Proofpoint TA505 October 2019

SDBbot has the ability to access the file system on a compromised host.

SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.

SDBbot has the ability to use RDP to connect to victim's machines.

SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.

SDBbot has the ability to identify the user on a compromised host.

Get2 has the ability to identify the current username of an infected host.

Get2 has the ability to inject DLLs into processes.

SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.

Get2 has the ability to identify running processes on an infected host.

Get2 has the ability to run executables with command-line arguments.

SDBbot has the ability to use the command shell to execute commands on a compromised host.

SDBbot has the ability to clean up and remove data structures from a compromised host.

SDBbot has the ability to delete files from a compromised host.

Get2 has the ability to use HTTP to send information collected from an infected host to C2.

SDBbot has the ability to identify the OS version, OS bit information and computer name.

Get2 has the ability to identify the computer name and Windows version of an infected host.

SDBbot has the ability to get directory listings or drive information on a compromised host.

SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.

SDBbot has the ability to communicate with C2 with TCP over port 443.

SDBbot has the ability to download a DLL from C2 to a compromised host.

SDBbot has the ability to record video on a compromised host.

SDBbot has the ability to decrypt and decompress its payload to enable code execution.

TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.

TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.

SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.

SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.

SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.

TA505 has used spearphishing emails with malicious attachments to initially compromise victims.

TA505 has sent spearphishing emails containing malicious links.