Procedure examples

Sagerunex will gather system information such as MAC and IP addresses.

Sagerunex has used VMProtect to pack and obscure itself.

Sagerunex can be passed a reference to an XOR-encrypted configuration file at runtime.

Sagerunex encrypts collected system data then exfiltrates via existing command and control channels.

Sagerunex is designed to be dynamic link library (DLL) injected into an infected endpoint and executed directly in memory.

Sagerunex identifies the `explorer.exe` process on the executing system.

Sagerunex communicates via HTTPS, at times using a hard-coded User Agent of `Mozilla/5.0 (compatible; MSIE 7.0; Win32)`.

Sagerunex gathers host information and stages it locally as a RAR file prior to exfiltration. Sagerunex stores logged data in an encrypted file located at `%TEMP%/TS_FB56.tmp` during execution.

Sagerunex gathers information from the infected system such as hostname.

Sagerunex uses several proxy configuration settings to ensure connectivity.

Sagerunex has used virtual private servers (VPS) for command and control traffic as well as third-party cloud services in more recent variants.

Sagerunex has used web services such as Twitter for command and control purposes.

Sagerunex calls the `WaitForSingleObject` API function as part of time-check logic.

Sagerunex finds the `explorer.exe` process after execution and uses it to change the token of its executing thread.

Sagerunex uses a custom decryption routine to unpack itself during installation.

Sagerunex uses a "servicemain" function to verify its environment to ensure it can only be executed as a service, as well as the existence of a configuration file in a specified directory.

Sagerunex has archived collected materials in RAR format.

Sagerunex uses HTTPS for command and control communication.