Fortinet Metamorfo Feb 2020

Metamorfo can enumerate all windows on the victim’s machine.

Metamorfo has used VMProtect to pack and protect files.

Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.

Metamorfo has deleted itself from the system after execution.

Metamorfo has collected the hostname and operating system version from the compromised host.

Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.

Metamorfo has downloaded a zip file for execution on the system.

Metamorfo has used MSI files to download additional files to execute.

Metamorfo has used native WINAPI calls.

Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.

Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.

Metamorfo had used AutoIt to load and execute the DLL payload.

Metamorfo has used MsiExec.exe to automatically execute files.

Metamorfo collects a list of installed antivirus software from the victim’s system.

Metamorfo has configured persistence to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.

Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.