Procedure examples

When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

BADNEWS copies files with certain extensions from USB devices to
a predefined directory.

BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.

BADNEWS attempts to hide its payloads using legitimate filenames.

When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.

BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.

When it first starts, BADNEWS spawns a new thread to log keystrokes.

BADNEWS is capable of executing commands via cmd.exe.

BADNEWS establishes a backdoor over HTTP.

BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.

BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.

BADNEWS collects C2 information via a dead drop resolver.

BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.

BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.

BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.

BADNEWS has a command to take a screenshot and send it to the C2 server.

BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.

BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.

After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.

BADNEWS encodes C2 traffic with base64.

BADNEWS installs a registry Run key to establish persistence.

BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.

BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.