Bitter PapRAT chain: ftp, schtasks, curl MSI download, msiexec (single scan)

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•4

Detects a staged execution sequence on a single device within a 30-minute window involving ftp.exe fetching an icon or resource file, optional schtasks creating a task, curl.exe downloading an MSI, and msiexec.exe installing the MSI.