Checkpoint IndigoZebra July 2021

xCaon has uploaded files from victims' machines.

BoxCaon can upload files from a compromised host.

BoxCaon can collect the victim's MAC address by using the GetAdaptersInfo API.

xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address.

BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.

BoxCaon uploads files and data from a compromised host over the existing C2 channel.

BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.

xCaon has a command to start an interactive shell.

xCaon has communicated with the C2 server by sending POST requests over HTTP.

BoxCaon has created a working folder for collected files that it sends to the C2 server.

BoxCaon has searched for files on the system, such as documents located in the desktop folder.

BoxCaon has used DropBox for C2 communications.

xCaon has a command to download files to the victim's machine.

IndigoZebra has downloaded additional files and tools from its C2 server.

BoxCaon can download files.

xCaon has leveraged native OS function calls to retrieve victim's network adapter's information using GetAdapterInfo() API.

BoxCaon has used Windows API calls to obtain information about the compromised host.

xCaon has used Base64 to encode its C2 traffic.

xCaon has decoded strings from the C2 server before executing commands.

xCaon has checked for the existence of Kaspersky antivirus software on the system.

xCaon has added persistence via the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load which causes the malware to run each time any user logs in.

BoxCaon established persistence by setting the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key to point to its executable.

IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.

BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.

xCaon has encrypted data sent to the C2 server using a XOR key.

IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.

IndigoZebra created Dropbox accounts for their operations.

IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.

IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.