Procedure examples

BlackEnergy has the capability to communicate over a backup channel via plus.google.com.

BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.

BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares.

BlackEnergy has conducted port scans on a host.

A BlackEnergy 2 plug-in uses WMI to gather victim host details.

BlackEnergy has gathered information about local network connections using netstat.

BlackEnergy injects its DLL component into svchost.exe.

BlackEnergy has run a keylogger plug-in on a victim.

BlackEnergy has gathered a process list by using Tasklist.exe.

BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.

BlackEnergy communicates with its C2 server over HTTP.

BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.

BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.

BlackEnergy is capable of taking screenshots.

BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.

BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.

One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

BlackEnergy attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.

BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.

BlackEnergy has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.

BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.

One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.

The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.