FireEye Periscope March 2018

HOMEFRY can perform credential dumping.

China Chopper's server component can upload local files.

Derusbi is capable of enumerating Registry keys and values.

MURKYTOP has the capability to identify remote hosts on connected networks.

Some strings in HOMEFRY are obfuscated with XOR x56.

MURKYTOP has the capability to scan for open ports on hosts in a connected network.

China Chopper's server component can spider authentication portals.

MURKYTOP has the capability to schedule remote AT jobs.

Derusbi is capable of logging keystrokes.

Derusbi collects current and parent process IDs.

Leviathan has used PowerShell for execution.

MURKYTOP uses the command-line interface.

HOMEFRY uses a command-line interface.

Derusbi is capable of creating a remote Bash shell and executing commands.

MURKYTOP has the capability to retrieve information about groups.

MURKYTOP has the capability to delete local files.

Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.

China Chopper's server component can change the timestamp of files.

China Chopper's server component executes code sent via HTTP POST commands.

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.

MURKYTOP has the capability to retrieve information about the OS.

Derusbi is capable of obtaining directory, file, and drive listings.

China Chopper's server component can list directory contents.

MURKYTOP has the capability to retrieve information about users on remote hosts.

BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.

BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.

Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.

China Chopper's server component can download remote files.

Leviathan has downloaded additional scripts and files from adversary-controlled servers.

China Chopper's server component can perform brute force password guessing against authentication portals.

Derusbi is capable of performing screen captures.

Derusbi is capable of performing audio captures.

Derusbi is capable of capturing video.

MURKYTOP has the capability to retrieve information about shares on remote hosts.

Leviathan has used BITSAdmin to download additional tools.

Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.

Leviathan has used WMI for persistence.

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

Leviathan has used stolen code signing certificates to sign malware.

Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.