Procedure examples

Taidoor can upload data and files from a victim's machine.

Taidoor can query the Registry on compromised hosts using RegQueryValueExA.

Taidoor has collected the MAC address of a compromised host; it can also use GetAdaptersInfo to identify network adapters.

Taidoor can use encrypted string blocks for obfuscation.

Taidoor can perform DLL loading.

Taidoor can use GetCurrentProcessId for process discovery.

Taidoor can copy cmd.exe into the system temp folder.

Taidoor can use DeleteFileA to remove files from infected hosts.

Taidoor has used HTTP GET and POST requests for C2.

Taidoor can search for specific files.

Taidoor can use TCP for C2 communications.

Taidoor has downloaded additional files onto a compromised host.

Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.

Taidoor has the ability to modify the Registry on compromised hosts using RegDeleteValueA and RegCreateKeyExA.

Taidoor can use GetLocalTime and GetSystemTime to collect system time.

Taidoor can use a stream cipher to decrypt stings used by the malware.

Taidoor has relied upon a victim to click on a malicious email attachment.

Taidoor has modified the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key for persistence.

Taidoor has been delivered through spearphishing emails.

Taidoor uses RC4 to encrypt the message body of HTTP content.