One Day Sec

What specific files does the PoisonFrog agent release in the %public%\Public folder, and what is the role of each?

The agent releases three files: `dUpdater.ps1` generates a system ID, reads proxy settings, and downloads files from the C2 server to execute commands or upload files; `hUpdater.ps1` creates folders for receive/send/done and receives commands via DNS A records; and `UpdateTask.vbs` loads both PowerShell scripts, as explained in the Analysis of APT34 Leaked Tools - PoisonFrog and Glimpse article.
PoisonFrog agentdUpdater.ps1hUpdater.ps1UpdateTask.vbsfile release

Browse all Q&A →