FireEye Metamorfo Apr 2018

Metamorfo can enumerate all windows on the victim’s machine.

Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.

Metamorfo has used VBS code on victims’ systems.

Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.

Metamorfo has collected the hostname and operating system version from the compromised host.

Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.

Metamorfo has used raw TCP for C2.

Metamorfo has downloaded a zip file for execution on the system.

Metamorfo has used MSI files to download additional files to execute.

Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.

Metamorfo can collect screenshots of the victim’s machine.

Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.

Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.

Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.

Metamorfo has used mshta.exe to execute a HTA payload.

Metamorfo has searched the compromised system for banking applications.

Metamorfo has configured persistence to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.

Metamorfo has been delivered to victims via emails with malicious HTML attachments.

Metamorfo has communicated with hosts over raw TCP on port 9999.

Metamorfo has side-loaded its malicious DLL file.

Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.