Symantec Bilbug 2022

Lotus Blossom has used Ping to identify remote systems.

Hannotog can upload encyrpted data for exfiltration.

Sagerunex can be passed a reference to an XOR-encrypted configuration file at runtime.

Lotus Blossom has used port scanners to enumerate services on remote hosts.

Sagerunex identifies the `explorer.exe` process on the executing system.

Hannotog can execute various `cmd.exe /c %s` commands.

Sagerunex communicates via HTTPS, at times using a hard-coded User Agent of `Mozilla/5.0 (compatible; MSIE 7.0; Win32)`.

Sagerunex gathers host information and stages it locally as a RAR file prior to exfiltration. Sagerunex stores logged data in an encrypted file located at `%TEMP%/TS_FB56.tmp` during execution.

Lotus Blossom has used `net` commands and tools such as AdFind to profile domain accounts associated with victim machines and make Active Directory queries.

Hannotog can download additional files to the victim machine.

Sagerunex finds the `explorer.exe` process after execution and uses it to change the token of its executing thread.

Lotus Blossom has used tools such as AdFind to make Active Directory queries.

Hannotog can stop Windows services.

Hannotog creates a new service for persistence.

Lotus Blossom has used WinRAR for compressing data in RAR format.

Hannotog uses non-standard listening ports, such as UDP 5900, for command and control purposes.

Sagerunex uses HTTPS for command and control communication.

Hannotog can modify local firewall settings via `netsh` commands to open a listening UDP port.