Procedure examples

FunnyDream can send compressed and obfuscated packets to C2.

FunnyDream can upload files from victims' machines.

FunnyDream has the ability to discover application windows via execution of `EnumWindows`.

FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.

FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.

FunnyDream can collect information about hosts on the victim network.

The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.

FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or
`xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.

FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.

FunnyDream has used a service named `WSearch` for execution.

FunnyDream can execute commands, including gathering user information, and send the results to C2.

FunnyDream can use WMI to open a Windows command shell on a remote machine.

The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component.

The FunnyDream Keyrecord component can capture keystrokes.

FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.

FunnyDream can use `cmd.exe` for execution on remote hosts.

FunnyDream has the ability to clean traces of malware deployment.

FunnyDream can delete files including its dropper component.

FunnyDream can stage collected information including screen captures and logged keystrokes locally.

FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.

FunnyDream can identify and use configured proxies in a compromised network for C2 communication.

FunnyDream can communicate with C2 over TCP and UDP.

FunnyDream can download additional files onto a compromised host.

FunnyDream can use Native API for defense evasion, discovery, and collection.

The FunnyDream ScreenCap component can take screenshots on a compromised host.

FunnyDream can monitor files for changes and automatically collect them.

The FunnyDream FilepakMonitor component can detect removable drive insertion.

FunnyDream can check system time to help determine when changes were made to specified files.

FunnyDream can use `rundll32` for execution of its components.

FunnyDream can identify the processes for Bkav antivirus.

FunnyDream has established persistence by running `sc.exe` and by setting the `WSearch` service to run automatically.

FunnyDream can use a Registry Run Key and the Startup folder to establish persistence.

FunnyDream can use com objects identified with `CLSID_ShellLink`(`IShellLink` and `IPersistFile`) and `WScript.Shell`(`RegWrite` method) to enable persistence mechanisms.

FunnyDream has compressed collected files with zLib.

FunnyDream has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or `qwerasdf` if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content.

FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.

FunnyDream can enumerate all logical drives on a targeted machine.