9002 RAT is the decrypted rcview.log payload, which connects to the command-and-control (C&C) server at 66[.]42[.]37[.]101.  Figure 2. Contents of the malicious update configuration   Figure 3. How the compromised update process launches the 9002 RAT malware  Figure 4.