ClearSky Wilted Tulip July 2017

Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".

Matryoshka is capable of keylogging.

Matryoshka is capable of providing Meterpreter shell access.

CopyKittens has used PowerShell Empire.

TDTESS provides a reverse shell on the victim.

TDTESS creates then deletes log files during installation of itself as a service.

After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.

Matryoshka uses DNS for C2.

TDTESS has a command to download and execute an additional file.

Matryoshka is capable of performing screen captures.

CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.

If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.

Matryoshka can establish persistence by adding Registry Run keys.

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.

Matryoshka is capable of stealing Outlook passwords.

CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.

CopyKittens has used -w hidden and -windowstyle hidden to conceal PowerShell windows.