Procedure examples

The AshTag AshenOrchestrator component payload as been Base64 encoded and embedded with HTML content from the C2 server.

AshTag has masqueraded as a legitimate VisualServer utility.

AshTag has exfiltrated reconnaissance data on targeted systems to C2 servers.

AshTag can use a .NET program to execute WMI queries and send unique victim IDs to C2.

AshTag can set persistence using scheduled tasks.

The AshTag AshenOrchestrator component has process management functionality.

AshTag can use JSON files to deliver payloads and configuration files.

AshTag can use HTTP to send and receive data from C2.

The AshTag loader and AshenOrchestrator components can collect reconnaissance data from victim machines.

The AshTag AshenOrchestrator component can enumerate files on victim hosts.

AshTag can download malicious payloads from file sharing services.

The AshTag stager component can retrieve and execute the main payload.

The AshTag AshenOrchestrator component has the ability to take screenshots.

The AshTag stager compoment can decode and decrypt Base64 and XOR-encrypted payloads.

AshTag has been executed through victims downloading and opening malicious RAR archive files.

AshTag has enabled execution via DLL sideloading using a legitimate executable paired with a malicious DLL named wtsapi32.

AshTag can check geolocation on targeted systems.

AshTag can use a set sleep time to delay C2 beaconing.

AshTag can use `volumeserialnumber` to enumerate volumes.