Procedure examples

LunarMail can set the `PR_DELETE_AFTER_SUBMIT` flag to delete messages sent for data exfiltration.

Goopy has the ability to delete emails used for C2 once the content has been copied.

Misdat is capable of deleting Registry keys used for persistence.

Raspberry Robin uses a RunOnce Registry key for persistence, where the key is removed after its use on reboot then re-added by the malware after it resumes execution.

SplatDropper has deleted its malicious payload and removed its own created service to avoid leaving traces of its presence on victim devices.

PlugX has deleted registry keys that store data and maintained persistence.

S-Type has deleted accounts it has created.

RTM has the ability to remove Registry entries that it created for persistence.

Bazar's loader can delete scheduled tasks created by a previous instance of the malware.

Kapeka will clear registry values used for persistent configuration storage when uninstalled.

SUNBURST removed IFEO registry values to clean up traces of persistence.

IPsec Helper can delete various service traces related to persistent execution when commanded.

Pillowmint can uninstall the malicious service from an infected machine.

GrimAgent can delete previously created tasks on a compromised host.

njRAT is capable of manipulating and deleting registry keys, including those used for persistence.

KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.

MCMD has the ability to remove set Registry Keys, including those used for persistence.

BRICKSTORM has copied itself to the `usr/sbin/` folder.

Hildegard has used an IRC channel for C2 communications.

QUIETEXIT can use an inverse negotiated SSH connection as part of its C2.

Raspberry Robin is capable of contacting the TOR network for delivering second-stage payloads.

Siloscape connects to an IRC server for C2.

Nightdoor uses TCP and UDP communication for command and control traffic.

Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.

Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.

Clambling has the ability to use Telnet for communication.

Sliver can utilize the Wireguard VPN protocol for command and control.

Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.

TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.

BLINDINGCAN has used HTTPS over port 443 for command and control.

Ninja can use HTTP for C2 communications.

RCSession can use HTTP in C2 communications.

Spark has used HTTP POST requests to communicate with its C2 server to receive commands.

QuietSieve can use HTTPS in C2 communications.

BRICKSTORM has communicated to hardcoded C2 through WebSockets (WSS) to include domains associated with Cloudflare Workers. BRICKSTORM has also leveraged Gorilla mux library to serve its HTTP API calls.

Amadey has used HTTP for C2 communications.

NICECURL has used HTTPS for C2 communications.

Proxysvc uses HTTP over SSL to communicate commands with the control server.

Torisma can use HTTP and HTTPS for C2 communications.

NOKKI has used HTTP for C2 communications.

Stuxnet uses HTTP to communicate with a command and control server.

IronWind can used HTTP to send information to C2 about the targeted system.

Get2 has the ability to use HTTP to send information collected from an infected host to C2.

POWRUNER can use HTTP for C2 communications.

KOPILUWAK has used HTTP POST requests to send data to C2.

COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.

Smoke Loader uses HTTP for C2.

WindTail has the ability to use HTTP for C2 communications.

reGeorg can use HTTP to tunnel connections in and out of targeted networks.

Emissary uses HTTP or HTTPS for C2.