Procedure examples

CHIMNEYSWEEP can collect files from compromised hosts.

CHIMNEYSWEEP can use a custom Base64 alphabet to encode an API decryption key.

The CHIMNEYSWEEP installer has been padded with null bytes to inflate its size.

CHIMNEYSWEEP can use `LoadLibrary` and `GetProcAddress` to resolve Windows API function strings at run time.

CHIMNEYSWEEP can extract RC4 encrypted embedded payloads for privilege escalation.

CHIMNEYSWEEP has included the victim's computer name and username in C2 messages sent to actor-owned infrastructure.

CHIMNEYSWEEP can upload collected files to the command-and-control server.

CHIMNEYSWEEP can use the Windows `SilentCleanup` scheduled task to enable payload execution.

CHIMNEYSWEEP has the ability to support keylogging.

CHIMNEYSWEEP can check if a process name contains “creensaver.”

CHIMNEYSWEEP can invoke the PowerShell command `[Reflection.Assembly]::LoadFile(\"%s\")\n$i=\"\"\n$r=[%s]::%s(\"%s\",[ref] $i)\necho $r,$i\n` to execute secondary payloads.

CHIMNEYSWEEP has executed a script named cln.vbs on compromised hosts.

CHIMNEYSWEEP can time stomp its executable, previously dating it between 2010 to 2021.

CHIMNEYSWEEP can send `HTTP GET` requests to  C2.

CHIMNEYSWEEP can store captured screenshots to disk including to a covert store named `APPX.%x%x%x%x%x.tmp` where `%x` is a random value.

CHIMNEYSWEEP has the ability to enumerate directories for files that match a set list.

CHIMNEYSWEEP has the ability to use use Telegram channels to return a list of commands to be executed, to download additional payloads, or to create a reverse shell.

CHIMNEYSWEEP can download additional files from C2.

CHIMNEYSWEEP can use Windows APIs including `LoadLibrary` and `GetProcAddress`.

CHIMNEYSWEEP can use the Windows Registry Environment key to change the `%windir%` variable to point to `c:\Windows` to enable payload execution.

CHIMNEYSWEEP can capture screenshots on targeted systems using a timer and either upload them or store them to disk.

CHIMNEYSWEEP can capture content from the clipboard.

CHIMNEYSWEEP can monitor for removable drives.

CHIMNEYSWEEP can use a custom Base64 alphabet for encoding C2.

CHIMNEYSWEEP can use an embedded RC4 key to decrypt Windows API function strings.

CHIMNEYSWEEP can use CMSTP.exe to install a malicious Microsoft Connection Manager Profile.

CHIMNEYSWEEP can execute a task which leads to execution if it finds a process name containing “creensaver.”

CHIMNEYSWEEP is capable of checking whether a compromised device is running DeepFreeze by Faronics.

CHIMNEYSWEEP can reboot or shutdown the targeted system or logoff the current user.

CHIMNEYSWEEP can make use of the Windows `SilentCleanup` scheduled task to execute its payload with elevated privileges.

CHIMNEYSWEEP has been dropped by a self-extracting archive signed with a valid digital certificate.