Symantec FIN8 Jul 2023

Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.

Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.

FIN8 has executed the command `quser` to display the session details of a compromised machine.

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.

Sardonic can use the `QueueUserAPC` API to execute shellcode on a compromised machine.

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via `cmd.exe`.

Sardonic has the ability to run `cmd.exe` or other interactive processes on a compromised computer.

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.

FIN8 has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.

Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.

FIN8 has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.

Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.