Agrius

Agrius used tools such as Mimikatz to dump LSASS memory to capture credentials in victim environments.

Agrius dumped the SAM file on victim machines to capture credentials.

Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.

Agrius used the tool NBTscan to scan for remote, accessible hosts in victim environments.

Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts. Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.

Agrius used the Plink tool for tunneling and connections to remote machines, renaming it systems.exe in some instances.

Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.

Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.

Agrius uses ASPXSpy web shells to enable follow-on command execution via cmd.exe.

Agrius has used the folder, C:\\windows\\temp\\s\\, to stage data for exfiltration.

Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.

Agrius engaged in various brute forcing activities via SMB in victim environments.

Agrius engaged in password spraying via SMB in victim environments.

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.

Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.