According to malware analysis reports from ANY.RUN , the executable performs the following actions:

: Modern EDR tools can flag the suspicious use of WMIC.EXE and TASKKILL.EXE that this malware relies on.

: Since this malware targets system files and startup configurations, having a clean system image is the fastest way to recover.

: This file is commonly found in "Malware Collections" on sites like GitHub. Never download or run executables from these sources unless you are in a secured, isolated virtual machine.

: The malware is known to forcibly change the desktop background image as part of its payload. System Sabotage :

Copyright © Shenzhen Quweilai Technology Company Limited All rights reserved.

Sitemap
Technical Support: Magic Lamp