Loading malware…
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled... The SharpPick idea, meaning to launch powershell scripts from within C# assembly by the use of Runspaces
-p <name>, --pipe <name> - Read powershell commands from a specified named pipe... The associated aggressor script leverages internal Beacon routines to write to a randomly named pipe
-n, --nocleanup - Don’t remove CLM disable leftovers (DLL files in TEMP and COM registry keys).
This program provides functionality to decode passed parameters on the fly, using Xor single-byte decode... Both command and script can be further encoded using single-byte XOR (will produce output Base64 encoded) for better OpSec experience.
if compiled with .NET Framework 4.7.1+ an additional functionality is included that allows to unload DLLs constituting CLM bypass artefacts and attempts to delete them afterwards
the code that ran in explorer.exe, outlook.exe, svchost.exe, and taskhostw.exe executed instances of the werfault.exe process and injected the following tools into the instances: SharpView ... Rubeus ... Stracciatella ... Seatbelt ... PowerShellRunner ... SharpChromium
-n, --nocleanup - Don’t remove CLM disable leftovers (DLL files in TEMP and COM registry keys).
Before launching any command, it makes sure to disable AMSI using two approaches and ETW... Before launching any command, it makes sure to disable Script Block logging using two approaches
launch it on a remote machine (2) thus having option for lateral movement over named pipe with a litle help of Stracciatella.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.