Procedure examples

Mafalda can dump password hashes from `LSASS.exe`.

Mafalda can collect files and information from a compromised host.

Mafalda can enumerate Registry keys with all subkeys and values.

Mafalda can use the `GetAdaptersInfo` function to retrieve information about network adapters and the `GetIpNetTable` function to retrieve the IPv4 to physical network address mapping table.

Mafalda has been obfuscated and contains encrypted functions.

Mafalda can collect the username from a compromised host.

Mafalda can send network system data and files to its C2 server.

Mafalda can use the GetExtendedTcpTable function to retrieve information about established TCP connections.

Mafalda can conduct mouse event logging.

Mafalda can enumerate running processes on a machine.

Mafalda can execute PowerShell commands on a compromised machine.

Mafalda can execute shell commands using `cmd.exe`.

Mafalda can use HTTP for C2.

Mafalda can place retrieved files into a destination directory.

Mafalda can collect the computer name of a compromised host.

Mafalda can search for files and directories.

Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.

Mafalda can use raw TCP for C2.

Mafalda can download additional files onto the compromised host.

Mafalda can use a variety of API calls.

Mafalda can manipulate the system registry on a compromised host.

Mafalda can take a screenshot of the target machine and save it to a file.

Mafalda can encode data using Base64 prior to exfiltration.

Mafalda can establish an SSH connection from a compromised host to a server.

Mafalda can use `AdjustTokenPrivileges()` to elevate privileges.

Mafalda can create a token for a different user.

Mafalda can decrypt files and data.

Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.

Mafalda can collect the contents of the `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState` file.

Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.

Mafalda can collect a Chrome encryption key used to protect browser cookies.

Mafalda can create a remote service, let it run once, and then delete it.

Mafalda can encrypt its C2 traffic with RC4.

Mafalda can search for debugging tools on a compromised host.

Mafalda can enumerate all drives on a compromised host.

Mafalda can delete Windows Event logs by invoking the `OpenEventLogW` and `ClearEventLogW` functions.