TrendLabs: Backdoor Uses FTP as C&C

Figure 6. Listing of all files in cabinet archive

REF: http://blog.trendmicro.com/trendlabs-security-intelligence/syscon-backdoor-uses-ftp-as-a-cc-channel/