MoustachedBouncer ESET August 2023

NightClub can use a file monitor to steal specific files from targeted systems.

SharpDisco has dropped a recent-files stealer plugin to `C:\Users\Public\WinSrcNT\It11.exe`.

NightClub can use `GetForegroundWindow` to enumerate the active window.

NightClub can obfuscate strings using the congruential generator `(LCG): staten+1 = (690069 × staten + 1) mod 232`.

MoustachedBouncer has used malware plugins packed with Themida.

NightClub has created a service named `WmdmPmSp` to spoof a Windows Media service.

NightClub has chosen file names to appear legitimate including EsetUpdate-0117583943.exe for its dropper.

SharpDisco can load a plugin to exfiltrate stolen files to SMB shares also used in C2.

NightClub can use SMTP and DNS for file exfiltration and C2.

Disco can create a scheduled task to run every minute for persistence.

SharpDisco can create scheduled tasks to execute reverse shells that read and write data to and from specified SMB shares.

NightClub can use a plugin for keylogging.

NightClub has the ability to use `GetWindowThreadProcessId` to identify the process behind a specified window.

MoustachedBouncer has used plugins to execute PowerShell scripts.

SharpDisco can use `cmd.exe` to execute plugins and to send command output to specified SMB shares.

MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.

MoustachedBouncer has exploited CVE-2021-1732 to execute malware components with elevated rights.

NightClub can modify the Creation, Access, and Write timestamps for malicious DLLs to match those of the genuine Windows DLL user32.dll.

Disco can use SMB to transfer files.

SharpDisco has the ability to transfer data between SMB shares.

NightClub can use emails for C2 communications.

NightClub can use a DNS tunneling plugin to exfiltrate data by adding it to the subdomain portion of a DNS request.

NightClub has copied captured files and keystrokes to the `%TEMP%` directory of compromised hosts.

MoustachedBouncer has used plugins to save captured screenshots to `.\AActdata\` on an SMB share.

NightClub can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.

SharpDisco can identify recently opened files by using an LNK format parser to extract the original file path from LNK files found in either `%USERPROFILE%\Recent` (Windows XP) or `%APPDATA%\Microsoft\Windows\Recent` (newer Windows versions) .

MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.

SharpDisco has been used to download a Python interpreter to `C:\Users\Public\WinTN\WinTN.exe` as well as other plugins from external sources.

Disco can download files to targeted systems via SMB.

NightClub can load multiple additional plugins on an infected host.

NightClub can use multiple native APIs including `GetKeyState`, `GetForegroundWindow`, `GetWindowThreadProcessId`, and `GetKeyboardLayout`.

SharpDisco can leverage Native APIs through plugins including `GetLogicalDrives`.

NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.

MoustachedBouncer has used plugins to take screenshots on targeted systems.

NightClub can load a module to call `CreateCompatibleDC` and `GdipSaveImageToStream` for screen capture.

SharpDisco has dropped a plugin to monitor external drives to `C:\Users\Public\It3.exe`.

NightClub has the ability to monitor removable drives.

NightClub can load a module to leverage the LAME encoder and `mciSendStringW` to control and capture audio.

NightClub has used a non-standard encoding in DNS tunneling removing any `=` from the result of base64 encoding, and replacing `/` characters with `-s` and `+` characters with `-p`.

Disco has been executed through inducing user interaction with malicious .zip and .msi files.

NightClub has created a Windows service named `WmdmPmSp` to establish persistence.

SharpDisco can hide windows using `ProcessWindowStyle.Hidden`.

MoustachedBouncer has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.

Disco has achieved initial access and execution through content injection into DNS, HTTP, and SMB replies to targeted hosts that redirect them to download malicious files.

SharpDisco can use a plugin to enumerate system drives.