Aveo

1 : Execute command in interactive shell

Aveo proceeds to set the following registry key to point towards the malware’s path, thus ensuring persistence across reboots: HKCU\software\microsoft\windows\currentversion\run\msnetbridge

Aveo proceeds to set the following registry key to point towards the malware’s path, thus ensuring persistence across reboots: HKCU\software\microsoft\windows\currentversion\run\msnetbridge

Aveo is disguised as a Microsoft Excel document, and drops a decoy document upon execution.

While the Aveo malware family awaits a response, it will perform sleep delays of randomly chosen intervals between 0 and 3276 milliseconds. Should the C2 server respond with ‘toyota’, it will set that interval to 60 seconds.

After the installation routine completes, Aveo will exfiltrate the following victim information to a remote server via HTTP. Unique victim hash IP Address Microsoft Windows version Username ANSI code page identifier

Aveo accepts the following commands, shown with their associated function. 2 : Get file attributes 4 : Read file 5 : List drives 6 : Execute DIR command against path

While the Aveo malware family awaits a response, it will perform sleep delays of randomly chosen intervals between 0 and 3276 milliseconds. Should the C2 server respond with ‘toyota’, it will set that interval to 60 seconds.

Aveo accepts the following commands, shown with their associated function. 3 : Write file 4 : Read file

The executable is in fact a WinRAR self-extracting executable file, which will drop the decoy document and Aveo Trojan upon execution.

To encrypt the provided data, the malware makes use of the RC4 algorithm, using a key of ‘hello’.

The Aveo Trojan is configured to communicate with the following domain name over HTTP.

Using a self-extracting WinRAR file, the malware drops a decoy document, a copy of the Aveo malware, and a cleanup script.

After the installation routine completes, Aveo will exfiltrate the following victim information to a remote server via HTTP.