It will look for a pre-established ASCII text file in the folder of C:WindowsSysWOW64.

This file is a batch script that is responsible for running multiple commands, shown below: sc create purebackup binpath= 'C:Windowssystem32cmd.exe /C start /b C: -c $km = ::ReadAllText('C:WindowsSysWOW64qzx.txt') IEX $km' start= auto DisplayName= 'purebackup' The initial attack started with the execution of a batch file that executed PowerShell for further activity. This post focuses on the unique aspects of the malware, post-delivery, and their impact on the victimized environment. This ransomware was involved in altering the system to permanently remove volume shadow copies and delete system services before encrypting data using standard AES-256 encryption. Notably, it uses known PowerShell code to perform reflective injection of its code, causing PowerShell itself to perform the malicious activity.

Medusa Locker used multiple stages of infection, starting with an initial batch file and text document, used to inject ransomware into memory for execution.

Skate universe online