Procedure examples

HiddenFace can upload files from the victim machine to C2 nodes.

HiddenFace can use active and passive C2 modes that use different encryption algorithms and backdoor commands.

HiddenFace can dynamically resolve Windows APIs.

HiddenFace has encrypted its payload with AES.

HiddenFace can collect the username associated with the compromised host.

HiddenFace has used scheduled tasks for execution and persistence.

HiddenFace can inject code directly into legitimate applications.

HiddenFace can check running processes against a list of blocklisted applications.

HiddenFace can alter timestamps for directory content on targeted machines.

HiddenFace can enumerate the hostname and username of the compromised system.

HiddenFace can act as an internal HTTP proxy within the targeted environment.

HiddenFace can use a custom TCP protocol over Port 443 for C2.

HiddenFace can download files from the C2 to victim systems.

HiddenFace can store its configuration file in the Registry.

HiddenFace has the ability to decrypt its payload prior to execution.

HiddenFace can check for the presence of specific analysis tools and will terminate itself if they are found.

HiddenFace can create a mutex to ensure only one instance is running at a time.

HiddenFace can sleep randomly between 30 and 60 seconds to avoid behavioral analysis.

HiddenFace can identify processes identified with security applications and tooling.

HiddenFace has used dynamic domain generation algorithms in C2.

HiddenFace's passive mode listens on TCP 47000.

HiddenFace can hide its IP lookup by using DNS over HTTPS (DoH) for C2.

HiddenFace can use a randomly selected symmetric encryption algorithm for C2.

HiddenFace can use RSA-2048 in addition to symmetric algorithms in C2.

HiddenFace can reconfigure Windows firewalls to enable communication by adding a rule named “Cortana” to allow inbound connection to TCP/47000.