Cylance Dust Storm

Mis-Type has collected files and data from a compromised host.

Misdat has collected files and data from a compromised host.

S-Type runs the command net start on a victim.

ZLib has the ability to discover and manipulate Windows services.

Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.

S-Type primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.

S-Type has used `ipconfig /all` on a compromised host.

Mis-Type may create a file containing the results of the command cmd.exe /c ipconfig /all.

For Operation Dust Storm, the threat actors used UPX to pack some payloads.

Misdat was typically packed using UPX.

Some S-Type samples have been packed with UPX.

During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.

Mis-Type runs tests to determine the privilege level of the compromised user.

S-Type has run tests to determine the privilege level of the compromised user.

For Operation Dust Storm, the threat actors disguised some executables as JPG files.

S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.

Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

S-Type has uploaded data and files from a compromised host to its C2 servers.

Misdat has uploaded files and data to its C2 servers.

ZLib has sent data and files from a compromised host to its C2 servers.

Mis-Type has transmitted collected files and data to its C2 server.

Mis-Type has been injected directly into a running process, including `explorer.exe`.

Mis-Type has used `cmd.exe` to run commands on a compromised host.

S-Type has provided the ability to execute shell commands on a compromised host.

Misdat is capable of providing shell functionality to the attacker to execute commands.

ZLib has the ability to execute shell commands.

During Operation Dust Storm, the threat actors used Visual Basic scripts.

During Operation Dust Storm, the threat actors used JavaScript code.

S-Type has deleted files it has created on a compromised host.

Misdat is capable of deleting the backdoor file.

Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.

S-Type has deleted accounts it has created.

Misdat is capable of deleting Registry keys used for persistence.

ZLib communicates over HTTP for C2.

S-Type uses HTTP for C2.

Mis-Type network traffic can communicate over HTTP.

Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.

The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.

ZLib has the ability to enumerate system information.

The initial beacon packet for S-Type contains the operating system version and file system of the victim.

The initial beacon packet for Misdat contains the operating system version of the victim.

ZLib has the ability to enumerate files and drives.

Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.

S-Type has run the command `net user` on a victim.

Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}.

Mis-Type network traffic can communicate over a raw socket.

Misdat network traffic communicates over a raw socket.

S-Type can download additional files onto a compromised host.