The actor has used a clever method to bypass security mechanisms in which it has embedded its malicious HTA file as a compressed zlib file within a PNG file that then has been decompressed during run time by converting itself to the BMP format. The second stage payload has the capability to receive and execute commands/shellcode as well as perform exfiltration and communications to a command and control server