Malware
IRONHALO
IRONHALO is a downloader that uses the HTTP protocol to retrieve a Base64 encoded payload from a hard-coded command-and-control (CnC) server and uniform resource locator (URL) path.
IRONHALO is a Windows malware family operated by APT 16 and APT16.
Background
IRONHALO is a downloader that fetches a Base64-encoded payload over HTTP from a hard-coded command-and-control (CnC) server and URL path. The retrieved payload is saved to a temporary file, then decoded and run inside a hidden window. The encoded and decoded versions are stored in files called igfxHK[%rand%].dat and igfxHK[%rand%].exe respectively, where [%rand%] is a 4-byte hexadecimal value derived from the current timestamp. The malware maintains persistence by placing a copy of itself in the current user's Startup folder.
Source: Malpedia (Fraunhofer FKIE).