MetaStealer Mar 2022 Malware Campaign - Command and Control Traffic

This strike simulates the HTTP traffic that gets generated after the malware is executed in the 'MetaStealer Mar 2022 Malware Campaign'. Once the persistent executable is run, the malware sends an HTTPS request to download a malicious reverse byte Windows DLL as well as an HTTP GET request to the same URI which is represented in this strike. After the malicious MetaStealer DLL is loaded, several HTTP GET requests are sent to an external server. The first HTTP request retrieves a base64 encoded Windows DLL. Then two more HTTP requests a GET and POST are sent to external servers to update status and wait for additional commands.