The archive contains two files; the first is an executable file, while the second is a decoy PDF document. The bear’s lair . The Stage-1 downloader will download and execute a new downloader, written in C++, not so different from other Zebrocy downloaders. How the bear hunts . In this section we describe in more detail the commands performed manually by the operators through their Delphi backdoor. As we did not identify a pattern in the order which the commands are invoked, we believe the operators are executing them manually. The first set of commands gathers information about the victim’s computer and environment: The commands above are commonly executed when the operators first connect to a newly activated backdoor. Moreover, the backdoor contains a list of filenames related to credentials from software listed below (database names): The operators take care of retrieving these databases if they are present on the victim’s computer. The operators retrieve these files on the machine using the DOWNLOAD_LIST command. This command can be used when the operators are aware of the presence of interesting files on the computer. This backdoor is executed using the CMD_EXECUTE command: There are some interesting facts here. The first set of commands is the same and executed during a very short timeframe, which raises another question: is it automated