Procedure examples

Contagious Interview has obfuscated JavaScript code using Base64 and variable substitutions.

Contagious Interview has used hexadecimal string encoding to hide critical JavaScript module names, function names, and C2 URLs, which are decoded dynamically at runtime.

Contagious Interview has delivered BeaverTail malware masquerading as legitimate software or applications. Contagious Interview has also delivered malicious payloads masquerading as legitimate software drivers.

Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.

Contagious Interview has exfiltrated victim information using FTP.

Contagious Interview has utilized VBS scripts to open cmd.exe and run commands to include the go_batch.bat batch file.

Contagious Interview has targeted macOS victim hosts using a bash downloader coremedia.sh and a bash script cloud.sh.

Contagious Interview has utilized Visual Basic scripts in the execution of their downloader malware targeting Windows devices including as script called update.vbs.

Contagious Interview has used the Python-based malware such as InvisibleFerret to install and execute Python Packages and Python modules.

Contagious Interview has leveraged JavaScript in the execution of their downloader malware targeting Windows devices using a NodeJS script titled nvidia.js.

Contagious Interview has configured malware to remove archives used in collection activities following successful exfiltration.

Contagious Interview has utilized email notifications from malware distribution servers to track victim engagement.

Contagious Interview has configured malicious webpages to identify the victim’s operating system by reviewing the details of the victims User-Agent of their browser.

Contagious Interview has conducted key word searches within files and directories on a compromised hosts to identify files for exfiltration.

Contagious Interview has leveraged Astrill VPN for C2.

Contagious Interview has lured victims to click on a malicious link that led to download of a malicious payload. Contagious Interview has also leveraged links to malicious payloads on social media and code repositories.

Contagious Interview has distributed malicious files requiring direct victim interaction to execute through the guise of a code test.

Contagious Interview has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.

Contagious Interview has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.

Contagious Interview has downloaded remote management and monitoring software such as “AnyDesk” for post compromise activities.

Contagious Interview has configured C2 endpoints to review IP geolocation, request headers, victim environment details and runtime conditions prior to delivering payloads.

Contagious Interview has requested victims to disable Docker and other container environments in attempts to thwart container isolation and ensure device infection.

Contagious Interview has established persistence using InvisibleFerret malware to create file to run the script on Startup via LaunchAgents. Contagious Interview has also utilized a plist file located in `/Library/LaunchAgents` to enable a malicious bash script the ability to persist.

Contagious Interview has targeted macOS victim hosts using a bash downloader `coremedia.sh` and a bash script `cloud.sh`.

Contagious Interview has established persistence using InvisibleFerret malware to place a .bat file in the Startup Folder.

Contagious Interview has established persistence using InvisibleFerret malware to create a .desktop entry to run on startup on GNOME-based Linux devices.

Contagious Interview has leveraged malware variants configured to dump credentials from the macOS keychain.

Contagious Interview has used fake job advertisements and messages sent via social media to spearphish targets. Contagious Interview has also leveraged hiring websites to solicit victims.

Contagious Interview has leveraged Telegram API to exfiltrate stolen data.

Contagious Interview has exfiltrated stolen passwords to Dropbox.

Contagious Interview has used TCP port 1224 for C2.

Contagious Interview has encrypted C2 traffic using RC4.

Contagious Interview has used services such as Astrill VPN.

Contagious Interview has registered domains to leverage in their social engineering campaigns. Contagious Interview has also registered domains to utilize for C2.

Contagious Interview has acquired virtual private servers from services such as Stark Industries Solutions and RouterHosting. Contagious Interview has also utilized hosting providers to include Tier[.]Net, Majestic Hosting, Leaseweb Singapore, and Kaopu Cloud.

Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files. Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages. Contagious Interview has also used Slack to coordinate their activities.

Contagious Interview has created and maintained personas on code repositories to distribute malicious payloads.

Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.

Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services. Contagious Interview has also utilized fake email accounts with Threat Intelligence vendor services.

Contagious Interview developed malicious NPM packages for delivery to or retrieval by victims.

Contagious Interview has developed malware that utilizes Qt cross-platform framework to include BeaverTail.

Contagious Interview has used remote management and monitoring software such as “AnyDesk”.

Contagious Interview has appeared to have used AI to generate images and content to facilitate their campaigns.

Contagious Interview has researched specific professional groups such as software developers for targeting. Contagious Interview has also researched individuals who work in roles related to cryptocurrency and blockchain technologies.

Contagious Interview has utilized open-source indicator of compromise repositories to determine their exposure to include VirusTotal, and MalTrail.

Contagious Interview had identified and solicited victims through social media such as LinkedIn, X, and Telegram.

Contagious Interview had identified and solicited victims through code repositories such as GitHub.

Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.

Contagious Interview has stolen cryptocurrency wallet credentials and credit card information utilizing BeaverTail and InvisibleFerret malware.

Contagious Interview has registered accounts with Threat Intelligence vendor services to check for reporting associated with their infrastructure and to evaluate new potential infrastructure.