Kaspersky Turla

Epic uses the tasklist /svc command to list the services on the system.

Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.

Epic uses the rem reg query command to obtain values from Registry keys.

Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .

Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.

Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.

Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.

Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands. Turla has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.

Epic uses the net view command on the victim’s machine.

Turla used net use commands to connect to lateral systems within a network.

Epic heavily obfuscates its code to make analysis more difficult.

Epic uses the net use, net session, and netstat commands to gather information on network connections.

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.

Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.

Epic uses the tasklist /v command to obtain a list of processes.

Epic uses HTTP and HTTPS for C2 communications.

Turla surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands.

Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the lPH*.dll pattern.

Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.

Turla may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.

Turla surveys a system upon check-in to discover the system time by using the net time command.

Epic uses the net time command to get the system time from the machine and collect the current date and time zone information.

Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.

Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.

Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.

Epic encrypts commands from the C2 server using a hardcoded key.