MalwareBytes WoodyRAT Aug 2022

Woody RAT can collect information from a compromised host.

Woody RAT can search registry keys to identify antivirus programs on an compromised host.

Woody RAT can retrieve network interface and proxy information.

Woody RAT can make `Ping` GET HTTP requests to its C2 server at regular intervals for network connectivity checks.

Woody RAT has used Base64 encoded strings and scripts.

Woody RAT can retrieve a list of user accounts and usernames from an infected machine.

Woody RAT can exfiltrate files from an infected machine to its C2 server.

Woody RAT can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.

Woody RAT can create a suspended notepad process and write shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.

Woody RAT can call `NtQuerySystemProcessInformation` with `SystemProcessInformation` to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.

Woody RAT can execute PowerShell commands and scripts with the use of .NET DLL, `WoodyPowerSession`.

Woody RAT can execute commands using `cmd.exe`.

Woody RAT has the ability to delete itself from disk by creating a suspended notepad process and writing shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.

Woody RAT can communicate with its C2 server using HTTP requests.

Woody RAT can retrieve the following information from an infected machine: OS, architecture, computer name, OS build version, and environment variables.

Woody RAT can list all files and their associated attributes, including filename, type, owner, creation time, last access time, last write time, size, and permissions.

Woody RAT can identify administrator accounts on an infected machine.

Woody RAT can download files from its C2 server, including the .NET DLLs, `WoodySharpExecutor` and `WoodyPowerSession`.

Woody RAT can use multiple native APIs, including `WriteProcessMemory`, `CreateProcess`, and `CreateRemoteThread` for process injection.

Woody RAT has the ability to take a screenshot of the infected host desktop using Windows GDI+.

Woody RAT can deobfuscate Base64-encoded strings and scripts.

Woody RAT has relied on CVE-2022-30190 (Follina) for execution during delivery.

Woody RAT has relied on users opening a malicious email attachment for execution.

Woody RAT can collect .NET, PowerShell, and Python information from an infected host.

Woody RAT can detect Avast Software, Doctor Web, Kaspersky, AVG, ESET, and Sophos antivirus programs.

Woody RAT has been delivered via malicious Word documents and archive files.

Woody RAT can use AES-CBC to encrypt data sent to its C2 server.

Woody RAT can use RSA-4096 to encrypt data sent to its C2 server.

Woody RAT can retrieve information about storage drives from an infected machine.

Woody RAT has suppressed all error reporting by calling `SetErrorMode` with 0x8007 as a parameter.