Procedure examples

PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.

PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.

PUNCHBUGGY has used PowerShell scripts.

PUNCHBUGGY has used python scripts.

PUNCHBUGGY can delete files written to disk.

PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.

PUNCHBUGGY has saved information to a random temp file before exfil.

PUNCHBUGGY can gather system information such as computer names.

PUNCHBUGGY can gather user names.

PUNCHBUGGY can download additional files and payloads to compromised hosts.

PUNCHBUGGY can load a DLL using the LoadLibrary API.

PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.

PUNCHBUGGY can load a DLL using Rundll32.

PUNCHBUGGY can gather AVs registered in the system.

PUNCHBUGGY can establish using a AppCertDLLs Registry key.

PUNCHBUGGY has been observed using a Registry Run key.

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.