Palo Alto Gamaredon Feb 2017

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.

A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.

Pteranodon exfiltrates screenshot files to its C2 server.

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.

Pteranodon schedules tasks to invoke its components in order to establish persistence.

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.

Pteranodon can use `cmd.exe` for execution on victim systems.

Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.

Pteranodon can use HTTP for C2.

Gamaredon Group has used HTTP and HTTPS for C2 communications.

Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\<Username>\AppData\Roaming\Microsoft\store to store screenshot JPEG files.

A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.

Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.

Pteranodon can download and execute additional files.

Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.

Pteranodon can capture screenshots at a configurable interval.

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.

Pteranodon executes functions using rundll32.exe.

Pteranodon copies itself to the Startup folder to establish persistence.