Procedure examples

Crimson can collect information from a compromised host.

Crimson can check the Registry for the presence of HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate to determine how long it has been installed on a host.

Crimson contains a command to collect the victim MAC address and LAN IP.

Crimson contains a module to collect data from removable drives.

Crimson can identify the user on a targeted system.

Crimson can exfiltrate stolen information over its C2.

Crimson can use a module to perform keylogging on compromised hosts.

Crimson contains a command to list processes.

Crimson has the ability to execute commands with the COMSPEC environment variable.

Crimson has the ability to delete files from a compromised host.

Crimson can use a HTTP GET request to download its final payload.

Crimson contains a command to collect the victim PC name and operating system.

Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.

Crimson can spread across systems by infecting removable media.

Crimson uses a custom TCP protocol for C2.

Crimson contains a command to retrieve files from its C2 server.

Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.

Crimson contains a command to perform screen captures.

Crimson contains a command to collect and exfiltrate emails from Outlook.

Crimson has the ability to discover pluggable/removable drives to extract files from.

Crimson can perform audio surveillance using microphones.

Crimson has the ability to determine the date and time on a compromised host.

Crimson can capture webcam video on targeted systems.

Crimson can decode its encoded PE file prior to execution.

Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.

Crimson contains a command to collect information about anti-virus software on the victim.

Crimson can add Registry run keys for persistence.

Crimson contains a module to steal credentials from Web browsers on the victim machine.

Crimson can identify the geographical location of a victim host.

Crimson contains a command to collect disk drive information.