ESET Gazer Aug 2017

Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.

Gazer can establish persistence by creating a scheduled task.

Gazer injects its communication module into an Internet accessible process through which it performs C2.

Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.

Gazer has commands to delete files and persistence mechanisms from the victim.

For early Gazer versions, the compilation timestamp was faked.

Gazer communicates with its C2 servers over HTTP.

Gazer can execute a task to download a file.

Gazer creates a mutex using the hard-coded value `{531511FA-190D-5D85-8A4A-279F2F592CC7}` to ensure that only one instance of itself is running.

Gazer can establish persistence through the system screensaver by configuring it to execute the malware.

Gazer can establish persistence by creating a .lnk file in the Start menu.

Gazer can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.

Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.

Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."

Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.

Gazer uses custom encryption for C2 that uses 3DES.

Gazer uses custom encryption for C2 that uses RSA.