DustySky

DustySky has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.

The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.

The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.

DustySky contains a keylogger.

DustySky collects information about running processes from victims.

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.

DustySky has used both HTTP and HTTPS for C2.

DustySky extracts basic information about the operating system.

DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.

DustySky searches for removable media and duplicates itself onto it.

DustySky checks for the existence of anti-virus.

DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.

DustySky searches for network drives and removable media and duplicates itself onto them.