Procedure examples

BackConfig has used compressed and decimal encoded VBS scripts.

BackConfig has hidden malicious payloads in %USERPROFILE%\Adobe\Driver\dwg\ and mimicked the legitimate DHCP service binary.

BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.

BackConfig can download and run batch files to execute commands on a compromised host.

BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.

BackConfig has the ability to remove files and folders related to previous infections.

BackConfig has the ability to use HTTPS for C2 communiations.

BackConfig has the ability to gather the victim's computer name.

BackConfig has the ability to identify folders and files related to previous infections.

BackConfig can download and execute additional payloads on a compromised host.

BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.

BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.

BackConfig has used a custom routine to decrypt strings.

BackConfig has compromised victims via links to URLs hosting malicious content.

BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.

BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.