Cylance Cleaver

Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.

Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.

Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.

TinyZBot contains keylogger functionality.

TinyZBot supports execution from the command-line.

Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.

TinyZBot contains screen capture functionality.

TinyZBot contains functionality to collect information from the clipboard.

TinyZBot can install as a Windows service for persistence.

TinyZBot can create a shortcut in the Windows startup folder for persistence.

TinyZBot can create a shortcut in the Windows startup folder for persistence.

Cleaver has used custom tools to facilitate ARP cache poisoning.

Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.

Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.

Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.

TinyZBot can disable Avira anti-virus.