Accenture MUDCARP March 2019

BADFLICK has uploaded files from victims' machines.

BADFLICK has captured victim IP address details.

Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.

Leviathan has used PowerShell for execution.

Leviathan has obtained valid accounts to gain initial access.

BADFLICK has captured victim computer name, memory space, and CPU details.

BADFLICK has searched for files on the infected host.

BADFLICK has download files from its C2 server.

BADFLICK can decode shellcode using a custom rotating XOR cipher.

Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.

BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.

BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.

Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.

BADFLICK has compressed data using the aPLib compression library.

BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.

Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.