SentinelLabs Metador Technical Appendix Sept 2022

Mafalda can dump password hashes from `LSASS.exe`.

metaMain can collect files and system information from a compromised host.

Mafalda can enumerate Registry keys with all subkeys and values.

metaMain's module file has been encrypted via XOR.

Mafalda can collect the username from a compromised host.

metaMain can collect the username from a compromised host.

metaMain can upload collected files and data to its C2 server.

metaMain can log mouse events.

Mafalda can conduct mouse event logging.

metaMain has the ability to log keyboard events.

metaMain can enumerate the processes that run on the platform.

Mafalda can execute PowerShell commands on a compromised machine.

Mafalda can execute shell commands using `cmd.exe`.

metaMain has deleted collected items after uploading the content to its C2 server.

metaMain can change the `CreationTime`, `LastAccessTime`, and `LastWriteTime` file time attributes when executed with `SYSTEM` privileges.

metaMain can use HTTP for C2 communications.

metaMain has stored the collected system files in a working directory.

Mafalda can collect the computer name of a compromised host.

metaMain can collect the computer name from a compromised host.

metaMain can recursively enumerate files in an operator-provided directory.

Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.

metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.

metaMain can establish an indirect and raw TCP socket-based connection to the C2 server.

Mafalda can download additional files onto the compromised host.

metaMain can download files onto compromised systems.

metaMain can execute an operator-provided Windows command by leveraging functions such as `WinExec`, `WriteFile`, and `ReadFile`.

metaMain can write the process ID of a target process into the `HKEY_LOCAL_MACHINE\SOFTWARE\DDE\tpid` Registry value as part of its reflective loading activity.

Mafalda can manipulate the system registry on a compromised host.

metaMain can take and save screenshots.

Mafalda can encode data using Base64 prior to exfiltration.

Mafalda can establish an SSH connection from a compromised host to a server.

Mafalda can use `AdjustTokenPrivileges()` to elevate privileges.

Mafalda can create a token for a different user.

Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.

metaMain has delayed execution for five to six minutes during its persistence establishment process.

Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.

Mafalda can create a remote service, let it run once, and then delete it.

metaMain can encrypt the data that it sends and receives from the C2 server using an RC4 encryption algorithm.

metaMain can support an HKCMD sideloading start method.

Mafalda can search for debugging tools on a compromised host.

Mafalda can enumerate all drives on a compromised host.