Procedure examples

HotCroissant has the ability to retrieve a list of services on the infected host.

HotCroissant has the ability to list the names of all open windows on the infected host.

HotCroissant has the ability to identify the IP address of the compromised machine.

HotCroissant has used the open source UPX executable packer.

HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.

HotCroissant has the ability to collect the username on the infected host.

HotCroissant has the ability to download files from the infected host to the command and control (C2) server.

HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.

HotCroissant has the ability to list running processes on the infected host.

HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.

HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.

HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.

HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.

HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.

HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.

HotCroissant has the ability to do real time screen viewing on an infected host.

HotCroissant has the ability to stop services on the infected host.

HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.

HotCroissant has the ability to hide the window for operations performed on a given file.

HotCroissant has compressed network communications and encrypted them with a custom stream cipher.