PyMicropsia

The malware is typically delivered through archive files or weaponized Office documents on Palestinian matters, written in English or Arabic.

Executing commands... allowing the operators very flexible execution of commands such as download and execution of payloads from a given URL, process execution, etc.

Persistence in this malware sample can be achieved via regular methods, such as setting up registry keys... This payload is named “SynLocSynMomentum.exe”... It sets up persistence via the shortcut .lnk copied to the startup menu.

They often do this by creating a shortcut to the malware in the AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup directory.

Persistence in this malware sample can be achieved via regular methods, such as setting up registry keys... This payload is named “SynLocSynMomentum.exe”... It sets up persistence via the shortcut .lnk copied to the startup menu.

They often do this by creating a shortcut to the malware in the AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup directory.

Deleting files... Eeyore Delete Firefox profiles and de-register device.

The sample implements keylogging capabilities using the GetAsyncKeyState API method.

Most samples are found to have a combination of the following features: ... Extract and upload stored credentials

Rapunzel Steal and upload browser credentials to C2.

Mulan Collect and upload process list.

Mulan Collect and upload process list... InfoCinder Collect and upload information regarding drives in the system.

Collecting file listing information... There are generic methods to collect specific folders and with different levels of information detailed

Collecting information from USB drives, including file exfiltration.

Collecting information from USB drives, including file exfiltration.

The sample implements keylogging capabilities using the GetAsyncKeyState API method.

Screenshots are sent to the C2 using Python’s mss library both periodically as well as on demand if the C2 operator sends the appropriate command.

Audio recording is achieved with the usage of the pyaudio and wave Python libraries.

one of the tactics, techniques and procedures (TTPs) observed across MICROPSIA samples is the use of rar.exe to compress data for exfiltration. In this version, rar.exe is downloaded from the C2 infrastructure and used with very similar parameters as observed in previous samples

Use Base64 to obfuscate command and control communications

Some Primewire samples utilize “multipart/form-data” for command and control check-ins... other samples combine the C2 parameters into a single “application/x-www-form-urlencoded” POST body.

PyMICROPSIA implements a simple HTTP POST-based C2 protocol, using different Uniform Resource Identifier (URI) paths and variables during the communication depending on the functionality invoked.

During the C2 interactions, PyMICROPSIA downloads two additional samples that are dropped and executed on the victim’s system, running additional functionality.

File uploads are performed via POST request to the following path: /zoailloaze/sfuxmiibif/hortense1

Collecting process information and killing processes... Killing and disabling Outlook process.