ESET Crutch December 2020

Crutch can exfiltrate files from compromised systems.

Crutch has used a hardcoded GitHub repository as a fallback channel.

Crutch has automatically exfiltrated stolen files to Dropbox.

Crutch can monitor removable drives and exfiltrate files matching a given extension list.

Crutch has established persistence with a scheduled task impersonating the Outlook item finder.

Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).

Crutch has the ability to persist using scheduled tasks.

Crutch has conducted C2 communications with a Dropbox account using the HTTP API.

Crutch has staged stolen files in the C:\AMD\Temp directory.

Turla has abused local accounts that have the same password across the victim’s network.

Turla has used net user to enumerate local accounts on the system.

Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.

Crutch can use Dropbox to receive commands and upload stolen data.

Crutch can automatically monitor removable drives in a loop and copy interesting files.

Crutch can monitor for removable drives being plugged into the compromised machine.

Crutch has used the WinRAR utility to compress and encrypt stolen files.

Crutch has exfiltrated stolen data to Dropbox.

Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.

Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.