Procedure examples

S-Type runs the command net start on a victim.

S-Type primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.

S-Type has used `ipconfig /all` on a compromised host.

Some S-Type samples have been packed with UPX.

S-Type has run tests to determine the privilege level of the compromised user.

S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

S-Type has uploaded data and files from a compromised host to its C2 servers.

S-Type has provided the ability to execute shell commands on a compromised host.

S-Type has deleted files it has created on a compromised host.

S-Type has deleted accounts it has created.

S-Type uses HTTP for C2.

The initial beacon packet for S-Type contains the operating system version and file system of the victim.

S-Type has run the command `net user` on a victim.

S-Type can download additional files onto a compromised host.

S-Type has used Windows APIs, including `GetKeyboardType`, `NetUserAdd`, and `NetUserDel`.

S-Type uses Base64 encoding for C2 traffic.

S-Type may create a temporary user on the system named `Lost_{Unique Identifier}` with the password `pond~!@6”{Unique Identifier}`.

S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.

S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious `msdtc.exe` file already created in the `%CommonFiles%` directory.

S-Type has attempted to determine if a compromised system was using a Japanese keyboard via the `GetKeyboardType` API call.