Procedure examples

Penquin can report the IP of the compromised host to attacker controlled infrastructure.

Penquin can remove strings from binaries.

Penquin has encrypted strings in the binary for obfuscation.

Penquin has mimicked the Cron binary to hide itself on compromised systems.

Penquin can sniff network traffic to look for packets matching specific conditions.

Penquin can execute the command code do_upload to send files to C2.

Penquin can use Cron to create periodic and pre-scheduled background jobs.

Penquin can execute remote commands using bash scripts.

Penquin can delete downloaded executables after running them.

Penquin can report the file system type of a compromised host to C2.

Penquin can use the command code do_vslist to send file names, size, and status to C2.

The Penquin C2 mechanism is based on TCP and UDP packets.

Penquin can execute the command code do_download to retrieve remote files from C2.

Penquin will connect to C2 only after sniffing a "magic packet" value in TCP or UDP packets matching specific conditions.

Penquin installs a `TCP` and `UDP` filter on the `eth0` interface.

Penquin can add the executable flag to a downloaded file.

Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.

Penquin can report the disk space of a compromised host to C2.