Group IB GrimAgent July 2021

GrimAgent can pad C2 messages with random generated values.

GrimAgent can collect data and files from a compromised host.

GrimAgent can enumerate the IP and domain of a target system.

GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.

GrimAgent has the ability to add bytes to change the file hash.

GrimAgent can identify the user id on a target machine.

GrimAgent has sent data related to a compromise host over its C2 channel.

GrimAgent has the ability to set persistence using the Task Scheduler.

GrimAgent can use the Windows Command Shell to execute commands, including its own removal.

GrimAgent can delete old binaries on a compromised host.

GrimAgent can delete previously created tasks on a compromised host.

GrimAgent has the ability to use HTTP for C2 communications.

GrimAgent can collect the OS, and build version on a compromised host.

GrimAgent has the ability to enumerate files and directories on a compromised host.

GrimAgent has the ability to download and execute additional payloads.

GrimAgent can use Native API including GetProcAddress and ShellExecuteW.

GrimAgent can base64 encode C2 replies.

GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.

GrimAgent uses the last 64 bytes of the binary to compute a mutex name. If the generated name is invalid, it will default to the generic `mymutex`.

GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.

GrimAgent can set persistence with a Registry run key.

GrimAgent can use an AES key to encrypt C2 communications.

GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.

GrimAgent can identify the country code on a compromised host.

GrimAgent has used Accept-Language to identify hosts in the United Kingdom, United States, France, and Spain.