Code comparison between the default batch script issued by Poison Frog’s C2 and a batch script received by the Helminth Trojan Webshells The data dump included several different webshells apparently used by OilRig to interact with compromised servers