Unit 42 QUADAGENT July 2018

QUADAGENT uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful.

QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.

QUADAGENT gathers the current domain the victim system belongs to.

QUADAGENT was likely obfuscated using `Invoke-Obfuscation`.

QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as `HKCU\Office365DCOMCheck`) in the `HKCU` hive.

OilRig has encrypted and encoded data in its malware, including by using base64.

QUADAGENT gathers the victim username.

QUADAGENT used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1.

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.

QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.

OilRig has used various types of scripting for execution.

QUADAGENT uses PowerShell scripts for execution.

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.

QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.

QUADAGENT uses VBScripts.

QUADAGENT has a command to delete its Registry key and scheduled task.

QUADAGENT uses HTTPS and HTTP for C2 communications.

QUADAGENT uses DNS for C2 communications.

QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.

QUADAGENT encodes C2 communications with base64.

QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.

OilRig has delivered malicious links to achieve execution on the target system.

OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.