Procedure examples

SocGholish has the ability to enumerate the domain name of a victim, as well as if the host is a member of an Active Directory domain.

SocGholish has single or double Base-64 encoded references to its second-stage server URLs.

The SocGholish JavaScript payload has been delivered within a compressed ZIP archive.

SocGholish can use `whoami` to obtain the username from a compromised host.

SocGholish has been named `AutoUpdater.js` to mimic legitimate update files.

SocGholish has used WMI calls for script execution and system profiling.

SocGholish can exfiltrate data directly to its C2 domain via HTTP.

SocGholish can list processes on targeted hosts.

The SocGholish payload is executed as JavaScript.

SocGholish can send output from `whoami` to a local temp file using the naming convention `rad<5-hex-chars>.tmp`.

SocGholish has the ability to enumerate system information including the victim computer name.

SocGholish has used Amazon Web Services to host second-stage servers.

SocGholish can download additional malware to infected hosts.

SocGholish has been distributed through compromised websites with malicious content often masquerading as browser updates.

SocGholish has lured victims into interacting with malicious links on compromised websites for execution.

SocGholish can profile compromised systems to identify domain trust relationships.

SocGholish can identify the victim's browser in order to serve the correct fake update page.

SocGholish has been spread via emails containing malicious links.

SocGholish can use IP-based geolocation to limit infections to victims in North America, Europe, and a small number of Asian-Pacific nations.