[–] 16 points 6 months ago (1 child)

The embedded PowerShell code creates a hidden folder at C:\Systems and downloads a trojanized ScreenConnect package from legitserver.theworkpc[.]com over TCP port 5443.

Nothing to see here, just a legit server doing work with the systems.

  • source
  • view more: next ›