Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Creates:
- C:\Users\<username>\AppData\Local\Temp\<rnd>\[A-Z]{6}.exe
- Method of persistence:
- C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\[A-Z]{6}.link <-points to above executable
- Modifies reg keys in:
- HKCU\Software\Microsoft\Windows\CurrentVersion\InternetSettings
- c2 calls via
- random tcp port, most traffic I've seen has the word "beta"
Add Comment
Please, Sign In to add comment
