FireEye FiveHands April 2021

SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.

The FIVEHANDS payload is encrypted with AES-128.

HELLOKITTY can use WMI to delete volume shadow copies.

FIVEHANDS can use WMI to delete files on a target machine.

DEATHRANSOM has the ability to use WMI to delete volume shadow copies.

HELLOKITTY can search for specific processes to terminate.

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.

FIVEHANDS can receive a command line argument to limit file encryption to specified directories.

DEATHRANSOM can use HTTPS to download files.

SombRAT can communicate over DNS with the C2 server.

DEATHRANSOM can use loop operations to enumerate directories on a compromised host.

SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.

SombRAT has the ability to download and execute additional payloads.

DEATHRANSOM can download files to a compromised host.

DEATHRANSOM has the ability to use loop operations to enumerate network resources.

HELLOKITTY has the ability to enumerate network resources.

FIVEHANDS has the ability to decrypt its payload prior to execution.

FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.

DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.

HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.

DEATHRANSOM can delete volume shadow copies on compromised hosts.

FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.

HELLOKITTY can delete volume shadow copies on compromised hosts.

SombRAT has the ability to modify its process memory to hide process command-line arguments.

SombRAT can SSL encrypt C2 traffic.

Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.

HELLOKITTY can enumerate logical drives on a target system.

DEATHRANSOM can enumerate logical drives on a target system.