Baumgartner Naikon 2015

SslMM has a hard-coded primary and backup C2 string.

WinMM is usually configured with primary and backup domains for C2 communications.

Naikon uses commands such as netsh interface show to discover network interface settings.

Sys10 collects the local IP address of the victim and sends it to the C2.

SslMM sends the logged-on username to its hard-coded C2.

Sys10 collects the account name of the logged-in user and sends it to the C2.

WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

HDoor scans to identify open ports on the victim.

SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.

WinMM sets a WH_CBT Windows hook to collect information on process creation.

Sys10 collects the group name of the logged-in user and sends it to the C2.

WinMM uses HTTP for C2.

Sys10 uses HTTP for C2.

Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.

WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.

SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.

WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.

SslMM contains a feature to manipulate process privileges and tokens.

Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.

HDoor kills anti-virus found on the victim.

SslMM identifies and kills anti-malware processes.