[SecList]Analysis: ?Red October?. Detailed Malware Description 4. Second Stage of Attack

[igor51]

Analysis: ?Red October?. Detailed Malware Description 4. Second Stage of Attack

Files with the extension ".bak" are treated differently. They are decrypted using a custom AMPRNG algorithm with a hardcoded key, then decompressed using LZMA
Source: Analysis: ?Red October?. Detailed Malware Description 4. Second Stage of Attack