Google Ad for Fake Anydesk Campaign Feb 2023 - Command and Control Traffic

This strike simulates the TCP traffic that gets generated after the malware is executed in the 'Google Ad for Fake Anydesk Campaign Feb 2023'. Once the executable is run, 2 follow on DLLs are downloaded, one of which makes the malware persistent and the other is responsible for outbound traffic from the host machine. The C2 traffic is sent over TCP port 443 and looks to exfiltrate data like the Windows version, computer name, current user, and location and current name of the persistent malware sample that gets stored in C:/ProgramData/.