DriveLife-PsTrojan

TrojanDropper/PS.Maloader.d

Introduction to the "DriveLife" Virus

Since its emergence in 2018, the "DriveLife" virus has spawned multiple variants and continuously refined its techniques to evade detection and removal by security software.
The virus exploits multiple high-risk vulnerabilities, including EternalBlue and SMBGhost, to compromise and infect hosts running Windows and Linux.
After a successful breach, it not only downloads miner files for cryptocurrency mining, but also releases a propagation module to continue compromising other endpoints.
Moreover, the PowerShell scripts used by the virus are obfuscated through multiple layers to evade detection by security software.