Procedure examples

QUADAGENT uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful.

QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.

QUADAGENT gathers the current domain the victim system belongs to.

QUADAGENT was likely obfuscated using `Invoke-Obfuscation`.

QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as `HKCU\Office365DCOMCheck`) in the `HKCU` hive.

QUADAGENT gathers the victim username.

QUADAGENT used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1.

QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.

QUADAGENT uses PowerShell scripts for execution.

QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.

QUADAGENT uses VBScripts.

QUADAGENT has a command to delete its Registry key and scheduled task.

QUADAGENT uses HTTPS and HTTP for C2 communications.

QUADAGENT uses DNS for C2 communications.

QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.

QUADAGENT encodes C2 communications with base64.

QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.