^[1]

^[1]

^[1]

Gelsemium can bypass UAC to elevate process privileges on a compromised host.^[1]

Gelsemium can use token manipulation to bypass UAC on Windows7 systems.^[1]

Gelsemium can use HTTP/S in C2 communications.^[1]

Gelsemium has the ability to use DNS in communication with C2.^[1]

Gelsemium can set persistence with a Registry run key.^[1]

Gelsemium can drop itself inC:\Windows\System32\spool\prtprocs\x64\winprint.dll to be loaded automatically by the spoolsv Windows service.^[1]

Gelsemium can use a batch script to delete itself.^[1]

Gelsemium can drop itself inC:\Windows\System32\spool\prtprocs\x64\winprint.dll as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.^[1]

Gelsemium can collect data from a compromised host.^[1]

Gelsemium can decompress and decrypt DLLs and shellcode.^[1]

Gelsemium can use dynamic DNS domain names in C2.^[1]

Gelsemium can use multiple domains and protocols in C2.^[1]

Gelsemium can retrieve data from specific Windows directories, as well as open random files as part ofVirtualization/Sandbox Evasion.^[1]

Gelsemium can delete its dropper component from the targeted system.^[1]

Gelsemium has the ability to perform timestomping of files on targeted systems.^[1]

Gelsemium can download additional plug-ins to a compromised host.^[1]

Gelsemium can use theIARPUinstallerStringLauncher COM interface are part of its UAC bypass process.^[1]

Gelsemium has used unverified signatures on malicious DLLs.^[1]

Gelsemium has named malicious binariesserv.exe,winprint.dll, andchrome_elf.dll and has set its persistence in the Registry with the key valueChrome Update to appear legitimate.^[1]

Gelsemium can modify the Registry to store its components.^[1]

Gelsemium has the ability to use various Windows API functions to perform tasks.^[1]

Gelsemium has the ability to use TCP and UDP in C2 communications.^[1]

Gelsemium can store its components in the Registry.^[1]

Gelsemium has the ability to compress its components.^[1]

Gelsemium can use junk code to hide functions and evade detection.^[1]

Gelsemium can enumerate running processes.^[1]

Gelsemium has the ability to inject DLLs into specific processes.^[1]

Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.^[1]

Gelsemium can use custom shellcode to map embedded DLLs into memory.^[1]

Gelsemium can check for the presence of specific security products.^[1]

Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.^[1]

Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.^[1]

Gelsemium can use junk code to generate random activity to obscure malware behavior.^[1]