Procedure examples

Metamorfo can enumerate all windows on the victim’s machine.

Metamorfo has used VMProtect to pack and protect files.

Metamorfo has encrypted payloads and strings.

Metamorfo has collected the username from the victim's machine.

Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.

Metamorfo can send the data it collects to the C2 server.

Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).

Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.

Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.

Metamorfo has performed process name checks and has monitored applications.

Metamorfo has used cmd.exe /c to execute files.

Metamorfo has used VBS code on victims’ systems.

Metamorfo includes payloads written in JavaScript.

Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.

Metamorfo has deleted itself from the system after execution.

Metamorfo has used HTTP for C2.

Metamorfo has collected the hostname and operating system version from the compromised host.

Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.

Metamorfo has used raw TCP for C2.

Metamorfo has used YouTube to store and hide C&C server domains.

Metamorfo has downloaded a zip file for execution on the system.

Metamorfo has used MSI files to download additional files to execute.

Metamorfo has used native WINAPI calls.

Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.

Metamorfo can collect screenshots of the victim’s machine.

Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.

Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.

Metamorfo uses JavaScript to get the system time.

Metamorfo had used AutoIt to load and execute the DLL payload.

Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.

Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.

Metamorfo has used mshta.exe to execute a HTA payload.

Metamorfo has used MsiExec.exe to automatically execute files.

Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.

Metamorfo has searched the compromised system for banking applications.

Metamorfo collects a list of installed antivirus software from the victim’s system.

Metamorfo has configured persistence to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.

Metamorfo has digitally signed executables using AVAST Software certificates.

Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.

Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.

Metamorfo has been delivered to victims via emails with malicious HTML attachments.

Metamorfo has communicated with hosts over raw TCP on port 9999.

Metamorfo has encrypted C2 commands with AES-256.

Metamorfo's C2 communication has been encrypted using OpenSSL.

Metamorfo has side-loaded its malicious DLL file.

Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.