Procedure examples

KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.

KeyBoy can determine the public or WAN IP address for the system.

In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.

KeyBoy installs a keylogger for intercepting credentials and keystrokes.

KeyBoy uses PowerShell commands to download and execute payloads.

KeyBoy can launch interactive shells for communicating with the victim machine.

KeyBoy uses VBS scripts for installing files and performing execution.

KeyBoy uses Python scripts for installing files and performing execution.

KeyBoy time-stomped its DLL in order to evade detection.

KeyBoy can gather extended system information, such as information about the operating system and memory.

KeyBoy has a command to launch a file browser or explorer on the system.

KeyBoy has a download and upload functionality.

KeyBoy has a command to perform screen grabbing.

KeyBoy installs a service pointing to a malicious DLL dropped to disk.

KeyBoy issues the command reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon” to achieve persistence.

KeyBoy attempts to collect passwords from browsers.

KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.

KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload.