Procedure examples

Zebrocy executes the reg query command to obtain information in the Registry.

Zebrocy runs the ipconfig /all command.

Zebrocy's Delphi variant was packed with UPX.

Zebrocy gets the username from the system.

Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.

Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.

One variant of Zebrocy uses WMI queries to gather information.

Zebrocy uses netstat -aon to gather network connection information.

Zebrocy has a command to create a scheduled task for persistence.

Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.

Zebrocy uses cmd.exe to execute commands on the system.

Zebrocy has a command to delete files and directories.

Zebrocy uses HTTP for C2.

Zebrocy uses SMTP and POP3 for C2.

Zebrocy stores all collected information in a single file before exfiltration.

Zebrocy collects the OS version and computer name. Zebrocy also runs the systeminfo command to gather system information.

Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the echo %APPDATA% command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.

Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.

A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.

Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.

Zebrocy enumerates information about connected storage devices.

Zebrocy gathers the current time zone and date information from the system.

Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.

Zebrocy identifies network drives when they are added to victim systems.

Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.

Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.

Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.

Zebrocy has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.

Zebrocy uses SSL and AES ECB for encrypting C2 communications.

Zebrocy collects the serial number for the storage volume C:\.