Bitter PapRAT talk.log/techtalkhelp fetch followed by Base64 PowerShell decode

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects a sequence where a process fetches a file containing 'talk.log' or 'techtalkhelp', followed within 15 minutes by the same device executing PowerShell with Base64 decoding flags.