Procedure examples

BLINDINGCAN has uploaded files from victim machines.

BLINDINGCAN has collected the victim machine's local IP address information and MAC address.

BLINDINGCAN has been packed with the UPX packer.

BLINDINGCAN has obfuscated code using Base64 encoding.

BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".

BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.

BLINDINGCAN has executed commands via cmd.exe.

BLINDINGCAN has deleted itself and associated artifacts from victim machines.

BLINDINGCAN has modified file and directory timestamps.

BLINDINGCAN has used HTTPS over port 443 for command and control.

BLINDINGCAN has collected from a victim machine the system name, processor information, and OS version.

BLINDINGCAN can search, read, write, move, and execute files.

BLINDINGCAN has downloaded files to a victim machine.

BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.

BLINDINGCAN has encoded its C2 traffic with Base64.

BLINDINGCAN has used AES and XOR to decrypt its DLLs.

BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.

BLINDINGCAN has used Rundll32 to load a malicious DLL.

BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.

BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.

BLINDINGCAN has encrypted its C2 traffic with RC4.

BLINDINGCAN has collected disk information, including type and free space available.