Procedure examples

Dyre has the ability to identify running services on a compromised host.

Dyre has the ability to identify network settings on a compromised host.

Dyre has been delivered with encrypted resources and must be unpacked for execution.

Dyre has the ability to identify the users on a compromised host.

Dyre has the ability to send information staged on a compromised host externally to C2.

Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.

Dyre has the ability to directly inject its code into the web browser process.

Dyre injects into other processes to load modules.

Dyre uses HTTPS for C2 communications.

Dyre has the ability to create files in a TEMP folder to act as a database to store information.

Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.

Dyre has a command to download and executes additional files.

Dyre decrypts resources needed for targeting the victim.

Dyre can detect sandbox analysis environments by inspecting the process list and Registry.

Dyre has the ability to identify installed programs on a compromised host.

Dyre registers itself as a service by adding several Registry keys.