Procedure examples

GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.

GreyEnergy enumerates all Windows services.

GreyEnergy is packed for obfuscation.

GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.

GreyEnergy has a module to inject a PE binary into a remote process.

GreyEnergy has a module to harvest pressed keystrokes.

GreyEnergy uses cmd.exe to execute itself in-memory.

GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.

GreyEnergy uses HTTP and HTTPS for C2 communications.

GreyEnergy has used Tor relays for Command and Control servers.

GreyEnergy can download additional modules and payloads.

GreyEnergy modifies conditions in the Registry and adds keys.

GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).

GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.

GreyEnergy digitally signs the malware with a code-signing certificate.

GreyEnergy encrypts communications using AES256.

GreyEnergy encrypts communications using RSA-2048.