Banking malware used GitHub for persistence