Executes dropped EXE

Identifies Wine through registry keys

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Contacts third-party web service commonly abused for C2

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Identifies Wine through registry keys

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.