group-ib_redcurl2

RedCurl used LaZagne to obtain passwords from memory.

RedCurl has collected data from the local disk of compromised hosts.

RedCurl has used batch scripts to exfiltrate data.

RedCurl has used malware with string encryption. RedCurl has also encrypted data and has encoded PowerShell commands using Base64. RedCurl has used `PyArmor` to obfuscate code execution of LaZagne. Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used `echo`, instead of file names themselves, to execute files.

RedCurl mimicked legitimate file names and scheduled tasks, e.g. ` MicrosoftCurrentupdatesCheck` and
`MdMMaintenenceTask` to mask malicious files and scheduled tasks.

RedCurl has collected data about network drives.

RedCurl has created scheduled tasks for persistence.

RedCurl prompts the user for credentials through a Microsoft Outlook pop-up.

RedCurl has used PowerShell to execute commands and to download malware.

RedCurl has used the Windows Command Prompt to execute commands.

RedCurl has used VBScript to run malicious files.

RedCurl has deleted files after execution.

RedCurl has used HTTP, HTTPS and Webdav protocls for C2 communications.

RedCurl has placed modified LNK files on network drives for lateral movement.

RedCurl has collected information about the target system, such as system information and list of network connections.

RedCurl has searched for and collected files on local and network drives.

RedCurl has collected information about local accounts.

RedCurl has collected information about domain accounts using SysInternal’s AdExplorer functionality .

RedCurl has collected information about email accounts.

RedCurl has used web services to download malicious files.

RedCurl has used batch scripts to collect data.

RedCurl has used malicious links to infect the victim machines.

RedCurl has used malicious files to infect the victim machines.

RedCurl has used rundll32.exe to execute malicious files.

RedCurl has used cloud storage to exfiltrate data, in particular the megatools utilities were used to exfiltrate data to Mega, a file storage service.

RedCurl has established persistence by creating entries in `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

RedCurl used LaZagne to obtain passwords in files.

RedCurl used LaZagne to obtain passwords in the Registry.

RedCurl used LaZagne to obtain passwords from web browsers.

RedCurl added the “hidden” file attribute to original files, manipulating victims to click on malicious LNK files.

RedCurl has used phishing emails with malicious links to gain initial access.

RedCurl has used AES-128 CBC to encrypt C2 communications.

RedCurl has used HTTPS for C2 communication.