attempts to obtain legitimate credentials during operations.


attempts to overwrite operating system files with image files.


A  uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.


automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.


automatically searches for files on local drives based on a predefined list of file extensions.


automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes.  also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.


A  variant can force the compromised system to function as a proxy server.


A  variant downloads the backdoor payload via the BITS service.


A  variant has used rundll32 for execution.


A  variant is encoded using a simple XOR cipher.


A variant of  attempts communication to the C2 server over HTTP on port 443.


A variant of  encrypts some C2 with 3DES and RSA.


A variant of  executes dir C:\progra~1 when initially run.


A  variant uses a C2 mechanism similar to port knocking that allows attackers to connect to a victim without leaving the connection open for more than a few sectonds.


A  variant uses DLL search order hijacking.


A  variant uses fake TLS to communicate with the C2 server.


A  VBA Macro sets its file attributes to System and Hidden.


A  VBScript receives a batch script to execute a set of commands in a command prompt.


A version of  introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.


A version of  loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application whitelisting techniques.


avoids analysis by encrypting all strings, internal files, configuration data.


A Word document delivering  prompts the user to enable macro execution.


Based on comparison of  versions,  made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.


Before being appended to image files,  commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.


Before writing to disk,  inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.


bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database.


bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe).


C2 servers communicated with malware over TCP 8081, 8282, and 8083.


C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers.


C2 traffic can communicate via TCP raw sockets.


C2 traffic for most  tools occurs over Port Numbers 53, 80, and 443.


C2 traffic from  is encrypted, then encoded with Base64 encoding.


C2 traffic has been encrypted with RC4 and AES.


C2 traffic is encrypted using bitwise NOT and XOR operations.


calls cmd.exe to run various DLL files via rundll32.


calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup.  also has the capability to invoke a reverse shell.


can accept multiple URLs for C2 servers.


can add a new service to ensure  persists on the system when delivered as another payload onto the system.


can add or remove applications or ports on the Windows firewall or disable it entirely.


can alter the victim's proxy configuration.


can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.


can be added as a service to establish persistence.


can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.


can be configured to use HTTP or DNS for command and control.


can be configured to use multiple network protocols to avoid network-based detection.


can be configured to use raw TCP or UDP for command and control.


can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.


can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.


can be used to copy files to a remotely connected system.


can be used to create  to upload and/or download files.


can be used to create  to upload files from a compromised host.


can be used to delete files from the file system.


can be used to disable local firewall settings.


can be used to discover current NetBIOS sessions.


can be used to discover local NetBIOS domain names.


can be used to discover processes running on a system.


can be used to discover services running on a system.


can be used to discover system firewall settings.


can be used to display ARP configuration information on the host.


can be used to download files from a given URL.


can be used to enumerate local network connections, including active TCP connections and other network statistics.


can be used to enumerate security software currently running on a system by process name of known products.


can be used to execute binaries on remote systems by creating and starting a service.


can be used to find files and directories with native functionality such as dir commands.


can be used to find information about the operating system.


can be used to gather information about the operating system.


can be used to identify remote systems within a network.


can be used to install browser root certificates as a precursor to performing man-in-the-middle between connections to banking websites. Example command: certutil -addstore -f -user ROOT ProgramData\cert512121.der.


can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)


can be used to schedule a task on a system.


can be used to set up a proxy tunnel to allow remote host access to an infected host.


can be used to subvert controls and possibly conceal command execution by not directly invoking .


can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.


can capture desktop screenshots in the PNG format and send them to the C2 server.


can capture screenshots at a configurable interval.


can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.


can capture screenshots of the victim’s machine.


can change Internet Explorer settings to reduce warnings about malware activity.


can collect CPU and architecture information from the victim’s machine.


can collect operating system (OS) version information, processor information, system name, and information about installed disks from the victim.


can communicate over a reverse proxy using SOCKS5.


can communicate over FTP and send email over SMTP.


can communicate over HTTP, SMTP, and POP3 for C2.


can communicate to its C2 over HTTP and HTTPS if directed.


can communicate to its C2 over TCP using a custom binary protocol.


can compress data with Zip before sending it over C2.


can create a directory (C:\ProgramData\Mail\MailAg\gl) to use as a temporary directory for uploading files.


can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.


can create a new service named msamger (Microsoft Security Accounts Manager).


can create a remote shell and run a given command.


can create a shortcut in the Windows startup folder for persistence.


can create backdoor accounts with the login "HelpAssistant" with the Limbo module.


can delete all Registry entries created during its execution.


can delete files and itself after infection to avoid analysis.


can delete files and optionally overwrite with random data beforehand.


can delete files on the victim’s machine.


can delete malware and associated artifacts from the victim.


can delete services from the victim’s machine.


can deliver "beacon" payloads for lateral movement by leveraging remote COM execution.


can disable Microsoft Office Protected View by changing Registry keys.


can discover and collect victim system information.


can download additional encrypted backdoors onto the victim via GIF files.


can download additional files and payloads to compromised hosts.


can download additional files from URLs.


can download additional payloads onto the victim.


can download and execute additional files.


can download and execute an arbitary executable.


can download and launch additional payloads.


can download and upload files to and from the victim’s machine.


can download and upload files to the victim's machine.


can download an executable to run on the victim.


can download files from its C2 server to the victim's machine.


can download files from the C2 server to the victim’s machine.


can download files off the target system to send back to the server.


can download or upload files from its C2 server.


can download remote files and additional payloads to the victim's machine.


can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.


can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.


can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.


can enable remote desktop on the victim's machine.


can enumerate and search for files and directories.


can enumerate drives and Remote Desktop sessions.


can enumerate drives and their types. It can also change file permissions using cacls.exe.


can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.


can enumerate Registry values, keys, and data.


can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".


can establish persistence by adding Registry Run keys.


can establish persistence by creating a .lnk file in the Start menu.


can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.


can establish persistence by creating a scheduled task.


can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.


can establish persistence through the system screensaver by configuring it to execute the malware.


can establish using a AppCertDLLs Registry key.


can execute a payload on a remote host with PowerShell. This technique does write any data to disk.


can execute commands from its C2 server.


can execute commands on the victim's machine.


can execute commands remotely by creating a new schedule task on the remote system


can execute commands remotely by creating a new service on the remote system.


can execute commands with script as well as execute JavaScript.


can execute ipconfig on the victim’s machine.


can execute shell commands using cmd.exe.


can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.


can exploit vulnerabilities such as MS14-058.


can extract cached password hashes from a system’s registry.


can function as a proxy to create a serve that relays communication between the client and C&C server.


can gather a process list from the victim.


can gather browser usernames and passwords.


can gather information about TCP connection state.


can gather information on the mapped drives, OS version, computer name, and memory size.


can gather information on the victim username.


can gather system information, the computer name, OS version, drive and serial information from the victim's machine.


can gather the IP address from the victim's machine.


can gather the victim computer name and serial number.


can get a list of the processes and running tasks on the system.


can identify logged in users across the domain and views user sessions.


can identify system information, including battery status.


can inject a malicious DLL into a process.


can inject a variety of payloads into processes dynamically chosen by the adversary.


can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.


can interact with a victim’s Outlook session and look through folders and emails.


can launch a remote shell to execute commands.


can launch cmd.exe to execute commands on the system.


can list local and remote shared drives and folders over SMB.


can lists information about files in a directory.


can list the running processes and get the process ID and parent process’s ID.


can load a DLL using the LoadLibrary API.


can migrate into another process using reflective DLL injection.


can modify file or directory timestamps.


can obtain a list of active connections and open ports.


can obtain a list of running processes on the victim’s machine.


can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.


can obtain a list of smart card readers attached to the victim.


can obtain a process list from the victim.


can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.


can obtain information about process integrity levels.


can obtain information about running processes on the victim.


can obtain information about security software on the victim.


can obtain information about the current user.


can obtain information about the logged on user both locally and for Remote Desktop sessions.


can obtain information about the victim's IP address.


can obtain information on installed anti-malware programs.


can obtain network information, including DNS, IP, and proxies.


can obtain passwords from common browsers and FTP clients.


can obtain running services on the victim.


can obtain the computer name, OS version, and default language identifier.


can obtain the date and time of a system.


can open an interactive command-shell to perform command line functions on victim machines.


can open the Windows Firewall on the victim’s machine to allow incoming connections.


can overwrite Registry settings to reduce its visibility on the victim.


can perform process injection by using a reflective DLL.


can perform screen captures of the victim’s machine.


can query for information contained within the Windows Registry.


can query service configuration information.


can receive and execute commands with cmd.exe. It can also provide a reverse shell.


can record audio using any existing hardware recording devices.


can record keystrokes from both the keyboard and virtual keyboard.


can record sound using input audio devices.


can record the sounds from microphones on a computer.


can remotely activate the victim’s webcam to capture content.


can retrieve and execute additional  payloads from the C2 server.


can retrieve information about the Windows domain.


can retrieve IP and network adapter configuration information from compromised hosts.


can retrieve OS name/architecture and computer/domain name information from compromised hosts.


can retrieve the current content of the user clipboard.


can retrieve usernames from compromised hosts.


can run a command on another machine using .


can run  to gather information about the victim.


can scan for open TCP ports on the target network.


can scan victim drives to look for specific banking software on the machine to determine next actions. It also looks at browsing history and open tabs for specific strings.


can search directories for files on the victim’s machine.


can set its "beacon" payload to reach out to the C2 server on an arbitrary and random interval. In addition it will break large data sets into smaller chunks for exfiltration.


can sleep for a specific time and be set to communicate at specific intervals.


can sniff plaintext network credentials and use NBNS Spoofing to poison name services.


can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.


can steal access tokens from exiting processes and make tokens from known credentials.


can switch to a new C2 channel if the current one is broken.


can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.


can take regular screenshots when certain applications are open that are sent to the command and control server.


can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.


can terminate a specific process by its process id.


can timestomp files on victims using a Web shell.


can track key presses with a keylogger module.


can uninstall malware components using a batch script. Additionally, a malicious Word document used for delivery uses VBA macros for execution.


can upload, download, and execute files on the victim.


can upload and download files to the victim.


can upload and download to/from a victim machine.


can upload files from compromised hosts.


can upload files to the victim's machine for operations.


can upload files to the victim’s machine and can download additional payloads.


can use a number of known techniques to bypass Windows UAC.


can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.


can use DDE to execute additional payloads on compromised hosts.


can use HTTP and DNS for C2 communications.


can use HTTP or HTTPS for command and control to hard-coded C2 servers.


can use known credentials to run commands and spawn processes as another user.


can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.


can use Mshta.exe to execute additional payloads on compromised hosts.


can use MSHTA to serve additional payloads.


can use Obfs3, a pluggable transport, to add another layer of encryption and obfuscate TLS.


can use PowerSploit or other scripting frameworks to perform execution.


can use process hollowing for execution.


can user PowerView to perform “net user” commands and create local system and domain accounts.


can use Rundll32 to execute additional payloads.


can use tasklist to collect a list of running tasks.


can use the command-line utility cacls.exe to change file permissions.


can use the Windows API function CreateProcess to execute another process.


can use Window admin shares (C$ and ADMIN$) for lateral movement.


can use Windows Authentication Packages for persistence.


can use WinRM to execute a payload on a remote host.


can use WMI queries to gather system information.


can use WMI queries to retrieve data from compromised hosts.


can wipe drives using  Remove-Item commands.


can write and execute PowerShell scripts.


captured screenshots and desktop video recordings.


captured screenshots and sent them out to a C2 server.


captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.


captures hashes and credentials that are sent to the system after the name services have been poisoned.


captures keystrokes and sends them back to the C2 server.


captures screenshots based on specific keywords in the window’s title.


captures screenshots of the infected system.


captures screenshots of the victim’s screen.


captures the content of the desktop with the screencapture binary.


checks for anti-virus, forensics, and virtualization software.


checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.


checks for processes associated with anti-virus vendors.


checks for sandboxing libraries and debugging tools.


checks for the presence of Bitdefender security software.


checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.


checks if the victim OS is 32 or 64-bit.


checks its parent process for indications that it is running in a sandbox setup.


checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.


checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.


cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.


code may be obfuscated through structured exception handling and return-oriented programming.


collected complete contents of the 'Pictures' folder from compromised Windows systems.


collected data from local victim systems.


collected file listings of all default Windows directories.


collected system architecture information.  used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.


collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.  also enumerated all available drives on the victim's machine.


collected the victim username and whether it was running as admin, then sent the information to its C2 server.


collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.


collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.


collects a list of files and directories in C:\ with the command dir /s /a c:\ >> "C:\windows\TEMP\[RANDOM].tmp".


collects a list of install programs and services on the system’s machine.


collects a list of network shares with the command net share.


collects a list of running services with the command tasklist /svc.


collects a unique identifier (UID) from a compromised host.


collects data from the local victim system.


collects endpoint information using the systeminfo command.


collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.


collects general system enumeration data about the infected machine and checks the OS version.


collects hard drive content and system configuration information.


collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.


collects information about running processes.


collects information about running processes from victims.


collects information about the OS and computer name.


collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.


collects information on network settings and Internet proxy settings from the victim.


collects information on running processes and environment variables from the victim.


collects its process identifier (PID) on the victim.


collects Keychain storage data and copies those passwords/tokens to a file.


collects keystrokes from the victim machine.


collects keystrokes from the victim’s machine.


collects local files and information from the victim’s local machine.


collects MAC address and local IP address information from the victim.


collects network adapter and interface information by using the commands ipconfig /all, arp -a and route print. It also collects the system's MAC address with getmac and domain configuration with net config workstation.


collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands systeminfo, net config workstation, hostname, ver, set, and date /t.


collects password policy information with the command net accounts.


collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.


collects the account name of the logged-in user and sends it to the C2.


collects the computer name, OS versioning information, and OS install date and sends the information to the C2.


collects the computer name, the BIOS model, and execution path.


collects the computer name and host name on the compromised system.


collects the computer name and serial number for the storage volume C:\.


collects the current username and sends it to the C2 server.


collects the current username from the victim.


collects the domain name from a compromised host.


collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.


collects the group name of the logged-in user and sends it to the C2.


collects the hostname of the victim machine.


collects the local IP address of the victim and sends it to the C2.


collects the MAC address, computer name, and CPU information.


collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.


collects the OS name, machine name, and architecture information.


collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.


collects the OS version and computer name.


collects the system information, including hostname and OS version, and sends it to the C2 server.


collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.


collects the username from the victim’s machine.


collects the victim IP address, MAC address, as well as the victim account domain name.


collects the victim LAN IP address and sends it to the C2 server.


collects the victim’s computer name, processor architecture, OS version, and volume serial number.


collects the victim’s username and whether that user is an admin.


collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.


collects user files from the compromised host based on predefined file extensions.


collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).


command and control occurs via HTTPS over port 443.


Commands such as net group and net localgroup can be used in  to gather information about and manipulate groups.


Commands such as net view can be used in  to gather information about available remote systems.


Commands under net user can be used in  to gather information about and manipulate user accounts.


commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.


communicates over common ports such as TCP 80, 443, and 25.


communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.


communicates to its C2 server over HTTP.


communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.


communicates to the C2 server by retrieving a Google Doc.


communicates using HTTPS and uses a custom encryption cipher to encrypt the HTTPS message body.


communicates with its C2 server over HTTP.


communicates with its C2 server over HTTPS.


communicates with its C2 server over TCP port 3728.


communicates with its C2 servers over HTTP.


communicates with its C2 servers through a TCP socket.


completes network communication via raw sockets.


compressed data with zlib prior to sending it over C2.


compresses collected files with both the GZipStream class and a simple character replacement scheme before sending them to its C2 server.


compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.


compromised legitimate organizations' websites to create watering holes to compromise victims.


compromised McAfee ePO to move laterally by distributing malware as a software deployment task.


compromised three Japanese websites using a Flash exploit to perform watering hole attacks.


compromised user credentials and used valid accounts for operations.


concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.


conducts brute force attacks against SSH services to gain initial access.


conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.


configured its payload to inject into the rundll32.exe.


connects to a predefined domain on port 443 to exfil gathered information.


connects to C2 infrastructure and establishes backdoors over a custom communications protocol.


connects to external C2 infrastructure over the HTTP port.


connects to port 80 of a C2 server using Wininet API.


contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.


contains a cleanup module that removes traces of itself from the victim.


contains a collection of CodeExecution modules that enable by injecting code (DLL, shellcode) or reflectively loading a Windows PE file into a process.


contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.


contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences, Windows vault credential objects, or using .


contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.


contains a collection of Privesc-PowerUp modules that can discover and exploit various path interception opportunities in services, processes, and variables.


contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.


contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.


contains a command to collect and exfiltrate emails from Outlook.


contains a command to collect information about anti-virus software on the victim.


contains a command to collect the victim MAC address and LAN IP.


contains a command to collect the victim PC name and operating system.


contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.


contains a command to perform screen captures.


contains a command to retrieve files from its C2 server.


contains a copy of the OpenSSL library to encrypt C2 traffic.


contains a custom version of the RC4 algorithm that includes a programming error.


contains a keylogger module that collects keystrokes and the titles of foreground windows.


contains a module that captures screenshots of the victim's desktop.


contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.


contains a module to steal credentials from Web browsers on the victim machine.


contains code to delete files from the victim’s machine.


contains code to open and copy data from the clipboard.


contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.


contains functionality to collect information from the clipboard.


contains junk code in its binary, likely to confuse malware analysts.


contains junk code in its functions in an effort to confuse disassembly programs.


contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.


contains keylogging functionality to steal passwords.


contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.


contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using autorun functionality.


contains the execFile function to execute a specified file on the system using the NSTask:launch method.


contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.


contains the getFirefoxPassword function to attempt to locate Firefox passwords.


contains the getInfoOSX function to return the OS X version as well as the current user.


contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed.


contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory.


contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\ Support/MobileSync/Backup/.


contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.


contains UAC bypass code for both 32- and 64-bit systems.


contains unused machine instructions in a likely attempt to hinder analysis.


copied all targeted files to a directory called index that was eventually uploaded to the C&C server.


copied and installed tools for operations once in the victim environment.


copies a file over to the remote system before execution.


copies an executable payload to the target system by using  and then scheduling an unnamed task to execute the malware.


copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.


copies files from removable drives to C:\system.


copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file.


copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).


copies itself to disk and creates an associated run key Registry entry to establish.


copies itself to the Startup folder to establish persistence.


copies staged data to removable drives when they are inserted into the system.


created accounts disguised as legitimate backup and service accounts as well as an email administration account.


created a custom video recording capability that could be used to monitor operations in the victim's environment.


created a directory named "out" in the user's %AppData% folder and copied files to it.


created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.


created a  that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.


created new Windows services and added them to the startup directories for persistence.


creates a backdoor by making a connection using a HTTP POST.


creates a backdoor through which remote attackers can adjust token privileges.


creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.


creates a backdoor through which remote attackers can create a service.


creates a backdoor through which remote attackers can delete files.


creates a backdoor through which remote attackers can download files and additional malware components.


creates a backdoor through which remote attackers can download files onto a compromised host.


creates a backdoor through which remote attackers can download files onto compromised hosts.


creates a backdoor through which remote attackers can inject files into running processes.


creates a backdoor through which remote attackers can load and call DLL functions.


creates a backdoor through which remote attackers can monitor services.


creates a backdoor through which remote attackers can obtain data from local systems.


creates a backdoor through which remote attackers can retrieve a list of running processes.


creates a backdoor through which remote attackers can retrieve files.


creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.


creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.


creates a backdoor through which remote attackers can retrieve lists of files.


creates a backdoor through which remote attackers can retrieve lists of running processes.


creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.


creates a backdoor through which remote attackers can start a remote shell.


creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.


creates and uses a VBScript as part of its persistent execution.


creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.”


creates a new service named “ntssrv” to execute the payload.


creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.


creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.


creates a new Windows service with the malicious executable for persistence.


creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.


creates a Registry Run key to establish persistence.


creates a Registry subkey that registers a new service.


creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. 's backdoor also enables remote attackers to modify and delete subkeys.


creates a scheduled task to establish by executing a malicious payload every subsequent minute.


creates a scheduled task to maintain persistence on the victim’s machine.


creates a scheduled task to run itself every three minutes.


creates a shortcut file and saves it in a Startup folder to establish persistence.


creates a suspended svchost process and injects its DLL into it.


creates a Windows service to establish persistence.


creates folders to store output from batch scripts prior to sending the information to its C2 server.


creates new services to establish persistence.


creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().


creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.


creates Registry keys to allow itself to run as various services.


creates run key Registry entries pointing to malicious DLLs dropped to disk.


creates scheduled tasks to establish persistence.


creates the following Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia.


creates then deletes log files during installation of itself as a service.


creates valid users to provide access to the system.


creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\<Username>\AppData\Roaming\Microsoft\store to store screenshot JPEG files.


credential stealer ZUMKONG emails credentials from the victim using HTTP POST requests.


Data captured by  is placed in a temporary file under a directory named "memdump".


Data  copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.


decodes an embedded configuration using XOR.


decodes Base64 strings and decrypts strings using a custom XOR algorithm.


decodes strings in the malware using XOR and RC4.


decrypts and extracts a copy of its main DLL payload when executing.


decrypts code, strings, and commands to use once it's on the victim's machine.


decrypts resources needed for targeting the victim.


deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.


deleted the DLL dropper from the victim’s machine to cover their tracks.


deletes content from C2 communications that was saved to the user's temporary directory.


deletes data in a way that makes it unrecoverable.


deletes files using DeleteFileW API call.


deletes one of its files, 2.hwp, from the endpoint after establishing persistence.


deletes the original dropped file from the victim.


deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.


delivered  to victims via a compromised legitimate website.


deobfuscates its strings and APIs once its executed.


DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.


determines a working directory where it stores all the gathered data about the compromised machine.


digitally signed an executable with a stolen certificate from legitimate company AI Squared.


discovers information about the infected machine.


discovers the current domain information.


disguised its malicious binaries with several layers of obfuscation, including encrypting the files.


DLL file and non-malicious decoy file are encrypted with RC4.


DLL side-loading has been used to execute  through a legitimate Citrix executable ssonsvr.exe which is vulnerable to the technique. The Citrix executable was dropped along with  by the dropper.


downloaded and launched code within a SCT file.


downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.


downloads additional files from C2 servers.


downloads additional files that are base64-encoded and encrypted with another cipher.


downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.


downloads and executes additional PowerShell code and Windows binaries.


downloads and executes PowerShell scripts.


downloads and installs Tor via homebrew.


downloads and uploads files on the victim’s machine.


downloads a new version of itself once it has installed. It also downloads additional plugins.


downloads an executable and injects it directly into a new process.


downloads a PowerShell script that decodes to a typical shellcode loader.


downloads encoded payloads and decodes them on the victim.


downloads several additional files and saves them to the victim's machine.


dropped and executed SecretsDump and CrackMapExec, tools that can dump password hashes.


dropped and executed tools used for password cracking, including Hydra.


dropper creates VBS scripts on the victim’s machine.


Droppers used by  use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.


drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.


drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.


dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.


dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.


dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.


During execution,  malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.


During its initial execution,  extracts operating system information from the infected host.


During the  installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.


Each time a new drive is inserted,  generates a list of all files on the drive and stores it in an encrypted file.


embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.


embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened. The actors also used batch scripting.


employs the same encoding scheme as  for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.


enables remote interaction and can obtain additional code over HTTPS GET and POST requests.


enables the Remote Desktop Protocol for persistence.


encapsulates traffic in multiple layers of encryption.


encodes commands from the control server using a range of characters and gzip.


encodes communications to the C2 server in Base64.


encrypted a .dll payload using RTL and a custom encryption algorithm.  has also obfuscated payloads with base64, XOR, and RC4.


encrypts C2 communications with RC4 as well as TLS.


encrypts C2 content with XOR using a single byte, 0x12.


encrypts C2 traffic using AES with a static key.


encrypts C2 traffic using RC4 with a static key.


encrypts C2 traffic with HTTPS and also encodes it with a single-byte XOR key.


encrypts collected data using a single byte XOR key.


encrypts command and control communications with RC4.


encrypts data sent to its C2 server over HTTP with RC4.


encrypts several of its files, including configuration files.


encrypts some C2 traffic with the Blowfish cipher.


encrypts strings in the backdoor using a custom XOR algorithm.


encrypts strings to make analysis more difficult.


encrypts the collected files using 3-DES.


encrypts the message body of HTTP traffic with RC2 (in CBC mode) and Base64 encoding.


encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.


enumerates directories and obtains file attributes on a system.


enumerates directories and scans for certain files.


enumerates the current network connections similar to  net use .


established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion]Winlogon.


establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.


establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.


establishes persistence by adding a Registry Run key.


establishes persistence by creating a shortcut.


establishes persistence by creating a shortcut in the Windows startup folder to run a script each time the user logs in.


establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.


establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.


establishes persistence in the Startup folder.


establishes persistence through a Registry Run key.


establishes persistence under the Registry key HKCU\Software\Run auto_update.


examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.


executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.


executes a binary on the system and logs the results into a temp file by using: cmd.exe /c "<file_path> > %temp%\PM* .tmp 2>&1".


executes additional Jscript and VBScript code on the victim's machine.


executes and stores obfuscated Perl scripts.


executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.


executes cmd.exe to provide a reverse shell to adversaries.


executes commands remotely on the infected host.


executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.


executes ipconfig /all after initial communication is made to the remote server.


executes net start after initial communication is made to the remote server.


executes net user after initial communication is made to the remote server.


executes payloads using the Windows API call CreateProcessW().


executes shellcode and a script to decode Base64 strings.


executes systeminfo after initial communication is made to the remote server.


executes  using PowerShell and can also perform pass-the-ticket and use Lazagne for harvesting credentials.


executes using regsvr32.exe called from the  persistence mechanism.


exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.


exfiltrates command output and collected files to its C2 server in 1500-byte blocks.


exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.


exfiltrates data in compressed chunks if a message is larger than 4096 bytes .


exfiltrates data over the same channel used for C2.


exfiltrates data using cookie values that are Base64-encoded.


exfiltrates screenshot files to its C2 server.


extracts and decrypts stage 3 malware, which is stored in encrypted resources.


Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.


finds a specified directory, lists the files and metadata about those files.


first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.


first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.


Following data collection,  has compressed log files into a ZIP archive prior to staging and exfiltration.


Following exploitation with  malware,  actors created a file containing a list of commands to be executed on the compromised computer.


For all non-removable drives on a victim,  executes automated collection of certain files for later exfiltration.


For early  versions, the compilation timestamp was faked.


gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.


gathered information and files from local directories for exfiltration.


gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.


gathers and beacons the system time during installation.


gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.


gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.


gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.


gathers domain and account names/information through process monitoring.


gathers file and directory information from the victim’s machine.


gathers information about local groups and members.


gathers information about network adapters.


gathers information about opened windows.


gathers information on local groups and members on the victim’s machine.


gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.


gathers system configuration information.


gathers system information, network addresses, disk type, disk free space, and the operation system version.


gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command systeminfo.


gathers the computer name and checks the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.


gathers the current domain the victim system belongs to.


gathers the IP address and domain from the victim’s machine.


gathers the local system time from the victim’s machine.


gathers the Mac address, IP address, and the network adapter information from the victim’s machine.


gathers the MAC address of the victim’s machine.


gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.


gathers the OS version, CPU type, amount of RAM available from the victim’s machine.


gathers the OS version, logical drives information, processor information, and volume information.


gathers the username from the victim’s machine.


gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.


gathers the victim's IP address and domain information, and then sends it to its C2 server.


gathers the victim’s IP address via the ipconfig -all command.


gathers volume drive information and system information.


Get-Keystrokes Exfiltration module can log keystrokes.


Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.


Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.


gets an output of running processes using the tasklist command.


had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, and CVE-2017-0199.


harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).


has 2 methods for elevating integrity. It can bypass UAC through eventvwr.exe and sdclt.exe.


has a built-in module for port scanning.


has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.


has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).


has a command to collect the victim's IP address.


has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.


has a command to create a reverse shell.


has a command to delete a file and deletes files after they have been successfully uploaded to C2 servers.


has a command to delete its Registry key and scheduled task.


has a command to disable routing and the Firewall on the victim’s machine.


has a command to download a file from the C2 server to the victim mobile device's SD card.


has a command to download a file to the system from its C2 server.


has a command to download an .exe and use process hollowing to inject it into a new process.


has a command to download and execute an additional file.


has a command to download and executes additional files.


has a command to edit the Registry on the victim’s machine.


has a command to gather system information from the victim’s machine.


has a command to get text of the current foreground window.


has a command to get the victim's domain and NetBIOS name.


has a command to list account information on the victim’s machine.


has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.


has a command to list its directory and logical drives.


has a command to list the victim's processes.


has a command to obtain a directory listing.


has a command to obtain a process listing.


has a command to retrieve information about connected users.


has a command to retrieve metadata for files on disk as well as a command to list the current working directory.


has a command to return a list of running processes.


has a command to set certain attributes such as creation/modification timestamps on files.


has a command to take a screenshot and send it to the C2 server.


has a command to upload a file to the victim machine.


has a command to upload information about all running processes to its C2 server.


has a command to upload to its C2 server victim browser bookmarks.


has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.


has a command to write random data across a file and delete it.


has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.


has added Registry Run keys to establish persistence.


has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.


has a function for decrypting data containing C2 configuration information.


has a module for loading and executing PowerShell scripts.


has a module for performing remote desktop access.


has a module to clear event logs with PowerShell.


has a package that collects documents from any inserted USB sticks.


has a plugin that can perform ARP scanning as well as port scanning.


has a plugin to detect active drivers of some security products.


has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.


has a tool called CANDYKING to capture a screenshot of user's desktop.


has a tool that can copy files to remote machines.


has a tool that can detect the existence of remote systems.


has a tool that can enumerate current network connections.


has a tool that can enumerate the permissions associated with Windows groups.


has a tool that can list out currently running processes.


has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.


has a tool that exfiltrates data over the C2 channel.


has a tool that looks for files and directories on the local file system.


has attached a malicious document to an email to gain initial access.


has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.


has attempted to get users to execute malware via social media and spearphishing emails.


has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.


has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.


has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.


has attempted to get victims to open malicious files sent via email as part of spearphishing campaigns.


has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.


has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.


has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context.


has been delivered through compromised sites acting as watering holes.


has been known to add created accounts to local admin groups to maintain elevated access.


has been known to brute force password hashes to be able to leverage plain text credentials.


has been known to create or enable accounts, such as support_388945a0.


has been known to remove indicators of compromise from tools.


has been known to stage files for exfiltration in a single location.


has been known to use credential dumping.


has been known to use multiple backdoors per campaign.


has been launched by starting iexplore.exe and replacing it with 's payload.


has been loaded onto Exchange servers and disguised as an ISAPI filter (DLL file). The IIS w3wp.exe process then loads the malicious DLL.


has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the registry run key location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe


has been observed being used to download  and the Cobalt Strike Beacon payload onto victims.


has been observed using SQL injection to gain access to systems.


has been used to decode binaries hidden inside certificate files as Base64 information.


has been used to execute remote commands.


has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.


has checked for the local admin group domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.


has cleared logs during post compromise cleanup activities.


has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.


has collected data from victims' local systems.


has collected emails from victim Microsoft Exchange servers.


has collected files from a local victim.


has collected information from Microsoft SharePoint services within target networks.


has commands to delete files and persistence mechanisms from the victim.


has commands to enumerate all storage devices and to find all files that start with a particular string.


has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.


has commands to get the current user's name and SID.


has commands to get the time the machine was built, the time, and the time zone.


has compressed and encrypted data into password-protected RAR archives prior to exfiltration.


has compressed data into password-protected RAR archives prior to exfiltration.


has compressed files before exfiltration using TAR and RAR.


has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.


has connected to C2 servers through proxies.


has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.


has created a scheduled task named “AdobeFlashSync” to establish persistence.


has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.


has created new services to establish persistence.


has created Windows tasks to establish persistence.


has deleted and overwrote files to cover tracks.


has deleted existing logs and exfiltrated file archives from a victim.


has deleted files associated with their payload after execution.


has deleted Registry keys during post compromise cleanup activities.


has deleted tmp and prefetch files during post compromise cleanup activities.


has delivered  and  by executing PowerShell commands through DDE in Word documents.


has delivered malicious links and macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.


has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.


has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.


has deployed a bootkit along with  to ensure its persistence on the victim. The bootkit shares code with some variants of .


has deployed backup web shells and obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.


has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.


has detached network shares after exfiltrating files, likely to evade detection.


has disabled host-based firewalls. The group has also globally opened port 3389.


has distributed targeted emails containing links to malicious documents with embedded macros.


has distributed targeted emails containing Word documents with embedded malicious macros.


has downloaded additional code and files from servers onto victims.


has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.


has downloaded additional malware, including by using .


has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.


has downloaded additional scripts and files from adversary-controlled servers.  has also used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.


has downloaded second stage malware from compromised websites.


has dumped credentials, including by using .


has dumped credentials from victims. Specifically, the group has used the tool GET5 Penetrator to look for remote login and hard-coded credentials.


has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.


has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.


has encrypted and encoded data in its malware, including by using base64.


has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.


has encrypted documents and malicious executables.


has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.


has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable. It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe” to establish persistence.


has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.


has established persistence by using the Registry option in PowerShell Empire to add a Run key.


has exfiltrated data in HTTP POST headers.


has exfiltrated data over FTP separately from its primary C2 channel over DNS.


has exfiltrated files stolen from file shares.


has exfiltrated files stolen from local systems.


has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.


has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.


has exploited Microsoft Word vulnerability CVE-2014-4114 for execution.


has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.


has exploited the CVE-2016-0167 local vulnerability.


has functionality to copy itself to network shares.


has functionality to remove Registry Run key persistence as a cleanup procedure.


has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.


has gathered information about local network connections using .


has infected victims by tricking them into visiting compromised watering hole websites.


has infected victims using watering holes.


has injected SMB URLs into malicious Word spearphishing attachments to initiate .


has inserted garbage characters into code, presumably to avoid anti-virus detection.


has installed updates and new malware on victims.


has interacted with compromised systems to browse and copy files through its graphical user interface in  sessions.


has leveraged a zero-day vulnerability to escalate privileges.


has leveraged multiple types of spearphishing in order to attempt to get a user to open links and attachments.


has masqueraded as legitimate Adobe Content Management System files.


has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.


has modules that are capable of capturing audio.


has obfuscated code using base64 and gzip compression.


has obfuscated DLLs and functions using dummy API calls inserted between real instructions.


has obfuscated strings in  by base64 encoding, and then encrypting them.


has packed malware payloads before delivery to victims.


has performed C2 using DNS via A, OPT, and TXT records.


has performed credential dumping with  and Lazagne.


has performed DLL search order hijacking to execute their payload.


has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).


has performed timestomping on victim files.


has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.


has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.


has registered itself as a scheduled task to run each time the current user logs in.


has registered itself as a service to establish persistence.


has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to dump credentials any time a domain, local user, or administrator logs in or changes a password.


has retrieved internal documents from machines inside victim environments, including by using  to stage documents before.


has run a keylogger plug-in on a victim.


has run a plug-in on a victim to spread through the local network by using  and accessing admin shares.


has run hostname and systeminfo on a victim.


has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.


has sent a C2 response that was base64-encoded.


has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.


has sent malicious Word OLE compound documents to victims.


has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.


has sent spearphishing attachments attempting to get a user to open them.


has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.


has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.


has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution. The group has also used an exploit toolkit known as Threadkit that launches .bat files.


has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.


has sometimes used drive-by attacks against vulnerable browser plugins.


has staged encrypted archives for exfiltration on Internet-facing servers that had previously been compromised with .


has targeted victims using spearphishing emails with malicious Microsoft Word attachments.


has targeted victims with spearphishing emails containing malicious Microsoft Word documents.


has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.


has the ability to create a reverse shell.


has the ability to discover and manipulate Windows services.


has the ability to download and execute additional files.


has the ability to enumerate drive types.


has the ability to enumerate system information.


has the ability to execute shell commands.


has the ability to identify any anti-virus installed on the infected system.


has the ability to initiate keylogging and screen captures.


has the ability to list processes on the system.


has the ability to obtain screenshots of the compromised system.


has the ability to remove Registry entries that it created during execution.


has the ability to scan for security tools such as firewalls and antivirus tools.


has the ability to search for a given filename on a victim.


has the ability to upload and download files from its C2 server.


has the capability to access the webcam on the victim’s machine.


has the capability to add its own account to the victim's machine.


has the capability to capture audio from a victim machine.


has the capability to capture keystrokes.


has the capability to capture screenshots.


has the capability to capture video from a victim machine.


has the capability to communicate over a backup channel via plus.google.com.


has the capability to create a remote shell.


has the capability to create a remote shell and execute specified commands.


has the capability to create a reverse shell.


has the capability to create a reverse shell on victims.


has the capability to delete files off the victim’s machine.


has the capability to delete local files.


has the capability to discover processes.


has the capability to download a file to the victim from the C2 server.


has the capability to download files from the C2 server.


has the capability to execute the command ipconfig /all.


has the capability to execute the command net start to interact with services.


has the capability to execute ver, systeminfo, and gpresult commands.


has the capability to gather the IP address from the victim's machine.


has the capability to gather the system’s hostname and OS version.


has the capability to gather the username from the victim's machine.


has the capability to gather the victim's current directory.


has the capability to gather the victim's proxy information.


has the capability to identify remote hosts on connected networks.


has the capability to log keystrokes from the victim’s machine.


has the capability to obtain a listing of running processes (including loaded modules).


has the capability to obtain file and directory listings.


has the capability to open a remote shell and run basic commands.


has the capability to retrieve information about groups.


has the capability to retrieve information about shares on remote hosts.


has the capability to retrieve information about the OS.


has the capability to retrieve information about users on remote hosts.


has the capability to scan for open ports on hosts in a connected network.


has the capability to schedule remote AT jobs.


has the capability to take screenshots of the victim’s machine.


has the capability to use rm -rf to remove folders and files from the victim's machine.


has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.


has tunneled RDP backdoors over port 443.


has updated and modified its malware, resulting in different hash values that evade detection.


has used , a RAT that uses HTTP to communicate.


has used a Batch file to automate frequently executed post compromise cleanup activities.


has used a batch script that adds a Registry Run key to establish malware persistence.


has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.


has used a global service provider's IP as a proxy for C2 traffic from a victim.


has used a keylogging tool called KEYPUNCH.


has used a keylogging tool that records keystrokes in encrypted files.


has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.


has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.  has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.


has used an audio capturing utility known as SOUNDWAVE that captures microphone input.


has used Android backdoors capable of enumerating specific files on the infected devices.


has used Android backdoors capable of exfiltrating specific files directly from the infected devices.


has used  and  to register a scheduled task to execute malware during lateral movement.


has used an RSS feed on Livejournal to update a list of encrypted C2 server names.


has used appcmd.exe to disable logging on a victim server.


has used application shim databases for persistence.


has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.


has used a scheduled task for persistence.


has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.


has used a tool known as RemoteExec (similar to ) to remotely execute batch scripts and binaries.


has used a tool that can obtain info about local and global group users, power users, and administrators.


has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig." The group has also used a tools to dump passwords from browsers.


has used a variant of NanoCore RAT that communicates with its C2 server over port 6666.


has used batch scripting to automate execution of commands.


has used batch scripts and scheduled tasks to delete critical system files.


has used batch scripts in its malware to install persistence mechanisms.


has used bitsadmin.exe to download additional tools.


has used brute force techniques to obtain credentials.


has used C:\Windows\Debug and C:\Perflogs as staging directories.


has used CMSTP.exe and a malicious INF to execute its  payload.


has used code-signing certificates on its malware that are either forged due to weak keys or stolen.


has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.


has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}).


has used compromised credentials to access other systems on a victim network.


has used compromised WordPress blogs as C2 servers.


has used credential dumping tools such as  and Lazagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.


has used custom DNS Tunneling protocols for C2.


has used CVE-2014-6324 to escalate privileges.


has used CVE-2015-4902 to bypass security features.


has used Daniel Bohannon’s Invoke-Obfuscation framework. The group also used files with base64 encoded PowerShell commands.


has used DLL side-loading to load malicious payloads.


has used encoded PowerShell scripts uploaded to  installations to download and install , as well as to evade defenses.


has used encoded PowerShell scripts uploaded to  installations to download and install .  also used PowerShell scripts to evade defenses.


has used exploits to increase their levels of rights and privileges.


has used filenames and Registry key names associated with Windows Defender.


has used Flash Player (CVE-2016-4117, CVE-2018-4878) and Word (CVE-2017-0199) exploits for execution.


has used  for credential dumping, as well as Metasploit’s  NTDSGRAB module to obtain a copy of the victim's Active Directory database.


has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.


has used HTTP, HTTPS, and DNS for command and control.


has used HTTP for C2, including sending error codes in Cookie headers.


has used HTTP requests for command and control.


has used  in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has used certutil -decode to decode files on the victim’s machine when dropping .


has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks.


has used keyloggers that are also capable of dumping credentials.


has used legitimate access granted to Managed Service Providers in order to access victims of interest.


has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.


has used macros in s as well as executed VBScripts on victim machines.


has used macros in Word documents that would download a second stage if executed.


has used malicious macros embedded inside Office documents to execute files.


has used Metasploit to perform reflective DLL injection in order to escalate privileges.


has used Meterpreter to enumerate users on remote systems.


has used Mshta.exe to execute its  payload.


has used mshta.exe to execute VBScript to execute malicious code on victim systems.


has used multiple software exploits for common client software, like Microsoft Word and Adobe Reader, to gain code execution as part of.


has used multiple types of scripting for execution, including JavaScript, JavaScript Scriptlets in XML, and VBScript.


has used net.exe in a script with net accounts /domain to find the password policy of a domain.


has used net group /domain, net localgroup administrators, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find group permission settings on a victim.


has used netstat -an on a victim to get a listing of network connections.


has used net time to check the local time on a target system.


has used net use to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim.


has used network scanning and enumeration tools, including .


has used ping to identify other machines of interest.


has used ports 53, 80, 443, and 8080 for C2.


has used powershell.exe to download and execute scripts.


has used PowerShell-based tools and shellcode loaders for execution.


has used PowerShell for execution and privilege escalation.


has used PowerShell for execution of a payload.


has used PowerShell on victim systems to download and run payloads after exploitation.


has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.


has used PowerShell scripts to download and execute programs in memory, without writing to disk.


has used process hollowing in iexplore.exe to load the  implant.


has used Putty Secure Copy Client (PSCP) to transfer data.


has used Putty to access compromised systems.


has used RAR to compress collected data before.


has used RAR to stage and compress local folders.


has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic.


has used RDP connections to move across the victim network.


has used RDP to move laterally to systems in the victim environment.


has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.


has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.


has used regsvr32.exe to execute a server variant of  in victim networks.


has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.


has used Remote Desktop Protocol to conduct lateral movement.


has used scheduled tasks to persist on victim systems.


has used sc query on a victim to gather information about services.


has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.


has used shell and VBS scripts as well as embedded macros for execution.


has used shellcode to download Meterpreter after compromising a victim.


has used spearphishing via a link to get users to download and run their malware.


has used spearphishing with an attachment to deliver files with exploits to initial victims.


has used stolen certificates to sign its malware.


has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor. The group has also moved laterally using the Local Administrator account.


has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.


has used TeamViewer to preserve remote access in case control using the Cobalt Strike module was lost.


has used Technet and Pastebin web pages for command and control.


has used the command-line interface for execution.


has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.


has used the Microsoft administration tool csvde.exe to export Active Directory data.


has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\Software\Microsoft\Office test\Special\Perf to execute code.


has used the open source tool Essential NetTools to map the network and build a list of targets.


has used the Plink utility to create SSH tunnels.


has used the Plink utility to tunnel RDP back to C2 infrastructure.


has used the  RAT, which communicates over HTTP with a payload encrypted with RC4.


has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.


has used the Windows command shell to execute commands.


has used  to locate PDF, Excel, and Word documents during. The group also searched a compromised DCCC computer for specific terms.


has used tools to compress data before exfilling it.


has used tools to take screenshots from victims.


has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.


has used valid, compromised email accounts for defense evasion, including to send malicious emails to other victim organizations.


has used valid accounts shared between Managed Service Providers and clients to move between the two environments.


has used valid digital certificates from Sysprint AG to sign its  dropper.


has used various batch scripts to establish C2, download additional files, and conduct other functions.


has used various forms of spearphishing attempting to get a user to open links or attachments.


has used various forms of spearphishing in attempts to get users to open links or attachments.


has used various methods of process injection including hot patching.


has used various tools to download files, including DGet (a similar tool to wget).


has used various tools to perform credential dumping.


has used various types of scripting for execution, including .bat and .vbs scripts. The group has also used macros to deliver malware such as  and .


has used VBS, VBE, and batch scripts for execution.


has used VBScript and JavaScript files to execute its  payload.


has used  via Web shell to establish redundant access. The group has also used harvested credentials to gain access to Internet-accessible resources such as Outlook Web Access, which could be used for redundant access.


has used Web shells, often to maintain access to a victim network.


has used Web shells to maintain access to victim websites.


has used Windows DDE for execution of commands and a malicious VBS.


has used WinSCP to exfiltrate data from a targeted organization over FTP.


has used WMI event filters to establish persistence.


has used XOR with 0x90 to obfuscate its configuration file.


hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.


hides collected data in password-protected .rar archives.


hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.


hides many of its backdoor payloads in an alternate data stream (ADS).


hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.


identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.


identifies and kills anti-malware processes.


identifies a proxy server if it exists and uses it to make HTTP requests.


identifies files and directories for collection by searching for specific file extensions or file modification time.


identifies files matching certain file extension and copies them to subdirectories it created.


identifies files with certain extensions and copies them to a directory in the user's profile.


identifies processes and collects the process ids.


identifies security software such as antivirus through the Security module.


If an initial connectivity check fails,  attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.


If  cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.


If  does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number,  will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.


If installing itself as a service fails,  instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.


If running as administrator,  installs itself as a new service named bmwappushservice to establish persistence.


implements a command and control protocol over HTTP.


includes a capability to modify the "beacon" payload to eliminate known signatures or unpacking methods.


includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.


includes garbage code to mislead anti-malware software and researchers.


injects a DLL for  into the explorer.exe process.


injects into other processes to load modules.


injects into the Internet Explorer process.


injects its DLL component into svchost.exe.


injects its DLL file into a newly spawned Internet Explorer process.


injects itself into various processes depending on whether it is low integrity or high integrity.


injects its malware variant, , into the cmd.exe process.


inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.


installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.


installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor."


installer searches the Registry and system to see if specific antivirus tools are installed on the system.


installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry.


installs a registry Run key to establish persistence.


installs a root certificate to aid in man-in-the-middle actions.


installs a service pointing to a malicious DLL dropped to disk.


installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.


installs itself under Registry Run key to establish persistence.


Invoke-Kerberoast module can request service tickets and return crackable ticket hashes.


Invoke-TokenManipulation Exfiltration module can be used to locate and impersonate user logon tokens.


Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a  payload.


is a rootkit that hides certain operating system artifacts.


is a simple proxy that creates an outbound RDP connection.


is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.


is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence.


is a Web shell. The ASPXTool version used by  has been deployed to accessible servers running Internet Information Services (IIS).


is capable of accessing locally stored passwords on victims.


is capable of configuring itself as a service.


is capable of creating a remote Bash shell and executing commands.


is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.


is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.


is capable of deleting Registry keys, sub-keys, and values on a victim system.


is capable of deleting Registry keys used for persistence.


is capable of downloading additional files.


is capable of downloading additional files through C2 channels, including a new version of itself.


is capable of downloading files, including additional modules.


is capable of downloading files from the C2.


is capable of enumerating and making modifications to an infected system's Registry.


is capable of enumerating and manipulating files and directories.


is capable of enumerating application windows.


is capable of executing commands and spawning a reverse shell.


is capable of executing commands via cmd.exe.


is capable of file deletion along with other file system interaction.


is capable of injecting code into the APC queue of a created  process as part of an "Early Bird injection."


is capable of listing contents of folders on the victim.  also searches for custom network encryption software on victims.


is capable of listing files, folders, and drives on a victim.


is capable of loading executable code via process hollowing.


is capable of obtaining directory, file, and drive listings.


is capable of opening a command terminal.


is capable of performing directory listings.


is capable of performing process listings.


is capable of performing remote command execution.


is capable of performing remote file transmission.


is capable of performing screen captures.


is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.


is capable of probing the network for open ports.


is capable of providing shell functionality to the attacker to execute commands.


is capable of reading files over the C2 channel.


is capable of retrieving information about the infected system.


is capable of spawning a Windows command shell.


is capable of starting a process using CreateProcess.


is capable of stealing Outlook passwords.


is capable of taking an image of and uploading the current desktop.


is capable of uploading and downloading files.


is capable of using HTTP, HTTPS, SMTP, and DNS for C2.


is capable of using ICMP, TCP, and UDP for C2.


is capable of using its command and control protocol over port 443. However, Duqu is also capable of encapsulating its command protocol over standard application layer protocols. The Duqu command and control protocol implements many of the same features as TCP and is a reliable transport protocol.


is capable of using Windows hook interfaces for information gathering such as credential access.


is capable of writing a file to the compromised system from the C2 server.


is capable of writing to a Registry Run key to establish.


is controlled via commands that are appended to image files.


is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.


is installed via execution of rundll32 with an export named "init" or "InitW."


is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.


is known to have the capability to overwrite the firmware on hard drives from some manufacturers.


is known to use RAR with passwords to encrypt data prior to exfiltration.


is known to use software packing in its tools.


is known to utilize encryption within network protocols.


is launched through use of DLL search order hijacking to load a malicious dll.


is obfuscated using the obfuscation tool called ConfuserEx.


is obfuscated using the open source ConfuserEx protector.  also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.


is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.


is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.


is used to enumerate and dump information from Microsoft SharePoint.


is used to execute programs and other actions at the command-line interface.


is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.


is used to poison name services to gather hashes and credentials from systems within a local network.


is used to schedule tasks on a Windows system to run at a specific date and time.


is usually configured with primary and backup domains for C2 communications.


keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.


kills and disables services by using cmd.exe.