ESET Attor Oct 2019

Attor can obtain application window titles and then determines which windows to perform Screen Capture on.

Attor has opened the registry and performed query searches.

Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.

Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.

Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).

Attor's dispatcher can establish persistence via adding a Registry key with a logon script HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" .

Attor has exfiltrated data over the C2 channel.

Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.

Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.

Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.

One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.

Attor’s plugin deletes the collected files and log files after exfiltration.

Attor has manipulated the time of last access to files and registry keys after they have been created or modified.

Attor has used FTP protocol for C2 communication.

Attor has staged collected data in a central upload directory prior to exfiltration.

Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.

Attor has used Tor for C2 communication.

Attor can download additional plugins, updates and other files.

Attor's dispatcher has used CreateProcessW API for execution.

Attor's dispatcher can modify the Run registry key.

Attor's has a plugin that captures screenshots of the target applications.

Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.

Attor has automatically collected data about the compromised system.

Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.

Attor's has a plugin that is capable of recording audio using available input sound devices.

Attor's dispatcher can execute additional plugins by loading the respective DLLs.

Attor's installer plugin can schedule rundll32.exe to load the dispatcher.

Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions.

Attor's dispatcher can establish persistence by registering a new service.

Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.

Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.

Attor's dispatcher can be executed as a service.

Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.

Attor's Blowfish key is encrypted with a public RSA key.

Attor monitors the free disk space on the system.