OP 28 November, 2023 - 06:14 PM
New malicious Backdoor Configs are Floating around Again and Here Is What They Look Like .
![[Image: Screenshot-6.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2F6Q8bBprM%2FScreenshot-6.png)
![[Image: Screenshot-7.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2FzB5h0dGT%2FScreenshot-7.png)
![[Image: Screenshot-8.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2FYS7jHvBH%2FScreenshot-8.png)
![[Image: Screenshot-9.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2Fx8nWjSTq%2FScreenshot-9.png)
![[Image: Screenshot-10.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2Ffy52Ct7f%2FScreenshot-10.png)
%USERPROFILE%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScHoster.exe.log
%USERPROFILE%\AppData\Roaming\dabbj
%USERPROFILE%\AppData\Roaming\dabbj\ehac.exe
![[Image: Screenshot-6.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2F6Q8bBprM%2FScreenshot-6.png)
![[Image: Screenshot-7.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2FzB5h0dGT%2FScreenshot-7.png)
![[Image: Screenshot-8.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2FYS7jHvBH%2FScreenshot-8.png)
![[Image: Screenshot-9.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2Fx8nWjSTq%2FScreenshot-9.png)
![[Image: Screenshot-10.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2Ffy52Ct7f%2FScreenshot-10.png)
%USERPROFILE%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScHoster.exe.log
%USERPROFILE%\AppData\Roaming\dabbj
%USERPROFILE%\AppData\Roaming\dabbj\ehac.exe
malware changes the victim clipboarded Bitcoin address
reads numerous files containing system information
logs the victim IP address and sends the stolen data to a Telegram bot
Permission is granted through a task on the Windows Task Scheduler.
![[Image: smart.gif]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fstatic.cracked.sh%2Fimages%2Fsmilies%2Fsmart.gif)
reads numerous files containing system information
logs the victim IP address and sends the stolen data to a Telegram bot
Permission is granted through a task on the Windows Task Scheduler.
![[Image: smart.gif]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fstatic.cracked.sh%2Fimages%2Fsmilies%2Fsmart.gif)