![]() The people who are searching AnyDesk on Google were being served by the malicious Google ads which have been placed by the threat actors, and this is happening from April 21, 2021. When these files were being executed, the experts noticed that they are downloading a PowerShell implant, that is continuously exfiltrating all the data and information from the affected system. Malvertisers developed the Legit AnyDesk appĪfter going through this malware, the experts came to know that the malicious campaign is dispatching all the assembled AnyDeskSetup.exe files which took off on April 21. However, in an investigation, the experts have detected a file “rexc.exe” that seems to be a renamed PowerShell binary, and here the main motive of this file is to bypass and avoid detections that are occurring. “C:\Intel\rexc.exe” -exec bypass \Intel\g.ps1 Not only this but it is also trying to launch very strong PowerShell scripts that have the command line:. Apart from this, the malware got an executable file that is resembling to have been influenced to avoid any kind of detection.
0 Comments
Leave a Reply. |