McAfee GhostSecret

Proxysvc searches the local system and gathers data.

Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.

Proxysvc collects the network adapter information and domain/username information based on current remote sessions.

Proxysvc performs data exfiltration over the control server channel using a custom protocol.

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.

Proxysvc lists processes running on the system.

Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.

Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c "<file_path> > %temp%\PM* .tmp 2>&1".

Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.

Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.

Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.

Proxysvc uses HTTP over SSL to communicate commands with the control server.

Proxysvc collects the OS version, country name, MAC address, computer name, and physical memory statistics.

Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.

Proxysvc lists files in directories.

Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.

Proxysvc automatically collects data about the victim and sends it to the control server.

A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.

As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.

Proxysvc can overwrite files indicated by the attacker before deleting them.

Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.

A Destover-like variant used by Lazarus Group collects disk space information and sends it to its C2 server.

Proxysvc collects volume information for all drives on the system.