Loading component...
User
Session ID: 05814137cae7c7b25a2c97de7edf72953c4c3b0d20d6ea5a64e4e4fd9079c45260
Key Functionalities:
### 1. **Persistence Mechanisms**
- Creates scheduled tasks for auto-startup
- Adds registry run keys for persistence
- Places itself in the startup folder
### 2. **Defense Evasion**
- Attempts to bypass AMSI (Antimalware Scan Interface)
- Adds Windows Defender exclusions
- Simulates process hollowing techniques
- Attempts DLL side-loading attacks
### 3. **Data Collection & Exfiltration**
- Collects system information (username, hostname)
- Searches for and uploads specific file types to a C2 server
- Supports various file types (.txt, .doc, .pdf, images, etc.)
### 4. **Ransomware Capabilities**
- Encrypts files using AES-256-CBC encryption
- Targets specific file types while avoiding system files
- Appends ".encrypted" extension to encrypted files
### 5. **Clipboard Hijacking**
- Monitors clipboard for cryptocurrency addresses
- Replaces detected crypto addresses with attacker-controlled addresses
- Supports Bitcoin, Ethereum, Solana, Dogecoin, Litecoin, and Tron
### 6. **System Disruption**
- Terminates security and backup processes
- Kills event log service to hide activities
- Disables system recovery features
- Forces system reboot after execution
### 7. **Stealth & Anti-Analysis**
- Uses mutex to prevent multiple instances
- Hides console window
- Uses string obfuscation to hide key values
- Self-deletes after execution
### 8. **C2 Communication**
- Connects to a command and control server
- Receives and executes commands remotely
- Encrypts communication with the C2 server
## How It Works:
1. The malware first checks if it's already running or has already executed (using a mutex and marker file)
2. It applies various evasion techniques to avoid detection
3. It establishes persistence mechanisms to survive reboots
4. It starts a beaconing loop to communicate with the C2 server
5. Based on commands received, it can:
- Collect system information
- Encrypt files (ransomware)
- Exfiltrate data
- Enable/disable clipboard hijacking
- Apply additional evasion techniques
6. After completing its tasks, it schedules a system reboot and self-deletes