establishes a reverse shell to an attacker's machine, enabling them to remotely execute commands on the victim's system via cmd.exe. It communicates with the attacker's system using an unencrypted TCP connection. The shell receives commands, executes them, and sends the output back to the attacker. To ensure persistence, it modifies the Windows Registry under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, adding a key named MoonWalkBackdoor. This key points to a file path intended to make the payload launch automatically on user login. However, the path specified (C:\\Windows\\System32\\payload.dll).