ClearSky Siamesekitten August 2021

Milan can upload files from a compromised host.

Shark can upload files to its C2.

Shark can update its configuration to use a different C2 server.

Milan can run `C:\Windows\system32\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings.

DanBot can use VNC for remote access to targeted systems.

Shark can use encrypted and encoded files for C2 configuration.

Milan can encode files containing information about the targeted system.

Shark can pause C2 communications for a specified time.

Milan can identify users registered to a targeted machine.

Milan has used an executable named `companycatalogue` to appear benign.

Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.

DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools.

Milan has used an executable named `companycatalog.exe.config` to appear benign.

Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.

Milan can establish persistence on a targeted host with scheduled tasks.

DanBot has the ability to execute arbitrary commands via `cmd.exe`.

Shark has the ability to use `CMD` to execute commands.

Milan can use `cmd.exe` for discovery actions on a targeted system.

Milan can delete files via `C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`.

Shark can delete files downloaded to the compromised host.

DanBot can delete its configuration file after installation.

Shark has the ability to use HTTP in C2 communications.

Milan can use HTTPS for communication with C2.

Milan has the ability to use DNS for C2 communications.

Shark can use DNS in C2 communications.

Shark has stored information in folders named `U1` and `U2` prior to exfiltration.

Milan has saved files prior to upload from a compromised host to folders beginning with the characters `a9850d2f`.

Shark can collect the GUID of a targeted machine.

Milan can enumerate the targeted machine's name and GUID.

Milan has run `C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1` to discover local accounts.

Shark can download additional files from its C2 via HTTP or DNS.

Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.

Shark can extract and decrypt downloaded .zip files.

DanBot has relied on victims' opening a malicious file for initial execution.

HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.

Shark can stop execution if the screen width of the targeted machine is not over 600 pixels.

Milan can use a COM component to generate scheduled tasks.

Shark can send DNS C2 communications using a unique domain generation algorithm.

HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.

HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.

HEXANE has identified specific potential victims at targeted organizations.

HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.

HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.

HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.