Transparent Tribe CrimsonRAT Campaign: LNK spawns cmd.exe executing doxc.bat/config.bat

Arnold Chan@slaz

•updated 21 days ago•0•0•1

Detects explorer.exe spawning the genuine cmd.exe binary with an explicit /c flag to run either the doxc\doxc.bat script from the 'My Resume.iso' lure chain, or config.bat co-occurring with the Documents_Details/windowSysUpdates decoy artifacts from the Document_Detail.zip lure chain — both used by Transparent Tribe (APT-C-56) to launch CrimsonRAT or the Golang RAT.