If the configuration is parsed successfully, the program writes the string "Meteor has started. to an encrypted log file, suggesting that the internal name of the malware is “Meteor“. As we will see later on in this article, another name was used in previous attacks. Throughout the entire execution of the malware, it keeps logging its actions to this same encrypted log file. Appendix C contains a helper script to decrypt the log file