Procedure examples

Flagpro can use `cmd.exe` to execute commands received from C2.

Hi-Zor has the ability to create a reverse shell.

China Chopper's server component is capable of opening a command terminal.

CALENDAR has a command to run cmd.exe to execute commands.

GoldMax can spawn a command shell, and execute native commands.

KeyBoy can launch interactive shells for communicating with the victim machine.

Anchor has used cmd.exe to run its self deletion routine.

Pteranodon can use `cmd.exe` for execution on victim systems.

DarkTortilla can use `cmd.exe` to add registry keys for persistence.

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.

Babuk has the ability to use the command line to control execution on compromised hosts.

DarkWatchman can use `cmd.exe` to execute commands.

BlackMould can run cmd.exe with parameters.

PlugX allows actors to spawn a reverse shell on a victim.

Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.

MultiLayer Wiper uses a batch script launched via a scheduled task to delete Windows Event Logs.

S-Type has provided the ability to execute shell commands on a compromised host.

SeaDuke is capable of executing commands.

LightNeuron is capable of executing commands via cmd.exe.

Peppy has the ability to execute shell commands.

Cuba has used cmd.exe /c and batch files for execution.

Clambling can use cmd.exe for command execution.

Akira executes from the Windows command line and can take various arguments for execution.

DarkGate uses a malicious Windows Batch script to run the Windows code utility to retrieve follow-on script payloads. DarkGate has also used `cmd.exe` to create a remote shell.

Carbanak has a command to create a reverse shell.

XTunnel has been used to execute remote commands.

HOMEFRY uses a command-line interface.

Caterpillar WebShell can run commands on the compromised asset with CMD functions.

Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.

USBferry can execute various Windows commands.

TSCookie has the ability to execute shell commands on the infected host.

The Latrodectus command handler can use `cmdexe` to run multiple discovery commands.

Saint Bot has used `cmd.exe` and `.bat` scripts for execution.

Chaes has used cmd to execute tasks on the system.

The C# implementation of the CharmPower command execution module can use cmd.

MuddyViper has used cmd.exe to launch a reverse shell.

TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell.

KOMPROGO is capable of creating a reverse shell.

QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.

TAINTEDSCRIBE can enable Windows CLI access and execute files.

Uroburos has the ability to use the command line for execution on the targeted system.

Metamorfo has used cmd.exe /c to execute files.

Embargo has utilized a BAT script to disable security solutions.

Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.

Bandook is capable of spawning a Windows command shell.

MagicRAT allows for the execution of arbitrary commands on the victim system.

KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.

DnsSystem can use `cmd.exe` for execution.

MoleNet can execute commands via the command line utility.

JHUHUGIT uses a .bat file to execute a .dll.