@f4ktu4l Nope. the custom malware was just a C2 beacon port 80 tunnel with a stager that loaded meterpreter from the remote system into mem SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique