Procedure examples

RedLeaves can obtain information about network parameters.

A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.

RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.

RedLeaves can enumerate drives and Remote Desktop sessions.

RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.

RedLeaves can delete specified files.

RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.

RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.

RedLeaves can enumerate and search for files and directories.

RedLeaves is capable of downloading a file from a specified URL.

RedLeaves can capture screenshots.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.

RedLeaves can gather browser usernames and passwords.

RedLeaves can use HTTP over non-standard ports, such as 995, for C2.

RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.

RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.