More SSH Fun!, (Tue, Dec 24th)

The report describes a small Windows batch script (SHA256:3172eb8283a3e82384e006458265b60001ba68c7982fda1b81053705496a999c) that uses C:\Windows\System32\OpenSSH\ssh.exe with options `-o PermitLocalCommand=yes` and `-R 5555` to establish a reverse SOCKS tunnel, run a local command that downloads and executes `Ghost.exe` from a devtunnels.ms URL, and creates a registry Run key for persistence — effectively implementing a backdoor and remote access capability on infected hosts.