Telefonica Snip3 December 2021

AsyncRAT can check if the current user of a compromised system is an administrator.

AsyncRAT can create a scheduled task to maintain persistence on system start-up.

Snip3 can use RunPE to execute malicious payloads within a hollowed Windows process.

AsyncRAT can examine running processes to determine if a debugger is present.

Snip3 can use a PowerShell script for second-stage execution.

Snip3 can use visual basic scripts for first-stage execution.

Snip3 can download and execute additional payloads and modules over separate communication channels.

Snip3 can download additional payloads to compromised systems.

AsyncRAT has the ability to use OS APIs including `CheckRemoteDebuggerPresent`.

Snip3 has been delivered to targets via downloads from malicious domains.

Snip3 has been executed through luring victims into clicking malicious links.

TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.

Snip3 can gain execution through the download of visual basic files.

AsyncRAT can identify strings such as Virtual, vmware, or VirtualBox to detect virtualized environments.

Snip3 can create a VBS file in startup to persist after system restarts.

AsyncRAT can hide the execution of scheduled tasks using `ProcessWindowStyle.Hidden`.

Snip3 has been delivered to victims through malicious e-mail attachments.

Snip3 has been delivered to victims through e-mail links to malicious files.

TA2541 has used spearphishing e-mails with malicious links to deliver malware.

AsyncRAT can use the `CheckRemoteDebuggerPresent` function to detect the presence of a debugger.

AsyncRAT can check the disk size through the values obtained with `DeviceInfo.`