Checks computer location settings

Looks up country code configured in the registry, likely geofence.

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Tries to access SSH used by SSH programs.

Adds Run key to start application

Network Service Discovery

Attempt to gather information on host's network.

Obfuscated Files or Information: Command Obfuscation

Adversaries may obfuscate content during command execution to impede detection.

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Command and Scripting Interpreter: PowerShell

Run Powershell to get system information.