Procedure examples

Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.

Sardonic has the ability to execute the `net start` command.

Sardonic has the ability to execute the `ipconfig` command.

Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.

Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.

Sardonic can use WMI to execute PowerShell commands on a compromised machine.

Sardonic has the ability to execute the `netstat` command.

Sardonic can use the `QueueUserAPC` API to execute shellcode on a compromised machine.

Sardonic has the ability to execute the `tasklist` command.

Sardonic has the ability to execute PowerShell commands on a compromised machine.

Sardonic has the ability to run `cmd.exe` or other interactive processes on a compromised computer.

Sardonic has the ability to delete created WMI objects to evade detections.

Sardonic has the ability to collect the computer name, and CPU manufacturer name from a compromised machine. Sardonic also has the ability to execute the `ver` and `systeminfo` commands.

Sardonic can communicate with actor-controlled C2 servers by using a custom little-endian binary protocol.

Sardonic has the ability to upload additional malicious files to a compromised machine.

Sardonic has the ability to call Win32 API functions to determine if `powershell.exe` is running.

Sardonic can encode client ID data in 32 uppercase hex characters and transfer to the actor-controlled C2 server.

Sardonic has the ability to execute the `net view` command.

Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.

Sardonic can use a WMI event filter to invoke a command-line event consumer to gain persistence.

Sardonic has the ability to connect with actor-controlled C2 servers using a custom binary protocol over port 443.

Sardonic has the ability to use an RC4 key to encrypt communications to and from actor-controlled C2 servers.

Sardonic has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers by using an RSA public key.

Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.

Sardonic has the ability to collect the C:\ drive serial number from a compromised machine.