Forcepoint Monsoon

When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

Unknown Logger can obtain information about the victim's IP address.

When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.

TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.

Unknown Logger can obtain information about the victim usernames.

When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.

When it first starts, BADNEWS spawns a new thread to log keystrokes.

Unknown Logger is capable of recording keystrokes.

AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.

BADNEWS is capable of executing commands via cmd.exe.

BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.

Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.

TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.

AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.

Unknown Logger is capable of spreading to USB devices.

BADNEWS collects C2 information via a dead drop resolver.

BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.

Unknown Logger is capable of downloading remote files.

BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.

BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.

BADNEWS has a command to take a screenshot and send it to the C2 server.

BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.

After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.

BADNEWS encodes C2 traffic with base64.

AutoIt backdoor has sent a C2 response that was base64-encoded.

TINYTYPHON installs itself under Registry Run key to establish persistence.

BADNEWS installs a registry Run key to establish persistence.

AutoIt backdoor attempts to escalate privileges by bypassing User Access Control.

Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.

BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.

BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.

Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.