BitDefender BADHATCH Mar 2021

BADHATCH can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer.

BADHATCH malicious PowerShell commands can be encoded with base64.

BADHATCH can be compressed with the ApLib algorithm.

BADHATCH can obtain logged user information from a compromised machine and can execute the command `whoami.exe`.

BADHATCH can exfiltrate data over the C2 channel.

BADHATCH can check for open ports on a computer by establishing a TCP connection.

BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.

BADHATCH can execute `netstat.exe -f` on a compromised machine.

BADHATCH can use `schtasks.exe` to gain persistence.

BADHATCH can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.

BADHATCH can inject itself into a new `svchost.exe -k netsvcs` process using the asynchronous procedure call (APC) queue.

BADHATCH can retrieve a list of running processes from a compromised machine.

BADHATCH can utilize `powershell.exe` to execute commands on a compromised host.

BADHATCH can use `cmd.exe` to execute commands on a compromised host.

BADHATCH can use `net.exe group "domain admins" /domain` to identify Domain Administrators.

BADHATCH can use HTTP and HTTPS over port 443 to communicate with actor-controlled C2 servers.

BADHATCH can emulate an FTP server to connect to actor-controlled C2 servers.

BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, OS type/version, bitness, and hostname.

BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.

BADHATCH can be utilized to abuse `sslip.io`, a free IP to domain mapping service, as part of actor-controlled C2 channels.

BADHATCH can take screenshots and send them to an actor-controlled C2 server.

BADHATCH can obtain the `DATETIME` and `UPTIME` from a compromised machine.

BADHATCH can impersonate a `lsass.exe` or `vmtoolsd.exe` token.

BADHATCH can check a user's access to the C$ share on a compromised machine.

BADHATCH can use `nltest.exe /domain_trusts` to discover domain trust relationships on a compromised machine.

BADHATCH can use WMI event subscriptions for persistence.

BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC.

BADHATCH can perform pass the hash on compromised machines with x64 versions.