CISA AR21-126A FIVEHANDS May 2021

SombRAT has collected data and files from a compromised host.

SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.

The FIVEHANDS payload is encrypted with AES-128.

SombRAT can execute getinfo to identify the username on a compromised host.

SombRAT can use a legitimate process name to hide itself.

FIVEHANDS can use WMI to delete files on a target machine.

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.

FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.

SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.

SombRAT has the ability to download and execute additional payloads.

SombRAT can execute getinfo to discover the current time on a compromised host.

SombRAT can run upload to decrypt and upload files from storage.

FIVEHANDS has the ability to decrypt its payload prior to execution.

FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.

FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.

SombRAT can SSL encrypt C2 traffic.