PXA Stealer - CMD based multi stage malware loader

Awais Munir@iawais

•updated today•1•1•1

Flags cmd.exe launched by a script host, Office or msiexec whose command line downloads with curl -s -o to a .pdf name and deletes with del /s /q, and involves Users\Public, AppData, conhost or --headless: the PXA Stealer