MalwareBytes SideCopy Dec 2021

Action RAT can collect local data from an infected machine.

AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.

Action RAT has the ability to collect the MAC address of an infected host.

SideCopy has identified the IP address of a compromised host.

Action RAT's commands, strings, and domains can be Base64 encoded within the payload.

Action RAT has the ability to collect the username from an infected host.

AuTo Stealer has the ability to collect the username from an infected host.

SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.

AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.

Action RAT can use WMI to gather AV products installed on an infected host.

Action RAT can use `cmd.exe` to execute commands on an infected host.

AuTo Stealer can use `cmd.exe` to execute a created batch file.

SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.

AuTo Stealer can use HTTP to communicate with its C2 servers.

Action RAT can use HTTP to communicate with C2 servers.

AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration.

AuTo Stealer has the ability to collect the hostname and OS information from an infected host.

SideCopy has identified the OS version of a compromised host.

Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.

Action RAT has the ability to collect drive and file information on an infected machine.

AuTo Stealer can use TCP to communicate with command and control servers.

SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.

Action RAT has the ability to download additional payloads onto an infected machine.

SideCopy has executed malware by calling the API function `CreateProcessW`.

Action RAT can use Base64 to decode actor-controlled C2 server communications.

SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.

SideCopy has utilized `mshta.exe` to execute a malicious hta file.

SideCopy has collected browser information from a compromised host.

Action RAT can identify AV products on an infected host using the following command: `cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List`.

AuTo Stealer has the ability to collect information about installed AV products from an infected host.

SideCopy uses a loader DLL file to collect AV product names from an infected host.

AuTo Stealer can place malicious executables in a victim's AutoRun registry key or StartUp directory, depending on the AV product installed, to maintain persistence.

SideCopy has sent spearphishing emails with malicious hta file attachments.

SideCopy has used a malicious loader DLL file to execute the `credwiz.exe` process and side-load the malicious payload `Duser.dll`.

SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.

SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.

SideCopy has used compromised domains to host its malicious payloads.

SideCopy has identified the country location of a compromised host.