Procedure examples

Astaroth collects the external IP address from the system.

Astaroth uses a software packer called Pe123\RPolyCryptor.

Astaroth has obfuscated and randomized parts of the JScript code it is initiating.

Astaroth has used an XOR-based algorithm to encrypt payloads twice with different keys.

Astaroth exfiltrates collected information from its r1.log file to the external C2 server.

Astaroth uses WMIC to execute payloads.

Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.

Astaroth logs keystrokes from the victim's machine.

Astaroth searches for different processes on the system.

Astaroth spawns a CMD process to execute commands.

Astaroth has used malicious VBS e-mail attachments for execution.

Astaroth uses JavaScript to perform its core functionalities.

Astaroth collects data in a plaintext file named r1.log before exfiltration.

Astaroth collects the machine name and keyboard language from the system.

Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.

Astaroth uses certutil and BITSAdmin to download additional malware.

Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries.

Astaroth collects the timestamp from the infected machine.

Astaroth uses the LoadLibraryExW() function to load additional modules.

Astaroth encodes data using Base64 before sending it to the C2 server.

Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.

Astaroth has used malicious files including VBS, LNK, and HTML for execution.

Astaroth uses ActiveX objects for file execution and manipulation.

Astaroth can be loaded through regsvr32.exe.

Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.

Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.

Astaroth checks for the presence of Avast antivirus in the C:\Program\Files\ folder.

Astaroth creates a startup item for persistence.

Astaroth's initial payload is a malicious .LNK file.

Astaroth uses an external software known as NetPass to recover passwords.

Astaroth uses an external software known as NetPass to recover passwords.

Astaroth loads its module with the XSL script parameter vShow set to zero, which opens the application with a hidden window.

Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.

Astaroth has been delivered via malicious e-mail attachments.

Astaroth has used a DGA in C2 communications.

Astaroth can launch itself via DLL Search Order Hijacking.