: Attempts to connect to Command & Control (C2) servers via non-standard ports to send stolen data.

: Creates scheduled tasks or registry keys to ensure the malware runs every time the computer starts. Safety Recommendation

If you are investigating a specific sample, these are the typical "red flags" identified in security papers: : Often unsigned or uses a forged certificate.

: Once executed, the software monitors the system clipboard. If it detects a cryptocurrency wallet address, it replaces it with the attacker's address, diverting any outgoing transactions.