Murkios bot drops files and controls system remotely

Zscaler ThreatLabZ analyzed the Murkios bot — a Windows malware that silently installs components (start.exe, systems.exe, winsys.exe, winsystem.exe), installs legitimate Plink (PuTTY) for SSH tunneling, enables and modifies RDP functionality via RDP Wrapper, bypasses UAC, creates persistent scheduled tasks and local user accounts, captures screenshots, and sends harvested data to a C2 (observed IP 193.238.46.117). The report provides dropped file paths, MD5 hashes, the download URL (murikos.in/soft.exe), and detailed command-line persistence and remote-access techniques.