Procedure examples

SDBbot has the ability to access the file system on a compromised host.

SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.

SDBbot has the ability to use RDP to connect to victim's machines.

SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.

SDBbot has used a packed installer file.

SDBbot has the ability to identify the user on a compromised host.

SDBbot has sent collected data from a compromised host to its C2 servers.

SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.

SDBbot can enumerate a list of running processes on a compromised machine.

SDBbot has the ability to use the command shell to execute commands on a compromised host.

SDBbot has the ability to clean up and remove data structures from a compromised host.

SDBbot has the ability to delete files from a compromised host.

SDBbot has the ability to identify the OS version, OS bit information and computer name.

SDBbot has the ability to get directory listings or drive information on a compromised host.

SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.

SDBbot has the ability to communicate with C2 with TCP over port 443.

SDBbot has the ability to download a DLL from C2 to a compromised host.

SDBbot has the ability to record video on a compromised host.

SDBbot has the ability to decrypt and decompress its payload to enable code execution.

SDBbot has used rundll32.exe to execute DLLs.

SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.

SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.

SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.

SDBbot can collected the country code of a compromised machine.