Proofpoint Operation Transparent Tribe March 2016

Crimson can check the Registry for the presence of HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate to determine how long it has been installed on a host.

Crimson contains a command to collect the victim MAC address and LAN IP.

Peppy has the ability to automatically exfiltrate files and keylogs.

Crimson contains a module to collect data from removable drives.

Transparent Tribe has dropped encoded executables on compromised hosts.

Crimson can identify the user on a targeted system.

Peppy can log keystrokes on compromised hosts.

Crimson can use a module to perform keylogging on compromised hosts.

Crimson contains a command to list processes.

Peppy has the ability to execute shell commands.

Transparent Tribe has crafted VBS-based malicious documents.

Crimson has the ability to delete files from a compromised host.

Crimson can use a HTTP GET request to download its final payload.

Peppy can use HTTP to communicate with C2.

Crimson contains a command to collect the victim PC name and operating system.

Peppy can identify specific files for exfiltration.

Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.

Crimson uses a custom TCP protocol for C2.

Crimson contains a command to retrieve files from its C2 server.

Peppy can download and execute remote files.

Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.

Peppy can take screenshots on targeted systems.

Crimson contains a command to perform screen captures.

Crimson contains a command to collect and exfiltrate emails from Outlook.

Crimson has the ability to discover pluggable/removable drives to extract files from.

Crimson can capture webcam video on targeted systems.

Crimson can decode its encoded PE file prior to execution.

Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.

Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.

Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.

Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.

Crimson contains a command to collect information about anti-virus software on the victim.

Crimson can add Registry run keys for persistence.

Crimson contains a module to steal credentials from Web browsers on the victim machine.

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.

Transparent Tribe has used dynamic DNS services to set up C2.

Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.

Transparent Tribe has compromised domains for use in targeted malicious campaigns.

Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.

Crimson contains a command to collect disk drive information.