Each sample contains malicious code that writes an embedded payload to disk and launches it. However, the malicious code was inserted at different locations in each of the trojanized PuTTY samples. In the PuTTY sample discovered by Mandiant, the code resides in the connect_to_host function, which is in the source file putty-0.77\ssh\ssh.c. To trigger the code, the user must attempt an SSH connection to the host IP address provided in the Readme.txt file (Figure 1).