Attempts to resolve suspicious domains or connect to hardcoded IP addresses over non-standard ports to receive instructions. Persistence Mechanisms: Creates a Scheduled Task to run on system startup.

Usually contains an executable (e.g., .exe , .scr ) or a shortcut file ( .lnk ) that initiates a multi-stage infection.

Use EDR (Endpoint Detection and Response) tools to flag unauthorized registry modifications and process injections.

The user manually extracts the archive, revealing a file disguised as a legitimate document or utility (e.g., using a double extension like Invoice.pdf.exe ).

Train users to identify suspicious email attachments and the danger of double-extension files.