After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers. TEARDROP and BEACON Malware Used . Multiple SUNBURST samples have been recovered, delivering different payloads. Next it checks that HKU\SOFTWARE\Microsoft\CTF exists, decodes an embedded payload using a custom rolling XOR algorithm and manually loads into memory an embedded payload using a custom PE-like file format. The credentials used for lateral movement were always different from those used for remote access. Detection Opportunity . Organizations can use HX’s LogonTracker module to graph all logon activity and analyze systems displaying a one-to-many relationship between source systems and accounts. After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer and execute files, profile the system, and disable system services. The userID is encoded via a custom XOR scheme after the MD5 is calculated. Commands are extracted from HTTP response bodies by searching for HEX strings using the following regular expression: "\{[0-9a-f-]{36}\}"||"[0-9a-f]{32}"||"[0-9a-f]{16}". Command data is spread across multiple strings that are disguised as GUID and HEX strings. The extracted message is single-byte XOR decoded using the first byte of the message, and this is then DEFLATE decompressed