360 Machete Sep 2020

Machete collects the MAC address of the target computer and other network configuration information.

Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.

Machete has created scheduled tasks to maintain Machete's persistence.

Machete logs keystrokes from the victim’s machine.

Machete has used batch files to initiate additional downloads of malicious files.

Machete has embedded malicious macros within spearphishing attachments to download additional files.

Machete is written in Python and is used in conjunction with additional Python scripts.

Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.

Machete uses HTTP for Command & Control.

Machete uses FTP for Command & Control.

Machete produces file listings in order to search for files to be exfiltrated.

Machete captures screenshots.

Machete captures audio from the computer’s microphone.

Machete takes photos from the computer’s web camera.

Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.

Machete has used msiexec to install the Machete malware.

Machete has delivered spearphishing emails that contain a zipped file with malicious contents.