When you decompress the file, you’ll get a folder that’s 753MB in size, with a compression ratio of 99.8% due to the existence of padding in the program. When the user executes the application in the folder, a PowerShell process with an encoded argument is launched.

After that, a cmd.exe process is started with a timeout of 21 seconds, and a.jpg file is retrieved from a remote web server after the timeout expires. This file includes a DLL with its contents reversed, potentially to avoid detection methods. Lastly, the startup process loads the DLL and uses it to replace the existing thread context. That DLL is a RedLine stealer payload that uses TCP to connect to a command-and-control server and receive commands on what destructive operations it should run next on the newly infected system.

Despite the fact that the distribution site is currently unavailable, nothing prevents the perpetrators from registering a new domain and resuming their activity. In fact, it’s extremely likely that this is already taking place in the wild. Because many Windows 10 customers are unable to obtain Windows 11 through official distribution channels due to hardware incompatibilities, malware operators see this as an ideal opportunity to acquire new victims.

Remember that these dangerous websites are promoted through forum and social media posts, as well as instant messages, so only trust the official Windows upgrade system notifications.