Rewterz Sidewinder COVID-19 June 2020

Sidewinder has named malicious files rekeywiz.exe to match the name of a legitimate Windows executable.

Sidewinder has used JavaScript to drop and execute malware loaders.

Sidewinder has used HTTP in C2 communications.

Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.

Sidewinder has lured targets to click on malicious links to gain execution in the target environment.

Sidewinder has lured targets to click on malicious files to gain execution in the target environment.

Sidewinder has used mshta.exe to execute malicious payloads.

Sidewinder has added paths to executables in the Registry to establish persistence.

Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.