| Hashes | Phase 1 (dropper) / SHA-256 | feb46ecf8212f3d6d43afff5ff37558a97486ebea72059ea03b29b53f42ed23c |
| Hashes | Phase 2 (Psyduck) / SHA-256 | 6f732fbbcbce8f4af84d65d6f016113819e3de4616e1b644b3d4c2086fdabe09 |
| Network | C2 domain | duck12.dynuddns.net |
| Network | C2 port | 1234 |
| Network | C2 protocol | HTTP |
| Network | C2 endpoint | /Vre |
| Network | C2 endpoint | /AW |
| Network | C2 endpoint | /SS |
| Network | C2 endpoint | /CF |
| Network | C2 endpoint | /DF |
| Network | C2 endpoint | /DR |
| Network | External IP lookup service | https://icanhazip.com |
| Host | Temporary created file | %TEMP%\agent_1781054578.ps1 |
| Host | Saved executable filename | %TEMP%\ce.exe (CK command) |
| Host | Saved executable filename | %TEMP%\update.exe (/DLF default) |
| Host | Global mutex name | Global\677d95b1-c2a4-4c21-a54f-874ddf08e8c9 |
| Host | Victim unique ID prefix | app_ |
| Host | C2 command delimiter | |V| |
| Host | Masquerade string | Apex Monitoring Co Fleet Monitor Agent |
| Behavior | User-Agent pattern | app_<random>\<hostname>\<user>\<OS>\<AV>\<UAC>\<.NET>\<exclusions>\<window> |
| Behavior | Execution Policy bypass parameter | -ep bypass |
| Behavior | Hidden execution parameter | -WindowStyle Hidden |
| Behavior | WMI namespace and class | root/SecurityCenter2: AntiVirusProduct |
| Behavior | Registry key read | HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System (ConsentPromptBehaviorAdmin) |