Accenture SNAKEMACKEREL Nov 2018

Zebrocy's Delphi variant was packed with UPX.

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.

Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.

An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.

Zebrocy uses HTTP for C2.

Zebrocy collects the OS version and computer name. Zebrocy also runs the systeminfo command to gather system information.

Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the echo %APPDATA% command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.

Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.

APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.

A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.

Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.

APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.

Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.

Zebrocy collects the serial number for the storage volume C:\.