Procedure examples

Pteranodon can use a dynamic Windows hashing algorithm to map API components.

Pteranodon exfiltrates screenshot files to its C2 server.

Pteranodon schedules tasks to invoke its components in order to establish persistence.

Pteranodon can use `cmd.exe` for execution on victim systems.

Pteranodon can use a malicious VBS file for execution.

Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.

Pteranodon can use HTTP for C2.

Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\<Username>\AppData\Roaming\Microsoft\store to store screenshot JPEG files.

Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.

Pteranodon can download and execute additional files.

Pteranodon has used various API calls.

Pteranodon can capture screenshots at a configurable interval.

Pteranodon can decrypt encrypted data strings prior to using them.

Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.

Pteranodon executes functions using rundll32.exe.

Pteranodon has the ability to use anti-detection functions to identify sandbox environments.

Pteranodon copies itself to the Startup folder to establish persistence.