Procedure examples

Carbon enumerates values in the Registry.

Carbon can collect the IP address of the victims and other computers on the network using the commands: ipconfig -all nbtstat -n, and nbtstat -s.

Carbon uses the net view command.

Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.

Carbon uses HTTP to send data to the C2 server.

Carbon uses the netstat -r and netstat -an commands.

Carbon creates several tasks for later execution to continue persistence on the victim’s machine.

Carbon has a command to inject code into a process.

Carbon can list the processes on the victim’s machine.

Carbon uses the net group command.

Carbon can use HTTP in C2 communications.

Carbon creates a base directory that contains the files and folders that are collected.

Carbon uses TCP and UDP for C2.

Carbon can use Pastebin to receive C2 commands.

Carbon uses the command net time \\127.0.0.1 to get information the system’s time.

Carbon decrypts task and configuration files for execution.

Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.

Carbon has used RSA encryption for C2 communications.