While specific hashes change, these characteristics are common in this campaign:

Often uses hardcoded IP addresses or Dynamic DNS services (like duckdns.org ).

The .rar file usually contains a lure document (PDF or Word) and a hidden LNK file or executable. ⚙️ Infection Chain

The malware captures keystrokes, takes screenshots, and sends system data to a Command & Control (C2) server. 🔍 Technical Indicators (IOCs)