Procedure examples

Machete searches the File system for files of interest.

Machete has sent data over HTTP if FTP failed, and has also used a fallback server.

Machete saves the window names.

Machete collects the MAC address of the target computer and other network configuration information.

Machete uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.

Machete’s collected files are exfiltrated automatically to remote servers.

Machete can find, encrypt, and upload files from fixed and removable drives.

Machete has been packed with NSIS.

Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.

Machete sends stolen data to the C2 server every 10 minutes.

Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.

Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.

Machete's collected data is exfiltrated over the same channel used for C2.

Machete has a feature to copy files from every drive onto a removable drive in a hidden folder.

The different components of Machete are executed by Windows Task Scheduler.

Machete logs keystrokes from the victim’s machine.

Machete has a component to check for running processes to look for web browsers.

Machete is written in Python and is used in conjunction with additional Python scripts.

Once a file is uploaded, Machete will delete it from the machine.

Machete uses HTTP for Command & Control.

Machete uses FTP for Command & Control.

Machete stores files and logs in a folder on the local drive.

Machete collects the hostname of the target computer.

Machete produces file listings in order to search for files to be exfiltrated.

Machete can download additional files for execution on the victim’s machine.

Machete captures screenshots.

Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.

Machete detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.

Machete captures audio from the computer’s microphone.

Machete takes photos from the computer’s web camera.

Machete has used base64 encoding.

Machete’s downloaded data is decrypted using AES.

Machete retrieves the user profile data (e.g., browsers) from Chrome and Firefox browsers.

Machete used the startup folder for persistence.

Machete has scanned and looked for cryptographic keys and certificate file extensions.

Machete collects stored credentials from several web browsers.

Machete stores zipped files with profile data from installed web browsers.

Machete's collected data is encrypted with AES before exfiltration.

Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive.

Machete has used AES to exfiltrate documents.

Machete has used TLS-encrypted FTP to exfiltrate data.