0

In almost every five minutes, I come out of the AVG avg stop downloading files and do not know which program wants to download these files.

I have read this before WMI Infections

So, i opened this question because, i think this malware variant used WMI to maintain persistence.

I have read this too : Explained: WMI hijackers

enter image description here

Effectively, the script to be executed is hidden from the user, and the script (as a file) isn’t stored on the system. Which is why it is considered as another fileless infection. WMI techniques were used by malware like Stuxnet in the past.

enter image description here

Improve this question
2

1 Answer 1

Reset to default
1

The target IP belongs to KRYPT TECHNOLOGIES, which is a cloud hosting company.

Their IPs are known to be used in an abusive manner:

  • they are known for using and hosting ambiguous domain names

  • they tend to also have malicious traffic and internet abuse trends

  • many of their so called legitimate websites hosted by them are actually fronts for hosting virus’s and other malicious distributed files, attacks and other malicious activities

  • BOTNET activities

  • activities that have been monitored through their internet access has been Spam, Virus Activity, Hacking Attempts, as well as Malicious file distribution

Verdic: Virus/malware.

Recommended Actions: delete files, blacklist IP in firewall.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .