Procedure examples

KGH_SPY can send a file containing victim system information to C2.

KGH_SPY has used encrypted strings in its installer.

KGH_SPY has masqueraded as a legitimate Windows tool.

KGH_SPY has the ability to set the HKCU\Environment\UserInitMprLogonScript Registry key to execute logon scripts.

KGH_SPY can exfiltrate collected information from the host to the C2 server.

KGH_SPY can perform keylogging by polling the GetAsyncKeyState() function.

KGH_SPY can execute PowerShell commands on the victim's machine.

KGH_SPY has the ability to set a Registry key to run a cmd.exe command.

KGH_SPY can send data to C2 with HTTP POST requests.

KGH_SPY can save collected system information to a file named "info" before exfiltration.

KGH_SPY can enumerate files and directories on a compromised host.

KGH_SPY has the ability to download and execute code from remote servers.

KGH_SPY can harvest data from mail clients.

KGH_SPY can decrypt encrypted strings and write them to a newly created folder.

KGH_SPY has been spread through Word documents containing malicious macros.

KGH_SPY can collect information on installed applications.

KGH_SPY can collect credentials from WINSCP.

KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.

KGH_SPY can collect credentials from the Windows Credential Manager.

KGH_SPY can collect drive information from a compromised host.