Bitdefender Naikon April 2021

Nebulae has the capability to upload collected files to C2.

RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.

RainyDay can create and register a service for execution.

RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working.

Naikon has used a netbios scanner for remote machine identification.

RainyDay has downloaded as a XOR-encrypted payload.

RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."

Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.

Nebulae has created a service named "Windows Update Agent1" to appear legitimate.

Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.

RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.

Nebulae uses functions named StartUserModeBrowserInjection and StopUserModeBrowserInjection indicating that it's trying to imitate chrome_frame_helper.dll.

Naikon has used the LadonGo scanner to scan target networks.

Naikon has used WMIC.exe for lateral movement.

RainyDay can use scheduled tasks to achieve persistence.

Naikon has used schtasks.exe for lateral movement in compromised networks.

RainyDay can enumerate processes on a target system.

Nebulae can enumerate processes on a target system.

RainyDay can use the Windows Command Shell for execution.

Nebulae can use CMD to execute a process.

Nebulae has the ability to delete files and directories.

RainyDay has the ability to uninstall itself by deleting its service and files.

RainyDay can use HTTP in C2 communications.

RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.

Naikon has used administrator credentials for lateral movement in compromised networks.

RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.

Nebulae can list files and directories on a compromised host.

RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.

Nebulae can use TCP in C2 communications.

RainyDay can use TCP in C2 communications.

RainyDay can download files to a compromised host.

Nebulae can download files from C2.

Nebulae has the ability to use CreateProcess to execute a process.

The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.

RainyDay has the ability to capture screenshots.

RainyDay can decrypt its payload via a XOR key.

RainyDay can use services to establish persistence.

Nebulae can create a service to establish persistence.

Naikon has modified a victim's Windows Run registry to establish persistence.

Nebulae can achieve persistence through a Registry Run key.

RainyDay can use tools to collect credentials from web browsers.

RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.

RainyDay can use a file exfiltration tool to upload specific files to Dropbox.

Nebulae can use RC4 and XOR to encrypt C2 communications.

RainyDay can use RC4 to encrypt C2 communications.

RainyDay can use side-loading to run malicious executables.

Nebulae can use DLL side-loading to gain execution.

Nebulae can discover logical drive information including the drive type, free space, and volume information.