Procedure examples

Epic uses the tasklist /svc command to list the services on the system.

Epic uses the rem reg query command to obtain values from Registry keys.

Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.

Epic uses the net view command on the victim’s machine.

Epic heavily obfuscates its code to make analysis more difficult.

Epic collects the user name from the victim’s machine.

Epic uses the net use, net session, and netstat commands to gather information on network connections.

Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.

Epic uses the tasklist /v command to obtain a list of processes.

Epic gathers information on local group names.

Epic has a command to delete a file from the machine.

Epic uses HTTP and HTTPS for C2 communications.

Epic collects the OS version, hardware information, computer name, available system memory status, and system and user language settings.

Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.

Epic gathers a list of all user accounts, privilege classes, and time of last logon.

Epic uses the net time command to get the system time from the machine and collect the current date and time zone information.

Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.

Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.

Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.

Epic compresses the collected data with bzip2 before sending it to the C2 server.

Epic encrypts commands from the C2 server using a hardcoded key.

Epic collects disk space information.