SentinelLabs Metador Sept 2022

metaMain can collect files and system information from a compromised host.

Mafalda can collect files and information from a compromised host.

Mafalda can use the `GetAdaptersInfo` function to retrieve information about network adapters and the `GetIpNetTable` function to retrieve the IPv4 to physical network address mapping table.

Mafalda has been obfuscated and contains encrypted functions.

Metador has encrypted their payloads.

Mafalda can send network system data and files to its C2 server.

Mafalda can use the GetExtendedTcpTable function to retrieve information about established TCP connections.

metaMain can inject the loader file, Speech02.db, into a process.

metaMain has the ability to log keyboard events.

Mafalda can enumerate running processes on a machine.

metaMain can enumerate the processes that run on the platform.

Metador has used the Windows command line to execute commands.

metaMain has deleted collected items after uploading the content to its C2 server.

Metador has quickly deleted `cbd.exe` from a compromised host following the successful deployment of their malware.

metaMain can use HTTP for C2 communications.

Mafalda can use HTTP for C2.

Metador has used HTTP for C2.

Mafalda can place retrieved files into a destination directory.

metaMain has stored the collected system files in a working directory.

Mafalda can collect the computer name of a compromised host.

Mafalda can search for files and directories.

metaMain can recursively enumerate files in an operator-provided directory.

Metador has used TCP for C2.

metaMain can establish an indirect and raw TCP socket-based connection to the C2 server.

Mafalda can use raw TCP for C2.

Metador has downloaded tools and malware onto a compromised system.

metaMain can download files onto compromised systems.

metaMain can execute an operator-provided Windows command by leveraging functions such as `WinExec`, `WriteFile`, and `ReadFile`.

Mafalda can use a variety of API calls.

Mafalda can take a screenshot of the target machine and save it to a file.

metaMain can take and save screenshots.

metaMain can decrypt and load other modules.

Mafalda can decrypt files and data.

Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.

metaMain has authenticated itself to a different implant, Cryshell, through a port knocking and handshake procedure.

Mafalda can collect the contents of the `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState` file.

Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.

Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as `cdb.exe`.

metaMain registered a WMI event subscription consumer called "hard_disk_stat" to establish persistence.

Mafalda can collect a Chrome encryption key used to protect browser cookies.

metaMain has used XOR-based encryption for collected files before exfiltration.

Mafalda can encrypt its C2 traffic with RC4.

metaMain can encrypt the data that it sends and receives from the C2 server using an RC4 encryption algorithm.

Metador has used unique malware in their operations, including metaMain and Mafalda.

Metador has used Microsoft's Console Debugger in some of their operations.

metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.

Mafalda can enumerate all drives on a compromised host.

Mafalda can delete Windows Event logs by invoking the `OpenEventLogW` and `ClearEventLogW` functions.