Anyone got Citadel 220.127.116.11 Rain Edition Sample? Better if C&C still works. Thank you.
Never mind. I figured out it was encrypted cfg downloaded during your analysis. It is targeting mainly European banks at the moment. Will be great if you could post more citadel with cfg as they come along.
Thanks a lot for sharing this info. What is the file in the zip with 140K size? Is that the cfg downloaded?
Is it possible to share the packet dump you may have?