Proofpoint Leviathan Oct 2017

Orz can gather victim proxy information.

NanHaiShu can gather information about the victim proxy server.

Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.

Leviathan has obfuscated code using base64.

Leviathan has obfuscated code using gzip compression.

Leviathan has used WMI for execution.

Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.

Orz can gather a process list from the victim.

Leviathan has used PowerShell for execution.

Orz can execute shell commands. Orz can execute commands with JavaScript.

Leviathan has used VBScript.

Orz can overwrite Registry settings to reduce its visibility on the victim.

NanHaiShu can gather the victim computer name and serial number.

Orz can gather the victim OS version and whether it is 64 or 32 bit.

Orz can gather victim drive information.

Orz has used Technet and Pastebin web pages for command and control.

Leviathan has downloaded additional scripts and files from adversary-controlled servers.

NanHaiShu can download additional files from URLs.

Orz can download files onto the victim.

Orz can perform Registry operations.

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.

Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.

Leviathan has sent spearphishing email links attempting to get a user to click.

Leviathan has sent spearphishing attachments attempting to get a user to click.

Leviathan has used regsvr32 for execution.

Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.

Orz can gather the victim's Internet Explorer version.

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.

Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.

Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.

NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.