Procedure examples

Turian can insert pseudo-random characters into its network encryption setup.

Turian can retrieve the internal IP address of a compromised host.

Turian can use VMProtect for obfuscation.

Turian can retrieve usernames.

Turian can disguise as a legitimate service to blend into normal operations.

Turian can create a remote shell and execute commands using cmd.

Turian has the ability to use /bin/sh to execute commands.

Turian has the ability to use Python to spawn a Unix shell.

Turian has the ability to use HTTP for its C2.

Turian can store copied files in a specific directory prior to exfiltration.

Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.

Turian can search for specific files and list directories.

Turian can download additional files and tools from its C2.

Turian has the ability to take screenshots.

Turian can scan for removable media to collect data.

Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.

Turian can establish persistence by adding Registry Run keys.

Turian can use WinRAR to create a password-protected archive for files of interest.