MalwareBytes LazyScripter Feb 2021

Koadic can download files off the target system to send back to the server.

Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.

LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.

KOCTOPUS has obfuscated scripts with the BatchEncryption tool.

Koadic can identify logged in users across the domain and views user sessions.

LazyScripter has used several different security software icons to disguise executables.

Koadic has used scheduled tasks to add persistence.

Koadic has used PowerShell to establish persistence.

LazyScripter has used PowerShell scripts to execute malicious code.

KOCTOPUS has used PowerShell commands to download additional files.

LazyScripter has used batch files to deploy open-source and multi-stage RATs.

KOCTOPUS has used `cmd.exe` and batch files for execution.

Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.

LazyScripter has used VBScript to execute malicious code.

KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.

LazyScripter has used JavaScript in its attacks.

KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.

Koadic has used HTTP for C2 communications.

LazyScripter has leveraged dynamic DNS providers for C2 communications.

KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.

Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.

Koadic can obtain a list of directories.

KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.

LazyScripter has used GitHub to host its payloads to operate spam campaigns.

LazyScripter had downloaded additional tools to a compromised host.

KOCTOPUS has executed a PowerShell command to download a file to the system.

Koadic can download additional files and tools.

KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution.

KOCTOPUS has added and deleted keys from the Registry.

KOCTOPUS has deobfuscated itself before executing its commands.

LazyScripter has relied upon users clicking on links to malicious files.

KOCTOPUS has relied on victims clicking on a malicious link delivered via email.

KOCTOPUS has relied on victims clicking a malicious document for execution.

LazyScripter has lured users to open malicious email attachments.

LazyScripter has used `mshta.exe` to execute Koadic stagers.

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

LazyScripter has used `rundll32.exe` to execute Koadic stagers.

KOCTOPUS can set the AutoRun Registry key with a PowerShell command.

Koadic has added persistence to the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` Registry key.

LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.

KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.

Koadic has used the command Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden to hide its window.

KOCTOPUS has used -WindowsStyle Hidden to hide the command window.

LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.

KOCTOPUS has been distributed via spearphishing emails with malicious attachments.

LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.

KOCTOPUS has been distributed as a malicious link within an email.

LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.

LazyScripter has established GitHub accounts to host its toolsets.

LazyScripter has used a variety of open-source remote access Trojans for its operations.