Procedure examples

Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.

Bankshot collects files from the local system.

Bankshot searches for certain Registry keys to be configured before executing the payload.

Bankshot exfiltrates data over its C2 channel.

Bankshot identifies processes and collects the process ids.

Bankshot uses the command-line interface to execute arbitrary commands.

Bankshot deletes all artifacts associated with the malware from the infected machine.

Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.

Bankshot modifies the time of a file as specified by the control server.

Bankshot uses HTTP for command and control communication.

Bankshot gathers system information, network addresses, and the operation system version.

Bankshot searches for files on the victim's machine.

Bankshot gathers domain and account names/information through process monitoring.

Bankshot gathers domain and account names/information through process monitoring.

Bankshot uploads files and secondary payloads to the victim's machine.

Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().

Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.

Bankshot recursively generates a list of files within a directory and sends them back to the control server.

Bankshot encodes commands from the control server using a range of characters and gzip.

Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.

Bankshot decodes embedded XOR strings.

Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.

Bankshot can terminate a specific process by its process id.

Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.

Bankshot gathers disk type and disk free space.