Procedure examples

SysUpdate can collect information and files from a compromised host.

SysUpdate can collect a list of services on a victim machine.

SysUpdate can collected the IP address and domain name of a compromised host.

SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.

SysUpdate has been packed with VMProtect.

SysUpdate can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

SysUpdate can encrypt and encode its configuration file.

SysUpdate can collect the username from a compromised host.

SysUpdate has named their unit configuration file similarly to other unit files residing in the same directory, `/usr/lib/systemd/system/`, to appear benign.

SysUpdate has exfiltrated data over its C2 channel.

SysUpdate can use WMI for execution on a compromised host.

SysUpdate can collect information about running processes.

SysUpdate can delete its configuration file from the targeted system.

SysUpdate has used DNS TXT requests as for its C2 communication.

SysUpdate can collect a system's architecture, operating system version, and hostname.

SysUpdate can search files on a compromised host.

SysUpdate has the ability to download files to a compromised host.

SysUpdate can call the `GetNetworkParams` API as part of its C2 establishment process.

SysUpdate can write its configuration file to Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

SysUpdate has the ability to capture screenshots.

SysUpdate has used Base64 to encode its C2 traffic.

SysUpdate can deobfuscate packed binaries in memory.

SysUpdate can copy a script to the user owned `/usr/lib/systemd/system/` directory with a symlink mapped to a `root` owned directory, `/etc/ystem/system`, in the unit configuration file's `ExecStart` directive to establish persistence and elevate privileges.

SysUpdate can create a service to establish persistence.

SysUpdate can use a Registry Run key to establish persistence.

SysUpdate has been signed with stolen digital certificates.

SysUpdate has the ability to set file attributes to hidden.

SysUpdate can manage services and processes.

SysUpdate has used DES to encrypt all C2 communications.

SysUpdate can load DLLs through vulnerable legitimate executables.

SysUpdate can collect a system's drive information.