Unit 42 Magic Hound Feb 2017

Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.

Magic Hound has used base64-encoded commands.

Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.

Magic Hound malware has obtained the victim username and sent it to the C2 server.

Magic Hound malware is capable of keylogging.

Magic Hound malware can list running processes.

Magic Hound has used PowerShell for execution and privilege escalation.

Magic Hound has used the command-line interface for code execution.

Magic Hound malware has used VBS scripts for execution.

Magic Hound has deleted and overwrote files to cover tracks.

Magic Hound malware has used IRC for C2.

Magic Hound has used HTTP for C2.

Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.

Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.

Magic Hound malware can use a SOAP Web service to communicate with its C2 server.

Magic Hound has downloaded additional code and files from servers onto victims.

Magic Hound malware can take a screenshot and upload the file to its C2 server.

Magic Hound malware has used Registry Run keys to establish persistence.

Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.

Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.