McAfee Gold Dragon

Gold Dragon enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Brave Prince gathers information about the Registry.

Brave Prince gathers network configuration information as well as the ARP cache.

Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.

Some Brave Prince variants have used South Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.

RunningRAT captures keystrokes and sends them back to the C2 server.

Gold Dragon checks the running processes on the victim’s machine.

Brave Prince lists the running processes.

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.

Gold Dragon uses cmd.exe to execute commands for discovery.

RunningRAT contains code to delete files from the victim’s machine.

Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.

Gold Dragon uses HTTP for communication to the control servers.

Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.

RunningRAT gathers the OS version and processor information.

Brave Prince collects hard drive content and system configuration information.

Gold Dragon collects endpoint information using the systeminfo command.

Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.

Brave Prince gathers file and directory information from the victim’s machine.

Gold Dragon can download additional components from the C2 server.

RunningRAT contains code to open and copy data from the clipboard.

Gold Dragon checks for anti-malware products and processes.

Gold Dragon establishes persistence in the Startup folder.

RunningRAT adds itself to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to establish persistence upon reboot.

RunningRAT contains code to compress files.

Gold Dragon encrypts data using Base64 before being sent to the command and control server.

RunningRAT gathers logical drives information and volume information.

Gold Dragon terminates anti-malware processes if they’re found running on the system.

Brave Prince terminates antimalware processes.

RunningRAT kills antimalware running process.

RunningRAT contains code to clear event logs.