Cisco Talos Bitter Bangladesh May 2022

ZxxZ can collect data from a compromised host.

ZxxZ can search the registry of a compromised host.

ZxxZ has been encoded to avoid detection from static analysis tools.

ZxxZ can collect the username from a compromised host.

BITTER has disguised malware as a Windows Security update service.

ZxxZ has been disguised as a Windows security update service.

BITTER has used scheduled tasks for persistence and execution.

ZxxZ has used scheduled tasks for persistence and execution.

ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.

BITTER has used HTTP POST requests for C2.

ZxxZ has collected the host name and operating system product name from a compromised machine.

BITTER has downloaded additional malware and tools onto a compromised host.

ZxxZ can download and execute additional files.

ZxxZ has used API functions such as `Process32First`, `Process32Next`, and `ShellExecuteA`.

ZxxZ has used a XOR key to decrypt strings.

BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.

ZxxZ has relied on victims to open a malicious attachment delivered via email.

BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.

ZxxZ can search a compromised host to determine if it is running Windows Defender or Kasperky antivirus.

BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.

ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.

BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.