Zscaler Higaisa 2020

Higaisa used a FakeTLS session for C2 communications.

Higaisa used ipconfig to gather network configuration information.

Higaisa performed padding with null bytes before calculating its hash.

Higaisa used Base64 encoded compressed payloads.

Higaisa used Base64 encoded compressed payloads.

Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.

Higaisa exfiltrated data over its C2 channel.

Higaisa dropped and added officeupdate.exe to scheduled tasks.

Higaisa’s shellcode attempted to find the process ID of the current process.

Higaisa used cmd.exe for execution.

Higaisa used JavaScript to execute additional files.

Higaisa used HTTP and HTTPS to send data back to its C2 server.

Higaisa discovered system proxy settings and used them if available.

Higaisa has called various native OS APIs.

Higaisa used a function to gather the current time.

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.

Higaisa used malicious e-mail attachments to lure victims into executing LNK files.

Higaisa added a spoofed binary to the start-up folder for persistence.

Higaisa has sent spearphishing emails containing malicious attachments.

Higaisa used AES-128 to encrypt C2 traffic.