Proofpoint TA505 Jan 2019

ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.

FlawedGrace encrypts its C2 configuration files with AES in CBC mode.

ServHelper will attempt to enumerate the username of the victim.

ServHelper has created a new user named `supportaccount`.

ServHelper contains modules that will use schtasks to carry out malicious operations.

ServHelper can execute shell commands against cmd.

ServHelper has a module to delete itself from the infected machine.

ServHelper uses HTTP for C2.

ServHelper will attempt to enumerate Windows version and system architecture.

ServHelper has added a user named "supportaccount" to the Remote Desktop Users and Administrators groups.

ServHelper may download additional files to execute.

ServHelper has created a new user named "supportaccount".

TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.

TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.

TA505 has used spearphishing emails with malicious attachments to initially compromise victims.

TA505 has sent spearphishing emails containing malicious links.

ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.