Procedure examples

Gelsemium can collect data from a compromised host.

Gelsemium can use multiple domains and protocols in C2.

Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.

Gelsemium can store its components in the Registry.

Gelsemium has the ability to compress its components.

Gelsemium can use junk code to hide functions and evade detection.

Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.

Gelsemium has used unverified signatures on malicious DLLs.

Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value Chrome Update to appear legitimate.

Gelsemium has the ability to inject DLLs into specific processes.

Gelsemium can enumerate running processes.

Gelsemium can use a batch script to delete itself.

Gelsemium can delete its dropper component from the targeted system.

Gelsemium has the ability to perform timestomping of files on targeted systems.

Gelsemium can use HTTP/S in C2 communications.

Gelsemium has the ability to use DNS in communication with C2.

Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.

Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.

Gelsemium has the ability to use TCP and UDP in C2 communications.

Gelsemium can download additional plug-ins to a compromised host.

Gelsemium has the ability to use various Windows API functions to perform tasks.

Gelsemium can modify the Registry to store its components.

Gelsemium can use token manipulation to bypass UAC on Windows7 systems.

Gelsemium can decompress and decrypt DLLs and shellcode.

Gelsemium can use junk code to generate random activity to obscure malware behavior.

Gelsemium can check for the presence of specific security products.

Gelsemium can drop itself in `C:\Windows\System32\spool\prtprocs\x64\winprint.dll` as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.

Gelsemium can set persistence with a Registry run key.

Gelsemium can drop itself in C:\Windows\System32\spool\prtprocs\x64\winprint.dll to be loaded automatically by the spoolsv Windows service.

Gelsemium can bypass UAC to elevate process privileges on a compromised host.

Gelsemium can use the `IARPUinstallerStringLauncher` COM interface are part of its UAC bypass process.

Gelsemium can use dynamic DNS domain names in C2.

Gelsemium can use custom shellcode to map embedded DLLs into memory.