APT34: Glimpse project
Security Affairs
MAY 2, 2019
The first command that is executed after the registration phase is the command tagged as 10100 having as a content: “whoami&ipconfig /all” D. It takes as input the tagged task and it forwards to the requesting Agent the Base64 encoded content of the file. Is actually what should be executed. It is not a TXT request.
82 
Let's personalize your content