Procedure examples

FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.

FELIXROOT collects information about the network including the IP address and DHCP server.

FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.

FELIXROOT collects the username from the victim’s machine.

FELIXROOT uses WMI to query the Windows Registry.

FELIXROOT collects a list of running processes.

FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.

FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.

FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.

FELIXROOT collects the victim’s computer name, processor architecture, OS version, and system type.

FELIXROOT downloads and uploads files to and from the victim’s machine.

FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.

FELIXROOT gathers the time zone information from the victim’s machine.

FELIXROOT uses Rundll32 for executing the dropper program.

FELIXROOT checks for installed security software like antivirus and firewall.

FELIXROOT adds a shortcut file to the startup folder for persistence.

FELIXROOT creates a .LNK file for persistence.

FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.

FELIXROOT collects the victim’s volume serial number.