Procedure examples

Misdat has collected files and data from a compromised host.

Misdat was typically packed using UPX.

Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Misdat has uploaded files and data to its C2 servers.

Misdat is capable of providing shell functionality to the attacker to execute commands.

Misdat is capable of deleting the backdoor file.

Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.

Misdat is capable of deleting Registry keys used for persistence.

The initial beacon packet for Misdat contains the operating system version of the victim.

Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.

Misdat network traffic communicates over a raw socket.

Misdat is capable of downloading files from the C2.

Misdat has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.

Misdat network traffic is Base64-encoded plaintext.

Misdat has created registry keys for persistence, including `HKCU\Software\dnimtsoleht\StubPath`, `HKCU\Software\snimtsOleht\StubPath`, `HKCU\Software\Backtsaleht\StubPath`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`.

Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`.