Following The Payload

Following The Payload

MediaVideo
Yanac

This payload is getting a little more interesting as the different stages start connecting together.

I follow the PowerShell activity through AppData, the Base64 payload that turns out to be a ZIP file, and the different URLs being used to pull down additional content.

Watch the full video: https://youtu.be/oJHOlNTH7lY?si=8LruOkxZlfvFLII-John HammondRead More