Both variants build their API imports dynamically using GetProcAddress, including wtsapi32.dll for gathering user and domain names for any active remote sessions - Both variants contain a variety of functionalities based on command IDs issued by the control servers - Common capabilities of both malware: Listing files in directory Creating arbitrary processes Writing data received from control servers to files on disk Gathering information for all drives Gathering process times for all processes Sending the contents of a specific file to the control server Wiping and deleting files on disk Setting the current working directory for the implant Sending disk space information to the control server - Listing files in directory - Creating arbitrary processes - Writing data received from control servers to files on disk - Gathering information for all drives - Gathering process times for all processes - Sending the contents of a specific file to the control server - Wiping and deleting files on disk - Setting the current working directory for the implant - Sending disk space information to the control server - Both variants use a batch file mechanism to delete their binaries from the system - Both variants run commands on the system, log output to a temporary file, and send the contents of the file to their control servers