Trend Micro DRBControl February 2020

Clambling can collect information from a compromised host.

RCSession can collect data from a compromised host.

Clambling has the ability to enumerate Registry keys, including KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir to search for a bitcoin wallet.

Clambling can enumerate the IP address of a compromised machine.

PlugX can use API hashing and modify the names of strings to evade detection.

The Clambling executable has been obfuscated when dropped on a compromised host.

Threat Group-3390 has packed malware and tools, including using VMProtect.

RCSession can store its obfuscated configuration file in the Registry under `HKLM\SOFTWARE\Plus` or `HKCU\SOFTWARE\Plus`.

HyperBro can be delivered encrypted to a compromised host.

RCSession can compress and obfuscate its strings to evade detection on a compromised host.

Threat Group-3390 has used `whoami` to collect system user information.

Clambling can identify the username on a compromised host.

RCSession has used a file named English.rtf to appear benign on victim hosts.

Clambling can inject into the `svchost.exe` process for execution.

RCSession can launch itself from a hollowed svchost.exe process.

Clambling can execute binaries through process hollowing.

RCSession has the ability to capture keystrokes on a compromised host.

Clambling can capture keystrokes on a compromised host.

Clambling can enumerate processes on a targeted system.

The Clambling dropper can use PowerShell to download the malware.

Threat Group-3390 has used PowerShell for execution.

RCSession can use `cmd.exe` for execution on compromised hosts.

Clambling can use cmd.exe for command execution.

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.

Clambling has the ability to use Telnet for communication.

Clambling has the ability to communicate over HTTP.

RCSession can use HTTP in C2 communications.

Clambling can discover the hostname, computer name, and Windows version of a targeted machine.

Clambling can browse directories on a compromised host.

RCSession has the ability to use TCP and UDP in C2 communications.

Clambling has the ability to use TCP and UDP for communication.

Clambling can use Dropbox to download malicious payloads, send commands, and receive information.

Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .

Clambling can set and delete Registry keys.

RCSession can write its configuration file to the Registry.

Clambling has the ability to capture screenshots.

Clambling has the ability to capture and store clipboard data.

Clambling can determine the current time.

Clambling can record screen content in AVI format.

Clambling has the ability to enumerate network shares.

Clambling can deobfuscate its payload prior to execution.

PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer. PlugX has also decrypted its payloads in memory.

HyperBro can unpack and decrypt its payload prior to execution.

Threat Group-3390 has lured victims into opening malicious files containing malware.

Clambling has gained execution through luring victims into opening malicious files.

Clambling can wait 30 minutes before initiating contact with C2.

Clambling can establish persistence by adding a Registry run key.

RCSession has the ability to modify a Registry Run key to establish persistence.

Clambling has the ability to bypass UAC using a `passuac.dll` file.

RCSession can bypass UAC to escalate privileges.