Procedure examples

Higaisa used a FakeTLS session for C2 communications.

Higaisa used ipconfig to gather network configuration information.

Higaisa performed padding with null bytes before calculating its hash.

Higaisa used Base64 encoded compressed payloads.

Higaisa used Base64 encoded compressed payloads.

Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.

Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.

Higaisa exfiltrated data over its C2 channel.

Higaisa dropped and added officeupdate.exe to scheduled tasks.

Higaisa’s shellcode attempted to find the process ID of the current process.

Higaisa used cmd.exe for execution.

Higaisa has used VBScript code on the victim's machine.

Higaisa used JavaScript to execute additional files.

Higaisa used HTTP and HTTPS to send data back to its C2 server.

Higaisa collected the system GUID and computer name.

Higaisa discovered system proxy settings and used them if available.

Higaisa has called various native OS APIs.

Higaisa used a function to gather the current time.

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.

Higaisa has exploited CVE-2018-0798 for execution.

Higaisa used malicious e-mail attachments to lure victims into executing LNK files.

Higaisa used an XSL file to run VBScript code.

Higaisa added a spoofed binary to the start-up folder for persistence.

Higaisa used a payload that creates a hidden window.

Higaisa has sent spearphishing emails containing malicious attachments.

Higaisa used AES-128 to encrypt C2 traffic.

Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.

Higaisa collected the system volume serial number.