Procedure examples

Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.

Egregor has used tools to gather information about users.

Egregor has masqueraded the svchost.exe process to exfiltrate data.

Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.

Egregor can enumerate all connected drives.

Egregor can inject its payload into iexplore.exe process.

Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.

Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.

Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.

Egregor has communicated with its C2 servers via HTTPS protocol.

Egregor can perform a language check of the infected system and can query the CPU information (cupid).

Egregor has the ability to download files from its C2 server.

Egregor has used the Windows API to make detection more difficult.

Egregor contains functionality to query the local/system time.

Egregor has been decrypted before execution.

Egregor has used BITSadmin to download and execute malicious DLLs.

Egregor has used regsvr32.exe to execute malicious DLLs.

Egregor has used rundll32 during execution.

Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.

Egregor can modify the GPO to evade detection.

Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.

Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.

Egregor can perform a long sleep (greater than or equal to 3 minutes) to evade detection.

Egregor has used DLL side-loading to execute its payload.

Egregor has disabled Windows Defender to evade protections.