Procedure examples

MuddyViper has uploaded files to the C2 server. Additionally, MuddyViper has the ability to upload the specified file in chunks with sleep time between each chunk.

MuddyViper has the ability to establish persistence by creating a scheduled task named ManageOnDriveUpdater to launch itself during system startup.

MuddyViper has displayed a fake Windows Security dialog to gather credentials.

MuddyViper has the ability to collect running processes.

MuddyViper has launched a reverse shell using a provided command line.

MuddyViper has used PowerShell.exe to launch a reverse shell.

MuddyViper has used cmd.exe to launch a reverse shell.

MuddyViper has used HTTP GET requests over port 443 and with the WINHTTP_FLAG_SECURE set to SSL/TLS via the WinHTTP API.

MuddyViper has the ability to download files from the C2 server. Additionally, MuddyViper has the ability to download a file in chunks with sleep time between each chunk.

MuddyViper has the ability to relaunch itself using the `CreateProcessW` API.

MuddyViper has the ability to clear the Registry values in the Windows Startup folder that were previously set for persistence.

MuddyViper has decrypted the embedded HackBrowserData tool prior to execution.

MuddyViper has the ability to check for a specified list of security tools in the compromised environment.

MuddyViper has the ability to establish persistence by configuring its installation directory as a Windows Startup folder by setting the following Registry values to `%APPDATALOCAL%\Microsoft\Windows\PPBCompatCache\ManagerCache`:  `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup`.

MuddyViper has archived collected web browser data into a file named CacheDump.zip.

MuddyViper has the ability to encrypt C2 communication using AES-CBC using the CNG API, the key `0608101047106453101617106423101013101012101083109710108585106969`, and the initialization vector `0`.

MuddyViper has reflectively loaded the decrypted HackBrowserData tool in a new thread.

MuddyViper has the ability to sleep for a certain amount of time, with the default being one minute.