Procedure examples

FatDuke can copy files and directories from a compromised host.

FatDuke has used several C2 servers per targeted organization.

FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.

FatDuke can identify the MAC address on the target computer.

FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.

FatDuke has been regularly repacked by its operators to create large binaries and evade detection.

FatDuke has been packed with junk code and strings.

FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.

FatDuke can list running processes on the localhost.

FatDuke has the ability to execute PowerShell scripts.

FatDuke can secure delete its DLL.

FatDuke can be controlled via a custom C2 protocol over HTTP.

FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.

FatDuke can enumerate directories on target machines.

FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.

FatDuke can call ShellExecuteW to open the default browser on the URL localhost.

FatDuke can decrypt AES encrypted C2 communications.

FatDuke can execute via rundll32.

FatDuke can turn itself on or off at random intervals.

FatDuke has used HKLM\SOFTWARE\Microsoft\CurrentVersion\Run to establish persistence.

FatDuke can AES encrypt C2 communications.