powershell command the image was downloaded in the working directory in the desktop therefore if the target downloads this in their downloads and run the trojan they will actually see the image file being downloaded and the backdoor being downloaded to that working directory so they will see new files being displayed in their file and here in their folder in here and therefore that will be suspicious so what we're going to do before doing anything we're actually going to change our working directory exactly the same way that we did in here when we did cd desktop but instead instead of going to the desktop which is a place that the user sees a lot we're actually going to go to the temp directory so we're going to do cd temp and we're using the percentage signs in here to tell the operating system to navigate to the temp path regardless of where that temp path is so we're using the environment temp variable and that's it we're actually ready to go we're going to first of all go to the temp directory download an image or any file that you want to display to the user open the file download an evil file open it again and you can do this multiple times if you want to open a number of evil files or a number of things so this can be used in so many scenarios so once you're done we're going to save this and you just want to make sure that you set the type to all files and set the extension to a batch file so use whatever name you want so let's say matrix trojan this time and we're just going to call it dot but now obviously you don't want to tell the user that this is a trojan we're just doing this in the video and that's it we're done let's select a place to save it let's save it on my desktop that's fine and i'm going to save it there and that's it we're ready let's go ahead and execute it so we're gonna minimize this close this minimize and close and i'm just gonna go to my kali machine and actually kill my connection at the moment so we're just gonna go back and we're gonna do kill all so that i don't have any connections so if we list you'll see we've got nothing right now and let's just go ahead and run this and perfect as you can see it's downloading the image first and then it's running it now obviously preferably you'd want to use a file that is not that big so it's downloaded and executed quickly but as you can see we can see the image on file we don't see any strange files in here because we stored everything in the temp directory and our if our evil code got executed in the background i should have got an agent in here and sure enough as you can see i get a connection through my empire so now i can remotely control that windows machine from here now i know what you're thinking this file right here looks very very suspicious it doesn't look like the trojan that i showed you at the start of the video not only that but if you right click this file and open it in a text editor you will actually see the code inside it which is not very good the user is going to know that you're trying to do something suspicious therefore what you want to do at the end once you test it like this as a bat file is compile it to an executable
NO_SEGMENT_TOKEN