Armorsteal SysMon.py python.exe ipinfo.io public IP and org check

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•2•0•6

Detects execution of a Python script named SysMon.py via a scheduled task, correlated with a subsequent network connection to ipinfo.io initiated by the same Python interpreter within a 10-minute window.