Hidden PowerShell Startup Execution

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects the hidden PowerShell command used by the observed Guildma Startup shortcut to launch a renamed AutoIt interpreter and a compiled script disguised as a LOG file from a user-writable public cache directory.