Procedure examples

Diavol can enumerate victims' local and external IPs when registering with C2.

Diavol can use the ARP table to find remote hosts to scan.

Diavol can spread throughout a network via SMB prior to encryption.

Diavol has Base64 encoded the RSA public key used for encrypting files.

Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.

Diavol can collect the username from a compromised host.

Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.

Diavol has used HTTP GET and POST requests for C2.

Diavol can collect the computer name and OS version from the system.

Diavol has a command to traverse the files and directories in a given path.

Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.

Diavol has used several API calls like `GetLogicalDriveStrings`, `SleepEx`, `SystemParametersInfoAPI`, `CryptEncrypt`, and others to execute parts of its attack.

Diavol has a `ENMDSKS` command to enumerates available network shares.

Diavol can delete specified files from a targeted system.

Diavol has encrypted files using an RSA key though the `CryptEncrypt` API and has appended filenames with ".lock64".

Diavol will terminate services using the Service Control Manager (SCM) API.

Diavol can delete shadow copies using the `IVssBackupComponents` COM object to call the `DeleteSnapshots` method.

After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text “All your files are encrypted! For more information see “README-FOR-DECRYPT.txt".

Diavol can attempt to stop security software.