ESET GreyEnergy Oct 2018

GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.

GreyEnergy enumerates all Windows services.

FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.

FELIXROOT collects information about the network including the IP address and DHCP server.

GreyEnergy is packed for obfuscation.

GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.

FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.

FELIXROOT collects the username from the victim’s machine.

FELIXROOT uses WMI to query the Windows Registry.

GreyEnergy has a module to inject a PE binary into a remote process.

GreyEnergy has a module to harvest pressed keystrokes.

FELIXROOT collects a list of running processes.

GreyEnergy uses cmd.exe to execute itself in-memory.

FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.

GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.

GreyEnergy uses HTTP and HTTPS for C2 communications.

FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.

FELIXROOT collects the victim’s computer name, processor architecture, OS version, and system type.

GreyEnergy has used Tor relays for Command and Control servers.

FELIXROOT downloads and uploads files to and from the victim’s machine.

GreyEnergy can download additional modules and payloads.

GreyEnergy modifies conditions in the Registry and adds keys.

FELIXROOT gathers the time zone information from the victim’s machine.

GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).

FELIXROOT uses Rundll32 for executing the dropper program.

FELIXROOT checks for installed security software like antivirus and firewall.

GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.

FELIXROOT adds a shortcut file to the startup folder for persistence.

FELIXROOT creates a .LNK file for persistence.

GreyEnergy digitally signs the malware with a code-signing certificate.

GreyEnergy encrypts communications using AES256.

GreyEnergy encrypts communications using RSA-2048.

FELIXROOT collects the victim’s volume serial number.