Procedure examples

CharmPower can collect data and files from a compromised host.

CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.

CharmPower has the ability to enumerate `Uninstall` registry values.

CharmPower has the ability to use ipconfig to enumerate system network settings.

CharmPower can use `netsh wlan show profiles` to list specific Wi-Fi profile details.

CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.

CharmPower can use `wmic` to gather information from a system.

CharmPower can send victim data via FTP with credentials hardcoded in the script.

CharmPower has the ability to list running processes through the use of `tasklist`.

CharmPower can use PowerShell for payload execution and C2 communication.

The C# implementation of the CharmPower command execution module can use cmd.

CharmPower can delete created files from a compromised system.

CharmPower can use HTTP to communicate with C2.

CharmPower can enumerate the OS version and computer name on a targeted system.

CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.

CharmPower can download additional modules from actor-controlled Amazon S3 buckets.

CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.

CharmPower has the ability to download additional modules to a compromised host.

CharmPower can remove persistence-related artifacts from the Registry.

CharmPower has the ability to capture screenshots.

CharmPower can send additional modules over C2 encoded with base64.

CharmPower can decrypt downloaded modules prior to execution.

CharmPower can list the installed applications on a compromised host.

CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.