Medium Metamorfo Apr 2020

Metamorfo has encrypted payloads and strings.

Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.

Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).

Metamorfo has performed process name checks and has monitored applications.

Metamorfo has used cmd.exe /c to execute files.

Metamorfo includes payloads written in JavaScript.

Metamorfo has deleted itself from the system after execution.

Metamorfo has used HTTP for C2.

Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.

Metamorfo has downloaded a zip file for execution on the system.

Metamorfo has used MSI files to download additional files to execute.

Metamorfo has used native WINAPI calls.

Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.

Metamorfo uses JavaScript to get the system time.

Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.

Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.

Metamorfo has configured persistence to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.

Metamorfo has digitally signed executables using AVAST Software certificates.

Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.

Metamorfo's C2 communication has been encrypted using OpenSSL.

Metamorfo has side-loaded its malicious DLL file.

Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.