Securelist Machete Aug 2014

Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.

Machete has a feature to copy files from every drive onto a removable drive in a hidden folder.

The different components of Machete are executed by Windows Task Scheduler.

Machete logs keystrokes from the victim’s machine.

Machete is written in Python and is used in conjunction with additional Python scripts.

Machete captures screenshots.

Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.

Machete captures audio from the computer’s microphone.

Machete takes photos from the computer’s web camera.

Machete has used base64 encoding.

Machete has distributed Machete through a fake blog website.

Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.

Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.

Machete used the startup folder for persistence.

Machete has delivered spearphishing emails that contain a zipped file with malicious contents.