ESET Zebrocy May 2019

Zebrocy executes the reg query command to obtain information in the Registry.

Zebrocy runs the ipconfig /all command.

Zebrocy uses netstat -aon to gather network connection information.

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.

Zebrocy uses cmd.exe to execute commands on the system.

Zebrocy has a command to delete files and directories.

Zebrocy uses HTTP for C2.

Zebrocy uses SMTP and POP3 for C2.

Zebrocy collects the OS version and computer name. Zebrocy also runs the systeminfo command to gather system information.

Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the echo %APPDATA% command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.

Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.

A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.

Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.

APT28 has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.

Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.

Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.

APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.

Zebrocy uses SSL and AES ECB for encrypting C2 communications.

APT28 has conducted credential phishing campaigns with links that redirect to credential harvesting sites.

Zebrocy collects the serial number for the storage volume C:\.