Procedure examples

Flagpro can collect data from a compromised host, including Windows authentication information.

Flagpro can check the name of the window displayed on the system.

Flagpro has been used to execute the ipconfig /all command on a victim system.

Flagpro has been used to execute net view on a targeted system.

Flagpro has been delivered within ZIP or RAR password-protected archived files.

Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.

Flagpro has been used to run the whoami command on the system.

Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.

Flagpro has exfiltrated data to the C2 server.

Flagpro has been used to execute netstat -ano on a compromised host.

Flagpro has been used to run the tasklist command on a compromised system.

Flagpro can use `cmd.exe` to execute commands received from C2.

Flagpro can execute malicious VBA macros embedded in .xlsm files.

Flagpro has been used to execute the net localgroup administrators command on a targeted system.

Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.

Flagpro can communicate with its C2 using HTTP.

Flagpro can download additional malware from the C2 server.

Flagpro can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`.

Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.

Flagpro has been used to execute `net view` to discover mapped network shares.

Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.

Flagpro has dropped an executable file to the startup directory.

Flagpro has been distributed via spearphishing as an email attachment.

Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.