Procedure examples

The Helminth config file is encrypted with RC4.

Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.

Helminth has used a scheduled task for persistence.

The executable version of Helminth has a module to log keystrokes.

Helminth has used Tasklist to get information on processes.

One version of Helminth uses a PowerShell script.

Helminth can provide a remote shell. One version of Helminth uses batch scripting.

One version of Helminth consists of VBScript scripts.

Helminth has checked the local administrators group.

Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.

Helminth can use HTTP for C2.

Helminth can use DNS for C2.

Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.

Helminth can download additional files.

The executable version of Helminth has a module to log clipboard contents.

A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.

For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.

Helminth establishes persistence by creating a shortcut in the Start Menu folder.

Helminth establishes persistence by creating a shortcut.

Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.

Helminth encrypts data sent to its C2 server over HTTP with RC4.