Procedure examples

Mispadu uses a custom algorithm to obfuscate its internal strings and uses hardcoded keys.

Mispadu also uses encoded configuration files and has encoded payloads using Base64.

Mispadu can sends the collected financial data to the C2 server.

Mispadu's binary is injected into memory via `WriteProcessMemory`.

Mispadu can log keystrokes on the victim's machine.

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

Mispadu can enumerate the running processes on a compromised host.

Mispadu’s dropper uses VBS files to install payloads and perform execution.

Mispadu collects the OS version, computer name, and language ID.

Mispadu searches for various filesystem paths to determine what banking applications are installed on the victim’s machine.

Mispadu has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.

Mispadu has the ability to capture screenshots on compromised hosts.

Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.

Mispadu decrypts its encrypted configuration files prior to execution.

Mispadu utilizes malicious Google Chrome browser extensions to steal financial data.

Mispadu has relied on users to execute malicious files in order to gain execution on victim machines.

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

Mispadu has been installed via MSI installer.

Mispadu uses RunDLL32 for execution via its injector DLL.

Mispadu can run checks to verify if it is running within a virtualized environments including Hyper-V, VirtualBox or VMWare and will terminate execution if the computer name is “JOHN-PC.”

Mispadu can list installed security products in the victim’s environment.

Mispadu creates a link in the startup folder for persistence. Mispadu adds persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Mispadu has obtained credentials from mail clients via NirSoft MailPassView.

Mispadu can steal credentials from Google Chrome.

Mispadu has been spread via malicious links embedded in emails.

Mispadu contains a copy of the OpenSSL library to encrypt C2 traffic.

Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.