Procedure examples

Agrius used tools such as Mimikatz to dump LSASS memory to capture credentials in victim environments.

Agrius dumped the SAM file on victim machines to capture credentials.

Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.

Agrius used the tool NBTscan to scan for remote, accessible hosts in victim environments.

Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts. Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.

Agrius used the Plink tool for tunneling and connections to remote machines, renaming it systems.exe in some instances.

Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.

Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.

Agrius uses ASPXSpy web shells to enable follow-on command execution via cmd.exe.

Agrius has used the folder, C:\\windows\\temp\\s\\, to stage data for exfiltration.

Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.

Agrius engaged in various brute forcing activities via SMB in victim environments.

Agrius engaged in password spraying via SMB in victim environments.

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.

Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.

Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity.

Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.

Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.

Agrius used 7zip to archive extracted data in preparation for exfiltration.

Agrius downloaded some payloads for follow-on execution from legitimate filesharing services such as ufile.io and easyupload.io.

Agrius typically uses commercial VPN services for anonymizing last-hop traffic to victim networks, such as ProtonVPN.

Agrius used several mechanisms to try to disable security tools. Agrius attempted to modify EDR-related services to disable auto-start on system reboot. Agrius used a publicly available driver, GMER64.sys typically used for anti-rootkit functionality, to selectively stop and remove security software processes.