Procedure examples

RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.

RainyDay can create and register a service for execution.

RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working.

RainyDay has downloaded as a XOR-encrypted payload.

RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."

RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.

RainyDay can use scheduled tasks to achieve persistence.

RainyDay can enumerate processes on a target system.

RainyDay can use the Windows Command Shell for execution.

RainyDay has the ability to uninstall itself by deleting its service and files.

RainyDay can use HTTP in C2 communications.

RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.

RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.

RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.

RainyDay can use TCP in C2 communications.

RainyDay can download files to a compromised host.

The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.

RainyDay has the ability to capture screenshots.

RainyDay can decrypt its payload via a XOR key.

RainyDay can use services to establish persistence.

RainyDay can use tools to collect credentials from web browsers.

RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.

RainyDay can use a file exfiltration tool to upload specific files to Dropbox.

RainyDay can use RC4 to encrypt C2 communications.

RainyDay can use side-loading to run malicious executables.