Procedure examples

DustySky has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.

The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.

DustySky has exfiltrated data to the C2 server.

The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.

DustySky contains a keylogger.

DustySky collects information about running processes from victims.

DustySky can delete files it creates from the infected system.

DustySky has used both HTTP and HTTPS for C2.

DustySky created folders in temp directories to host collected files before exfiltration.

DustySky extracts basic information about the operating system.

DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.

DustySky searches for removable media and duplicates itself onto it.

DustySky captures PNG screenshots of the main screen.

DustySky can detect connected USB devices.

DustySky lists all installed software for the infected machine.

DustySky checks for the existence of anti-virus.

DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

DustySky can compress files via RAR while staging data to be exfiltrated.

DustySky searches for network drives and removable media and duplicates itself onto them.