Unit42 Redaman January 2019

RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.

RTM has been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.

RTM has been delivered as archived Windows executable files masquerading as PDF documents.

RTM has named the scheduled task it creates "Windows Update".

RTM tries to add a scheduled task to establish persistence.

RTM can record keystrokes from both the keyboard and virtual keyboard.

RTM can delete all files created during its execution.

RTM has initiated connections to external domains using HTTPS.

RTM can check for specific files and directories associated with virtualization and malware analysis.

RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.

RTM can download additional files.

RTM can capture screenshots.

RTM collects data from the clipboard.

RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.

RTM can obtain a list of smart card readers attached to the victim.

RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.

RTM runs its core DLL file using rundll32.exe.

RTM can detect if it is running within a sandbox or other virtualized analysis environment.

RTM can add a certificate to the Windows store.

RTM has been delivered via spearphishing attachments disguised as PDF documents.

RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.