ESET Casbaneiro Oct 2019

Metamorfo has encrypted payloads and strings.

Metamorfo has collected the username from the victim's machine.

Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.

Metamorfo can send the data it collects to the C2 server.

Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.

Metamorfo has used HTTP for C2.

Metamorfo has collected the hostname and operating system version from the compromised host.

Metamorfo has used YouTube to store and hide C&C server domains.

Metamorfo has used MSI files to download additional files to execute.

Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.

Metamorfo can collect screenshots of the victim’s machine.

Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.

Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.

Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.

Metamorfo has used MsiExec.exe to automatically execute files.

Metamorfo has searched the compromised system for banking applications.

Metamorfo collects a list of installed antivirus software from the victim’s system.

Metamorfo has configured persistence to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.

Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.

Metamorfo has been delivered to victims via emails with malicious HTML attachments.

Metamorfo has encrypted C2 commands with AES-256.

Metamorfo has side-loaded its malicious DLL file.