Procedure examples

ShadowPad has collected the domain name of the victim system.

ShadowPad has encrypted its payload, a virtual file system, and various files.

ShadowPad maintains a configuration block and virtual file system in the Registry.

ShadowPad has sent data back to C2 every 8 hours.

ShadowPad has collected the username of the victim system.

ShadowPad has injected an install module into a newly created process.

ShadowPad has injected a DLL into svchost.exe.

ShadowPad has collected the PID of a malicious process.

ShadowPad has deleted arbitrary Registry values.

ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.

ShadowPad has used FTP for C2 communications.

ShadowPad has used DNS tunneling for C2 communications.

ShadowPad has discovered system information including memory status, CPU frequency, and OS versions.

ShadowPad has used UDP for C2 communications.

ShadowPad has downloaded code from a C2 server.

ShadowPad can modify the Registry to store and maintain a configuration block and virtual file system.

ShadowPad has collected the current date and time of the victim system.

ShadowPad has encoded data as readable Latin characters.

ShadowPad has decrypted a binary blob to start execution.

ShadowPad uses a DGA that is based on the day of the month for C2 servers.

ShadowPad has discovered system information including volume serial numbers.