ESET Zebrocy Nov 2018

Zebrocy gets the username from the system.

Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.

Zebrocy has a command to delete files and directories.

Zebrocy uses HTTP for C2.

Zebrocy uses SMTP and POP3 for C2.

Zebrocy stores all collected information in a single file before exfiltration.

Zebrocy collects the OS version and computer name. Zebrocy also runs the systeminfo command to gather system information.

Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the echo %APPDATA% command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.

A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.

Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.

Zebrocy gathers the current time zone and date information from the system.

Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.

Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.

Zebrocy has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.

Zebrocy uses SSL and AES ECB for encrypting C2 communications.

Zebrocy collects the serial number for the storage volume C:\.