Technical Information
- C:\users\public\documents\svp7.lnk
- C:\users\public\documents\perprotect.bat
- C:\users\public\documents\perprotect.exe
- from <Full path to file> to C:\users\public\documents\taakhsot.exe
- 'to##.ckd.cc':80
- /ip.php?ip################ via to##.ckd.cc
- http://sv##.top/index.php?sh####################################
- DNS ASK to##.ckd.cc
- DNS ASK sv##.top
- ClassName: '' WindowName: 'SVP7'
- 'C:\users\public\documents\perprotect.exe' /c Perprotect.bat
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\find.exe' /i "taakhsot.exe"