From the original article[0]: > The script itself is rather simple. First, it creates a new VBScript Sle with the main malicious loop at the “%PROGRAMDATA%\Mic

From the original article[0]: > The script itself is rather simple. First, it creates a new VBScript Sle with the main malicious loop at the “%PROGRAMDATA%\Microsoft Essentials\Software Essentials.vbs” path. As its persistence mechanism, it then creates a new autorun registry key “HCU\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Software Essentials.” With this, the malware ensures that it is run every time the system is started or rebooted. Good to see that the methods from 15 years ago are still valid. [0]: https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems https://blog.reversinglabs.com/blog/mining-for-malicious-rub...