Kaspersky ToddyCat Check Logs October 2023

ToddyCat has run scripts to collect documents from targeted hosts.

LoFiSe can collect files of interest from targeted systems.

Pcexter can upload files from targeted systems.

ToddyCat has used `ping %REMOTE_HOST%` for post exploit discovery.

ToddyCat has used locally mounted network shares for lateral movement through targated environments.

The Ninja payload is XOR encrypted and compressed. Ninja has also XORed its configuration data with a constant value of `0xAA`.

Ninja has compressed its data with the LZSS algorithm.

Ninja has used legitimate looking filenames for its loader including update.dll and x64.dll.

ToddyCat has used WMI to execute scripts for post exploit document collection.

ToddyCat has used `netstat -anop tcp` to discover TCP connections to compromised hosts.

ToddyCat has used scheduled tasks to execute discovery commands and scripts for collection.

Ninja has the ability to inject an agent module into a new process and arbitrary shellcode into running processes.

ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.

Ninja can enumerate processes on a targeted host.

ToddyCat has used Powershell scripts to perform post exploit collection.

ToddyCat has used .bat scripts and `cmd` for execution on compromised hosts.

ToddyCat has executed `net group "domain admins" /dom` for discovery on compromised machines.

Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.

LoFiSe can save files to be evaluated for further exfiltration in the `C:\Programdata\Microsoft\` and `C:\windows\temp\` folders.

ToddyCat manually transferred collected files to an exfiltration host using xcopy.

ToddyCat has used compromised domain admin credentials to mount local network shares.

Ninja can obtain the computer name and information on the OS from targeted hosts.

Pcexter has the ability to search for files in specified directories.

LoFiSe can monitor the file system to identify files less than 6.4 MB in size with file extensions including .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .tif, .odt, .ods, .odp, .eml, and .msg.

Ninja has the ability to enumerate directory content.

ToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.

ToddyCat has run `net user %USER% /dom` for account discovery.

Ninja can proxy C2 communications including to and from internal agents without internet connectivity.

Ninja can forward TCP packets between the C2 and a remote host.

ToddyCat has used a passive backdoor that receives commands with UDP packets.

The Ninja loader can call Windows APIs for discovery, process injection, and payload decryption.

ToddyCat has used `WinExec` to execute commands received from C2 on compromised hosts.

LoFiSe can collect all the files from the working directory every three hours and place them into a password-protected archive for further exfiltration.

The Ninja loader component can decrypt and decompress the payload.

Ninja loader components can be executed through rundll32.exe.

ToddyCat can determine is Kaspersky software is running on an endpoint by running `cmd /c wmic process where name="avp.exe"`.

LoFiSe can collect files into password-protected ZIP-archives for exfiltration.

ToddyCat has leveraged xcopy, 7zip, and RAR to stage and compress collected documents prior to exfiltration.

ToddyCat has hidden malicious scripts using `powershell.exe -windowstyle hidden`.

Pcexter can upload stolen files to OneDrive storage accounts via HTTP `POST`.

ToddyCat has used a DropBox uploader to exfiltrate stolen files.

LoFiSe has been executed as a file named DsNcDiag.dll through side-loading.

Ninja loaders can be side-loaded with legitimate and signed executables including the VLC.exe media player.

Pcexter has been distributed and executed as a DLL file named Vspmsg.dll via DLL side-loading.

Ninja can obtain information on physical drives from targeted hosts.

ToddyCat has collected information on bootable drives including model, vendor, and serial numbers.

Prior to executing a backdoor ToddyCat has run `cmd /c start /b netsh advfirewall firewall add rule name="SGAccessInboundRule" dir=in protocol=udp action=allow localport=49683` to allow the targeted system to receive UDP packets on port 49683.