Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%TEMP%\' -ExclusionPath '<Current directory>'; Set-MpPreference -DisableIOAVProtection $true; Stop-...
Modifies file system
Creates the following files
- %TEMP%\pen000d873d.exe
Deletes following files that it created itself
- %TEMP%\pen000d873d.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\pen000d873d.exe'
