McAfee Bankshot

Bankshot collects files from the local system.

Bankshot exfiltrates data over its C2 channel.

Bankshot identifies processes and collects the process ids.

Bankshot uses the command-line interface to execute arbitrary commands.

Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.

Bankshot modifies the time of a file as specified by the control server.

Bankshot uses HTTP for command and control communication.

Bankshot gathers system information, network addresses, and the operation system version.

Bankshot gathers domain and account names/information through process monitoring.

Bankshot gathers domain and account names/information through process monitoring.

Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().

Bankshot recursively generates a list of files within a directory and sends them back to the control server.

Bankshot encodes commands from the control server using a range of characters and gzip.

Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.

Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.

Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.

Bankshot can terminate a specific process by its process id.

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.

Bankshot gathers disk type and disk free space.