Gigamon BADHATCH Jul 2019

BADHATCH has an embedded second stage DLL payload within the first stage of the malware.

BADHATCH can exfiltrate data over the C2 channel.

BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.

BADHATCH can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.

BADHATCH has the ability to execute a malicious DLL by injecting into `explorer.exe` on a compromised machine.

BADHATCH can inject itself into a new `svchost.exe -k netsvcs` process using the asynchronous procedure call (APC) queue.

BADHATCH can utilize `powershell.exe` to execute commands on a compromised host.

BADHATCH can use `cmd.exe` to execute commands on a compromised host.

BADHATCH has the ability to delete PowerShell scripts from a compromised machine.

BADHATCH can use HTTP and HTTPS over port 443 to communicate with actor-controlled C2 servers.

BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, OS type/version, bitness, and hostname.

BADHATCH has the ability to load a second stage malicious DLL file onto a compromised machine.

BADHATCH can utilize Native API functions such as, `ToolHelp32` and `Rt1AdjustPrivilege` to enable `SeDebugPrivilege` on a compromised machine.

BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.

BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to `CreateThread`.