Bitdefender FunnyDream Campaign November 2020

FunnyDream can send compressed and obfuscated packets to C2.

ccf32 can collect files from a compromised host.

PcShare can collect files and information from a compromised host.

FunnyDream can upload files from victims' machines.

FunnyDream has the ability to discover application windows via execution of `EnumWindows`.

FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.

PcShare can search the registry files of a compromised host.

FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.

During FunnyDream, the threat actors used ipconfig for discovery on remote systems.

PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\r\n`.

During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.

The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.

FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or
`xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.

PcShare has been encrypted with XOR using different 32-long Base16 strings.

Chinoxy has encrypted its configuration file.

PcShare has been compressed with LZW algorithm.

FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.

PcShare has used an invalid certificate in attempt to appear legitimate.

FunnyDream has used a service named `WSearch` for execution.

Chinoxy has used the name `eoffice.exe` in attempt to appear as a legitimate file.

PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.

PcShare can upload files and information from a compromised host to its C2 servers.

FunnyDream can execute commands, including gathering user information, and send the results to C2.

FunnyDream can use WMI to open a Windows command shell on a remote machine.

During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.

ccf32 can upload collected data and files to an FTP server.

During FunnyDream, the threat actors used netstat to discover network connections on remote systems.

ccf32 can run on a daily basis using a scheduled task.

The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.

The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component.

The FunnyDream Keyrecord component can capture keystrokes.

PcShare has the ability to capture keystrokes.

FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.

PcShare can obtain a list of running processes on a compromised host.

During FunnyDream, the threat actors used Tasklist on targeted systems.

PcShare can execute `cmd` commands on a compromised host.

ccf32 has used `cmd.exe` for archiving data and deleting files.

FunnyDream can use `cmd.exe` for execution on remote hosts.

During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.

During FunnyDream, the threat actors used a Visual Basic script to run remote commands.

FunnyDream has the ability to clean traces of malware deployment.

ccf32 can delete files and folders from compromised machines.

FunnyDream can delete files including its dropper component.

PcShare has deleted its files and components from a compromised host.

PcShare has used HTTP for C2 communication.

FunnyDream can stage collected information including screen captures and logged keystrokes locally.

ccf32 can temporarily store files in a hidden directory on the local host.

ccf32 has copied files to a remote machine infected with Chinoxy or another backdoor.

During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts.

FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.