Reads local data of messenger clients

Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Downloads MZ/PE file

Modifies Windows Firewall

Network Share Discovery

Attempt to gather information on host network.

Writes to the Master Boot Record (MBR)

Bootkits write to the MBR to gain persistence at a level below the operating system.