Procedure examples

Clambling can collect information from a compromised host.

Clambling has the ability to enumerate Registry keys, including KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir to search for a bitcoin wallet.

Clambling can enumerate the IP address of a compromised machine.

The Clambling executable has been obfuscated when dropped on a compromised host.

Clambling can identify the username on a compromised host.

Clambling can inject into the `svchost.exe` process for execution.

Clambling can execute binaries through process hollowing.

Clambling can capture keystrokes on a compromised host.

Clambling can enumerate processes on a targeted system.

The Clambling dropper can use PowerShell to download the malware.

Clambling can use cmd.exe for command execution.

Clambling has the ability to use Telnet for communication.

Clambling has the ability to communicate over HTTP.

Clambling can discover the hostname, computer name, and Windows version of a targeted machine.

Clambling can browse directories on a compromised host.

Clambling has the ability to use TCP and UDP for communication.

Clambling can use Dropbox to download malicious payloads, send commands, and receive information.

Clambling can set and delete Registry keys.

Clambling has the ability to capture screenshots.

Clambling has the ability to capture and store clipboard data.

Clambling can determine the current time.

Clambling can record screen content in AVI format.

Clambling has the ability to enumerate network shares.

Clambling can deobfuscate its payload prior to execution.

Clambling has gained execution through luring victims into opening malicious files.

Clambling can wait 30 minutes before initiating contact with C2.

Clambling can register itself as a system service to gain persistence.

Clambling can establish persistence by adding a Registry run key.

Clambling has the ability to bypass UAC using a `passuac.dll` file.

Clambling has the ability to set its file attributes to hidden.

Clambling has been delivered to victim's machines through malicious e-mail attachments.

Clambling can send files from a victim's machine to Dropbox.

Clambling can create and start services on a compromised host.

Clambling can store a file named `mpsvc.dll`, which opens a malicious `mpsvc.mui` file, in the same folder as the legitimate Microsoft executable `MsMpEng.exe` to gain execution.