SVCReady can communicate with its C2 servers via HTTP.^[1]

SVCReady has used VBA macros to execute shellcode.^[1]

SVCReady can collect data from an infected host.^[1]

SVCReady has created theHKEY_CURRENT_USER\Software\Classes\CLSID\{E6D34FFC-AD32-4d6a-934C-D387FA873A19} Registry key for persistence.^[1]

SVCReady can send collected data in JSON format to its C2 server.^[1]

SVCReady has the ability to download additional tools such as the RedLine Stealer to an infected host.^[1]

SVCReady has named a taskRecoveryExTask as part of its persistence activity.^[1]

SVCReady can use Windows API calls to gather information from an infected host.^[1]

SVCReady can encrypt victim data with an RC4 cipher.^[1]

SVCReady can check for the number of devices plugged into an infected host.^[1]

SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.^[1]

SVCReady can collect a list of running processes from an infected host.^[1]

SVCReady can search for theHKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System Registry key to gather system information.^[1]

SVCReady can create a scheduled task namedRecoveryExTask to gain persistence.^[1]

SVCReady can take a screenshot from an infected host.^[1]

SVCReady can collect a list of installed software from an infected host.^[1]

SVCReady has usedrundll32.exe for execution.^[1]

SVCReady has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use ofsysteminfo.exe.^[1]

SVCReady can collect the username from an infected host.^[1]

SVCReady can collect time zone information.^[1]

SVCReady has relied on users clicking a malicious attachment delivered through spearphishing.^[1]

SVCReady has the ability to determine if its runtime environment is virtualized.^[1]

SVCReady can enter a sleep stage for 30 minutes to evade detection.^[1]

SVCReady can useWMI queries to detect the presence of a virtual machine environment.^[1]