^[1]

^[1]

^[1]

SysUpdate has used DNS TXT requests as for its C2 communication.^[2]

SysUpdate can use a Registry Run key to establish persistence.^[1]

SysUpdate can copy a script to the user owned/usr/lib/systemd/system/ directory with a symlink mapped to aroot owned directory,/etc/ystem/system, in the unit configuration file'sExecStart directive to establish persistence and elevate privileges.^[2]

SysUpdate can create a service to establish persistence.^[1]

SysUpdate has used Base64 to encode its C2 traffic.^[2]

SysUpdate can collect information and files from a compromised host.^[2]

SysUpdate can deobfuscate packed binaries in memory.^[1]

SysUpdate has used DES to encrypt all C2 communications.^[2]

SysUpdate has exfiltrated data over its C2 channel.^[2]

SysUpdate can search files on a compromised host.^[1][2]

SysUpdate has the ability to set file attributes to hidden.^[1]

SysUpdate can load DLLs through vulnerable legitimate executables.^[1]

SysUpdate can delete its configuration file from the targeted system.^[1]

SysUpdate has the ability to download files to a compromised host.^[1][2]

SysUpdate can collect a system's drive information.^[1][2]

SysUpdate has named their unit configuration file similarly to other unit files residing in the same directory,/usr/lib/systemd/system/, to appear benign.^[2]

SysUpdate can write its configuration file toSoftware\Classes\scConfig in eitherHKEY_LOCAL_MACHINE orHKEY_CURRENT_USER.^[1]

SysUpdate can call theGetNetworkParams API as part of its C2 establishment process.^[2]

SysUpdate has been packed with VMProtect.^[1][2]

SysUpdate can store its encoded configuration file withinSoftware\Classes\scConfig in eitherHKEY_LOCAL_MACHINE orHKEY_CURRENT_USER.^[1]

SysUpdate can encrypt and encode its configuration file.^[1]

SysUpdate can collect information about running processes.^[2]

SysUpdate has the ability to capture screenshots.^[1]

SysUpdate has been signed with stolen digital certificates.^[2]

SysUpdate can collect a system's architecture, operating system version, and hostname.^[1][2]

SysUpdate can collected the IP address and domain name of a compromised host.^[2]

SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.^[2]

SysUpdate can collect the username from a compromised host.^[2]

SysUpdate can collect a list of services on a victim machine.^[2]

SysUpdate can manage services and processes.^[1]

SysUpdate can use WMI for execution on a compromised host.^[1]

^[1]