This backdoor was the preferred second-stage implant for the group throughout 2014 and 2015. The malware was a fullfeatured backdoor with built-in NTLM proxy authentication support which was designed to be run as a ServiceDLL. Each