Carbon Black HotCroissant April 2020

HotCroissant has the ability to retrieve a list of services on the infected host.

HotCroissant has the ability to list the names of all open windows on the infected host.

Rifdoor has the ability to identify the IP address of the compromised host.

Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.

HotCroissant has used the open source UPX executable packer.

Rifdoor has encrypted strings with a single byte XOR algorithm.

HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.

Rifdoor has the ability to identify the username on the compromised host.

HotCroissant has the ability to collect the username on the infected host.

HotCroissant has the ability to download files from the infected host to the command and control (C2) server.

HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.

HotCroissant has the ability to list running processes on the infected host.

HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.

HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.

Rifdoor has the ability to identify the Windows version on the compromised host.

HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.

HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.

HotCroissant has the ability to do real time screen viewing on an infected host.

Rifdoor has been executed from malicious Excel or Word documents containing macros.

HotCroissant has the ability to stop services on the infected host.

HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.

Rifdoor has created a new registry entry at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of C:\ProgramData\Initech\Initech.exe /run.

HotCroissant has the ability to hide the window for operations performed on a given file.

Rifdoor has been distributed in e-mails with malicious Excel or Word documents.

HotCroissant has compressed network communications and encrypted them with a custom stream cipher.

Rifdoor has encrypted command and control (C2) communications with a stream cipher.