Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%APPDATA%\VMProtect\VMProtect_Con.exe.lnk'
- %APPDATA%\vmprotect\vmprotect_con.exe.lnk
- %APPDATA%\vmprotect\vmprotect_con.exe
- %TEMP%\svhost.exe
- %APPDATA%\vmprotect\vmprotect_con.exe.bat
- 'localhost':9921
- 'no###icious.ml':9921
- DNS ASK si###elogger.ml
- DNS ASK bi####theword.ml
- DNS ASK no###icious.ml
- '%WINDIR%\syswow64\cmd.exe' /c %APPDATA%\VMProtect\VMProtect_Con.exe.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%APPDATA%\VMProtect\VMProtect_Con.exe.lnk" /f
- '%WINDIR%\syswow64\cmd.exe' /c %APPDATA%\VMProtect\VMProtect_Con.exe.bat
- '%WINDIR%\syswow64\timeout.exe' /t 180