CryptoClippy Speaks Portuguese

MITRE Techniques

• [T1189] Drive-by Compromise – Delivery via malvertising leading Portuguese-speaking users to attacker domains; “SEO poisoning … threat actor-controlled domain.”
• [T1059.001] PowerShell – Stage 1/Stage 2 loaders executed via obfuscated PowerShell scripts (e.g., “The first PowerShell script loader … The Ricoly.ps1 script’s purpose is to decrypt the second-stage obfuscated/encrypted script ps.”).
• [T1055] Process Injection – Loader injects its stealer into svchost.exe; “inject its stealer component into svchost.exe.”
• [T1027] Obfuscated/Compressed Files and Information – Use of obfuscated/encrypted payloads and encoded payloads; “obfuscated PowerShell scripts and encoded payloads.”
• [T1047] Windows Management Instrumentation – Script contains elements of WMI; “This script contains elements of Windows Management Instrumentation (WMI).”
• [T1021.001] Remote Services – RDP backdoor established via RC4-encrypted PowerShell script; “Remote Desktop Protocol (RDP) backdoor …”
• [T1053] Scheduled Task – Persistence via scheduled task execution (e.g., “gains persistence by creating a scheduled task.”).
• [T1112] Modify Registry – Registry modifications related to terminal services; “registry modifications of terminal services.”
• [T1136] Create Account – Local account creation as part of backdoor/persistence; “local account creation.”
• [T1056] Input Capture – Clipboard monitoring and manipulation via SetWinEventHook and clipboard APIs; “setup event hooks … clipboard data.”
• [T1071.001] Web Protocols – C2 communications over web protocols; “communicate with C2 servers.”
• [T1564.001] Hide Artifacts: Hide Artifacts/Obfuscated Files – Anti-analysis and obfuscation to evade detection; “obfuscated PowerShell scripts and encoded payloads.”