QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: 
The TwoFace payload shell requires a password that is sent within HTTP POST data or within the HTTP Cookie, specifically with a field with a name “pwd”. The “pwd” field is used for authentication as a password, which the payload will generate the SHA1 hash and compare it with a hash that is hardcoded within the payload. We extracted the SHA1 hashes used for authentication from the known TwoFace shells, as seen in Table 4 and were able to find the associated password string for three of them. One of the passwords, “RamdanAlKarim12” contains a phrase that means “Ramadan the generous” in Arabic (رمضان الكريم). Another known password is “FreeMe!”, while the last known password contains what may be an acronym of a middle eastern energy organization followed by “pass”. It is possible that the actor chose this acronym based on the targeted organization, but we cannot confirm this.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: 
The platform is started by the kernel mode driver component (“msndsrv.sys” on Windows 2000 or above and “mssvc32.vxd” on Windows 9x). The driver then waits for the system to start and initiates execution of the user-mode loader “mscfg32.exe”. The loader then starts the platform’s central module (an orchestrator) from the “mscfg32.dll” module. Additional drivers and libraries may be loaded by different components of the platform, either built-in or auxiliary.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
- T1106: Native API
Threat description: 
If an encrypted command arrives from the C&C, it is decrypted using RC4. The source domain name is used as the decryption key. Once the C&C command has been executed, a [Tasks] section will be created in config.ini; this is a logall actions performed by the bot.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1027: Obfuscated Files or Information
- T1573: Encrypted Channel
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: 
The following figure shows the content of the downloaded shell script sh. Upon execution, the sh script downloads different architectures of DDoS bot, and runs the downloaded binaries. None of the malwares was available on Virustotal at the time of our discovery, however many of them were uploaded to Virustotal not long after. More and more attack traffic are being detected at the time of writing, indicating that many devices are probably infected already.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1059.004: Command and Scripting Interpreter - Unix Shell
- T1587.001: Develop Capabilities - Malware
Threat description: 
While we do not have telemetry showing how the CASHY200 PowerShell backdoor was delivered, in September 2019 we observed a host based in Kuwait beaconing to the windows64x[.]com domain using the same DNS tunneling protocol as the CASHY200 payload. Fortunately, the beaconing to this domain was blocked by our DNS security service, so the adversary was no longer able to communicate with their payload using this DNS tunnel. By analyzing the lineage of this tool, we found that actors may have used CASHY200 when targeting Kuwait government organizations starting in the spring of 2018 and continuing throughout 2019, according to our open source collection efforts.
MITRE ATT&CK techniques:
- T1572: Protocol Tunneling
- T1071: Application Layer Protocol
- T1071.004: Application Layer Protocol - DNS
Threat description: 
The very first stage of the implant’s code is a custom loader written by APT3, which extracts an encrypted version of DoublePulsar code from incoming SMB packets, and decrypts and executes it. This is in fact a self-modifying piece of code, i.e. before it actually handles any of the aforementioned functionalities, it must decrypt subsequent parts of itself. The code is wrapped in 2 layers using simple crypters, so the first crypter decodes the second, and the latter decodes the actual loader code.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1027: Obfuscated Files or Information
- T1105: Ingress Tool Transfer
- T1027.002: Obfuscated Files or Information - Software Packing
- T1620: Reflective Code Loading
- T1587.001: Develop Capabilities - Malware
Threat description: 
In March 2017, Kasperksy released a report that compared DROPSHOT (which they call Stonedrill) with the most recent variant of SHAMOON (referred to as Shamoon 2.0). They stated that both wipers employ anti-emulation techniques and were used to target organizations in Saudi Arabia, but also mentioned several differences. For example, they stated DROPSHOT uses more advanced anti-emulation techniques, utilizes external scripts for self-deletion, and uses memory injection versus external drivers for deployment. Kaspersky also noted the difference in resource language sections: SHAMOON embeds Arabic-Yemen language resources while DROPSHOT embeds Farsi (Persian) language resources.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
- T1587.001: Develop Capabilities - Malware
Threat description: 
This is another aspect that has stayed unmodified in GandCrab 2. Once the information collection phase is over, GandCrab moves to terminate a wide range of processes that might be running on the victim machine and might be holding write access to files. This technique has been previously documented as a part of the Cerber ransomware, and prevents a scenario where GandCrab will attempt to encrypt a file and fail to obtain write access to the file because it is already open in another application. Process termination is done by the standard method of invoking the CreateToolhelp32Snapshot windows API and then iterating over the processes with Process32First and Process32Next. The list shares enough common processes with the one used by Cerber that it’s probable to assume the list was based on the one used in Cerber originally. The list of targeted processes is constant throughout both versions of GandCrab:
MITRE ATT&CK techniques:
- T1057: Process Discovery
- T1106: Native API
Threat description: 
Some malicious documents that we managed to retrieve contained a social engineering banner asking users to enable macros execution. This explains how the malicious logic from the macro-based delivery chain could actually be triggered when macros are disabled by default on most modern Office settings.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1204: User Execution
Threat description: 
Figure 6 shows our testing of the download command within RGDoor, specifically a command “download$c:\windows\temp\test.txt” that downloads the file uploaded in our previous test. We chose to use the key “89” (0x89) in this test to showcase RGDoor’s ability to use any hexadecimal byte as a key, which resulted in an encoded command string of “7eb+5+Xm6O2t6rPV/uDn7eb++tX97OT51f3s+v2n/fH9”. RGDoor responds to this command with the encoded string “/ez6/eDn7ri7uoM=”, which when decrypted with the “89” key results in the string ‘testing123\n’, which is the contents of the “test.txt” file.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1140: Deobfuscate/Decode Files or Information
- T1132: Data Encoding
Threat description: 
To gather credentials and facilitate lateral movement, ransomware deployment, the operators used PowerShell to recursively search the file system for logon credentials stored in text files and spreadsheets. The PowerShell tool "SessionGopher", capable of extracting session information from remote access tools, such as WinSCP, PuTTY, FileZilla and more, was also used enabling RDP and the Microsoft Sysinternals utility PsExec to allow lateral movement.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
- T1555: Credentials from Password Stores
- T1021.001: Remote Services - Remote Desktop Protocol
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1021: Remote Services
- T1005: Data from Local System
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: 
During the execution of subsequent instructions, a call to the 0x10001D9A function is made. This function has a loop located at offset 0x10001E4D and performs several operations. One of these operations is a 1-byte XOR instruction (xor byte ptr [esi+ecx], al) located at offset 0x10001E4D. Its purpose is to decrypt a total of 110591 bytes of the executable’s resource data where the PE binary data is stored. The final result is an in-memory reconstructed executable file. In Figure 19, the encrypted and decrypted data in the process’s memory can be seen.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
The path configured in the VNC configuration file across all implants employing VNC (UltraVNC.ini) is “Y:\ПРОБА\Создание троянов\создание RMS\vnc”. This isn’t the only place hardcoded Cyrillic file paths are used by implants. Many of the batch scripts also use hardcoded paths such as “Главное меню\Программы\Автозагрузка”. Many payloads also include a VBS script which raises a dialog box to the users asking them to run the malware again. It reads, “Ошибка при инициализации приложения (0xc0000005). Повторить попытку открытия файла?” (English Translation from Russian: Application failed to initialize (0xc0000005). Try to open the file again?).
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: 
Malicious macros already embedded, ready to execute. Malicious macro downloaded as part of an externally linked template that is then injected into the original lure maldoc.
MITRE ATT&CK techniques:
- T1027.009: Obfuscated Files or Information - Embedded Payloads
Threat description: 
The lure documents captured in this attack are in Yiddish[1] The attackers exploit office with OLE autolink objects (CVE-2017-0199) to embed the documents onto malicious websites. All the exploits and malicious payload were uploaded through remote servers. [1]The language is automatically identified by Google Translate  _Notification in the pop-up window: _ Links to this document may reference other files. Do you want to update this document with the data in the linked file? Once victims opened the lure document, Word will firstly visit a remote website of IE vbscript 0day (CVE-2018-8174) to trigger the exploit. Afterwards, Shellcode will be running to send several requests to get payload from remote servers. The payload will then be decrypted for further attack. While the payload is running, Word will release three DLL backdoors locally. The backdoors will be installed and executed through PowerShell and rundll32. UAC bypass was used in this process, as well as file steganography and memory reflection uploading, in order to bypass traffic detection and to complete loading without any files. The main process of the attack is shown in the following figure:
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1140: Deobfuscate/Decode Files or Information
- T1059: Command and Scripting Interpreter
- T1027: Obfuscated Files or Information
- T1102: Web Service
- T1204.002: User Execution - Malicious File
- T1036: Masquerading
- T1204: User Execution
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1204.001: User Execution - Malicious Link
- T1218.011: System Binary Proxy Execution - Rundll32
- T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control
Threat description: 
An actor successfully tested China Chopper on a second server and stopped the activity. However, we also found another Monero cryptocurrency miner just as we found commodity malware on other systems compromised with China Chopper. The actors first reset the Access Control List for the Windows temporary files folder and take ownership of the folder. They then allow the miner executable through the Windows Firewall and finally launch the mining payload.
MITRE ATT&CK techniques:
- T1562.004: Impair Defenses - Disable or Modify System Firewall
- T1496: Resource Hijacking
- T1222.001: File and Directory Permissions Modification - Windows File and Directory Permissions Modification
Threat description: 
This “transfer” decryption routine returns a URL that is concatenated with the other variables, resulting in”hXXp://www.hotinfonews.com/news/dailynews2.php?id=&t=win”. It is this content that is written to disk and executed on the victim’s machine. A description of that downloader follows. It is most interesting that this exploit/php combination’s encryption routine is different from the obfuscation commonly used throughout Red October modules. It further suggests that potentially this limited use package was developed separately from the rest for a specific target.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
Throughout January 2020, FireEye has continued to observe multiple targeted phishing campaigns designed to download and deploy a backdoor we track as MINEBRIDGE. The campaigns primarily targeted financial services organizations in the United States, though targeting is likely more widespread than those we’ve initially observed in our FireEye product telemetry. At least one campaign targeted South Korean organizations, including a marketing agency.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1598.003: Phishing for Information - Spearphishing Link
- T1566.002: Phishing - Spearphishing Link
Threat description: 
To enable lateral movement, the adversary uses ping and nslookup commands, in addition to scanning the environment for Windows systems listening on port 445. This is done using a simple port scanning binary unique to PROPHET SPIDER, typically named pscan or pscan2. For example, process logging may reveal similar commands to the below. Note the commands are executed by the oracle user account, which is the user that runs WebLogic. In multiple PROPHET SPIDER cases, CrowdStrike observed a reverse shell binary located at /var/tmp/[filename], which launches bash as a child; and the pscan2 command is a child to bash. The reverse shell is a child to PID 1, which indicates it was either executed via an init script created for persistence, or its parent was terminated causing it to become a zombie process that was reaped by the init daemon.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
- T1059: Command and Scripting Interpreter
- T1049: System Network Connections Discovery
- T1059.004: Command and Scripting Interpreter - Unix Shell
- T1046: Network Service Discovery
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: 
There are multiple web inject files. One contains all of the target URL and hostname data, and the second contains regex patterns, as well as the code to inject. These files are both RC4-encrypted and compressed.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
Exploitation of CVE-2016-0167 a Microsoft Windows Privilege Escalation vulnerability to gain SYSTEM level privileges. Earlier versions of Shifu exploited CVE-2015-0003 to achieve the same goal. Use of a Windows atom to identify if the host is already infected with Shifu in addition to the mutex used by previous versions. Use of “push-calc-ret” API obfuscation to hide function calls from malware analysts. Use of alternative Namecoin .bit domains.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1106: Native API
Threat description: 
APT33 registered multiple domains that masquerade as Saudi Arabian aviation companies and Western organizations that together have partnerships to provide training, maintenance and support for Saudi’s military and commercial fleet. Based on observed targeting patterns, APT33 likely used these domains in spear phishing emails to target victim organizations.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
- T1566: Phishing
- T1583.001: Acquire Infrastructure - Domains
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1598: Phishing for Information
Threat description: 
Comnie Malware Family Comnie uses the RC4 algorithm in multiple locations both to obfuscate strings used by the malware, as well as for network communication. Additionally, the malware looks for multiple security products on victim machines and sometimes alters its behavior depending on the products present. More information about how Comnie handles identified security products may be found in the technical analysis in the Appendix. These security products included those that are known to be most widely used within South Korea and Taiwan. Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path. When originally run, Comnie will convert itself from an executable file to a DLL and will write this newly created DLL to the host machine’s %APPDATA% directory. The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file. Unit 42 has observed a total of two variants of Comnie. One of the ways the variants differ is in how they obtain their command and control (C2) information. Both variants make use of third-party online services in an attempt to prevent DNS based blocking of their first stage communications. However, the obfuscation mechanism varies slightly. In older variants, Comnie was found to look for the ‘++a++’ markers. The example C2s used by older variants of Comnie demonstrates this:
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
- T1104: Multi-Stage Channels
- T1057: Process Discovery
- T1518.001: Software Discovery - Security Software Discovery
- T1573: Encrypted Channel
- T1071.004: Application Layer Protocol - DNS
- T1071: Application Layer Protocol
- T1001: Data Obfuscation
Threat description: 
Capturing screenshots at a configurable interval and uploading them to the attacker. Downloading and executing additional files. Executing arbitrary commands on the system.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1113: Screen Capture
- T1041: Exfiltration Over C2 Channel
- T1005: Data from Local System
- T1119: Automated Collection
Threat description: 
UNC215 made technical modifications to their tools to limit outbound network traffic and used other victim networks to proxy their C2 instructions, likely to minimize the risk of detection and blend in with normal network traffic. The following are examples of HYPERBRO and FOCUSFJORD samples capable of acting as proxies to relay communications to their C2 servers. We do not have enough context about the following samples to attribute all of them to UNC215, though they are representative of activity we have seen from the group.
MITRE ATT&CK techniques:
- T1090: Proxy
- T1090.001: Proxy - Internal Proxy
- T1090.002: Proxy - External Proxy
- T1090.003: Proxy - Multi-hop Proxy
Threat description: 
Finally, the Phorpiex VNC worm executes several scripts on a victim’s machine by simulating keyboard input using VNC protocol. First it enters Win+R to open the “Run program” window. Then it “enters” the script contents by sending the corresponding VNC packets:
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1021.005: Remote Services - VNC
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: 
The end result is a legitimate, though outdated (version 11, compiled on September 17, 2018, at 10:30:12 UTC), TeamViewer instance hijacked by a malicious sideloaded DLL (MINEBRIDGE).
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1036: Masquerading
- T1574.002: Hijack Execution Flow - DLL Side-Loading
- T1219: Remote Access Software
- T1588.002: Obtain Capabilities - Tool
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: 
We observed previous, somewhat similar spearphishing scenarios with an archive containing .LNK, .docx, and base64 encoded executable code, delivering offensive Finfisher objects in separate intrusion activity clusters. This activity was not Sofacy, but the spearphishing techniques were somewhat similar – the layered powershell script attachment technique is not the same, but not altogether new.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: 
Zebrocy activity is a known subset of Sofacy activity. We predicted that they would continue to innovate within their malware development after observing past behavior, developing with Delphi, AutoIT, .Net C#, Powershell, and now “Go” languages. Their continued targeting, phishing techniques, infrastructure setup, technique and malware innovation, and previously known backdoors help provide strong confidence that this activity continues to be Zebrocy.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: 
As this is a NULL-Deref vulnerability, we can immediately rule out CVE-2017-0005, as the stack trace shown in Microsoft’s blog has nothing to do with the NULL page. This means that this is possibly another vulnerability found and exploited by Equation Group in 2013. With that out of the way, it is time to understand what triggers this NULL-Deref vulnerability.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1587.004: Develop Capabilities - Exploits
Threat description: 
The persistence is guaranteed by a method that is called when the program is closing. It checks if the malware directory exists as specified in an embedded configuration and then copies the malware executable inside it. It also creates a registry key under “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” to execute the worm automatically.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
- T1547: Boot or Logon Autostart Execution
Threat description: 
One of the maldocs disclosed here was referred to by a Bit.ly-shortened URL (created Jan. 23, 2020) — hxxp://bit[.]ly/iaf-guidelines — which redirects to hxxp://tecbeck[.]com/IAP39031[.]docx. It is highly likely that the attackers hosted the maldocs on a public server and distributed the direct or Bit.ly links to the targets in the form of spear-phishing emails. This may be done to bypass detection systems that scan email attachments for malware.
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
- T1566.002: Phishing - Spearphishing Link
Threat description: 
First, the module checks if it is running in a target process name and (if specified) by the target username. If the module or user names do not match, the thread terminates.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
- T1057: Process Discovery
- T1087: Account Discovery
- T1480: Execution Guardrails
Threat description: 
In one part of guide.txt, an example target appears to be provided, with a corresponding adversary IP (185.162.235[.]106) for the legitimate domain to be redirected to. Analysis of this IP provides several interesting data points, including possible relationships to previously observed OilRig infrastructure. Examining the hosting provider shows that the IP is associated with an Iranian hosting provider called NovinVPS. The autonomous system name of the IP shows that the allocation is controlled by Serverius Holding B.V., which is an autonomous system name we have previously seen associated with the OilRig group. In fact, examining the Class C IP block of 185.162.235[.]0/24 shows at least two other IPs we have previously identified as in use by the OilRig group for C2 servers. 185.162.235[.]29 and 185.162.235[.]121 and their associated domains, office365-management[.]com and msoffice-cdn[.]com respectively. Office365-management[.]com was first identified in October 2017 as a C2 servers for OilRig operations delivering the ISMInjector backdoor. Later in February 2018 we were able to link the entire grouping of infrastructure to another campaign delivering the OopsIE backdoor via the reuse of WHOIS registrant artifacts, shared SSL certificates, and a shared Class C IP block. Figure 17 shows the relationship between the files related to DNS hijacking and known infrastructure associated with OilRig.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: 
In total, we observed three variations of CMSTAR in these recent attacks against Belarusian targets. The biggest change observed between them looks to be minor modifications made to the string obfuscation routine. A very simple modification to the digit used in subtraction was modified between the variants, as shown below:
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1587.001: Develop Capabilities - Malware
Threat description: 
During the C2 interactions, PyMICROPSIA downloads two additional samples that are dropped and executed on the victim’s system, running additional functionality. These payloads are not Python / PyInstaller based.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
Another important conclusion we drew from analyzing the exploited vulnerability is that we now know for sure that EpMe exploits CVE-2017-0005. On top of our analysis of both the Equation Group and APT31 exploits, the EpMe exploit aligns perfectly with the details reported in Microsoft’s blog on CVE-2017-0005. And if that wasn’t enough, the exploit indeed stopped working after Microsoft’s March 2017 patch, the patch that addressed the said vulnerability.
MITRE ATT&CK techniques:
- T1587.004: Develop Capabilities - Exploits
- T1588.006: Obtain Capabilities - Vulnerabilities
- T1588.005: Obtain Capabilities - Exploits
- T1499.004: Endpoint Denial of Service - Application or System Exploitation
Threat description: 
But even more curious were the names of malicious drivers in this list, which if found could indicate that the target system has already been compromised by another attacker, and would then warn the operators to “pull back”. Another pivotal component in the Equation Group’s arsenal that is in charge of such checks is called “Territorial Dispute”, or “TeDi”.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
- T1082: System Information Discovery
- T1480: Execution Guardrails
Threat description: 
Here is the script hosted on Pastebin: Reflective loader downloaded from pastebin.com The script executes a hardcoded PE file located — Gandcrab —at the end of the script using a reflective DLL-loading technique. In addition to the ransomware, we identified another actor trying to execute a Monero miner on the vulnerable server with China Chopper:
MITRE ATT&CK techniques:
- T1102: Web Service
- T1620: Reflective Code Loading
Threat description: 
Then, it reads user-related info from the file sqlxmlx.inc in the same folder (we can see strings referencing to “UserID” commentary in this part of the code). But this file was never created. As you recall, there is a function that should have collected this data and should have saved it into this sqlxmlx.inc file. However, on the first launch, the collected user information is saved into “xmlrwbin.inc”. This effectively means that the malware writer mistakenly coded the bot to save user information into the wrong file. There is a chance for the mistaken code to still work — user information could be copied into the send information heap. But not in this case – at the time of writing, the gathered user information variable which should point to the xmlrwbin.inc filename has not yet been initialized, causing the file write to fail. We see that sqlxmlx.inc is not created to store user information.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
- T1119: Automated Collection
- T1074: Data Staged
- T1074.001: Data Staged - Local Data Staging
- T1087: Account Discovery
Threat description: 
The encrypted payload has a slightly lower entropy of 7.990713 out of 8. Looking at the embedded binary in a hex editor reveals multiple occurrences of the byte pattern 51 36 94 A4 26 5B 0F 19, as seen in Figure 4. As this pattern occurs multiple times in a row in the middle of the encrypted data and ECB mode is being used, an educated guess is that the plaintext is supposed to be 00 00 00 00 00 00 00 00.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
Figure 3 Portion of malicious macro responsible for compiling and executing embedded source code .
MITRE ATT&CK techniques:
- T1027.004: Obfuscated Files or Information - Compile After Delivery
Threat description: 
Of interest is the script file docker.container.local.spread.txt, which lists the name of a local Docker image, as shown in Figure 8. The Docker image is a local Docker image, meaning it is not hosted and downloaded from an external docker repository such as Docker Hub. Researchers did search Docker Hub for the presence of this Docker image and none were found.
MITRE ATT&CK techniques:
- T1610: Deploy Container
Threat description: 
This infection chain is based on a Windows shortcut file, with a misleading .docx.lnk double extension, and constitutes a more modular approach to PowerPepper delivery.
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1204.002: User Execution - Malicious File
- T1036.007: Masquerading - Double File Extension
Threat description: 
The NewsBeef APT previously engaged in long-term, elaborate social engineering schemes that take advantage of popular social network platforms. Previous analysis of the NewsBeef APT indicates that the group focuses on Saudi Arabian (SA) and Western targets, and lacks advanced offensive technology development capabilities.
MITRE ATT&CK techniques:
- T1585.001: Establish Accounts - Social Media Accounts
Threat description: 
The second functionality enabled in this sample that had not been observed in previous Thanos variants involved the ability to overwrite the master boot record (MBR). Once the code checks to see if the operating system version is not “Windows 10” or “Windows 8,” the code will attempt to open “\\.\PhysicalDrive0” and write a 512-byte string to offset 0. The byte array that is written to offset 0 of “\\.\PhysicalDrive0” initially has a ransom message of “Your files are encrypted. Contact us at: get-my-data@protonmail.com…”, but the code will replace this string with the following string before writing to disk:
MITRE ATT&CK techniques:
- T1485: Data Destruction
- T1561.002: Disk Wipe - Disk Structure Wipe
- T1082: System Information Discovery
Threat description: 
Tools such as XHide Process Faker, which can hide or change the name of Linux processes and PyInstaller, which can convert Python scripts into executables.
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1036: Masquerading
- T1027: Obfuscated Files or Information
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: 
We first discussed ShaggyPanther, a previously unseen malware and intrusion set targeting Taiwan and Malaysia, in a private report in January 2018. Related activities date back to more than a decade ago, with similar code maintaining compilation timestamps from 2004. Since then, ShaggyPanther activity has been detected in several more locations: most recently in Indonesia in July, and – somewhat surprisingly – in Syria in March. The newer 2018 and 2019 backdoor code maintains a new layer of obfuscation and no longer maintains clear-text C2 strings. Since our original release, we have identified an initial server-side infection vector from this actor, using SinoChopper/ChinaChopper, a commonly used web shell shared by multiple Chinese-speaking actors. SinoChopper not only performs host identification and backdoor delivery but also email archive theft and additional activity. Although not all incidents can be traced back to server-side exploitation, we did detect a couple of cases and obtained information about their staged install process. In 2019, we observed ShaggyPanther targeting Windows servers.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1505.003: Server Software Component - Web Shell
- T1048: Exfiltration Over Alternative Protocol
Threat description: 
The DEWMODE web shell (Figure 4) extracts a list of available files from a MySQL database on the FTA and lists those files and corresponding metadata—file ID, path, filename, uploader, and recipient—on an HTML page. UNC2546 then uses the presented list to download files through the DEWMODE web shell. Download requests are captured in the FTA’s web logs, which will contain requests to the DEWMODE web shell with encrypted and encoded URL parameters, where dwn is the file path and fn is the requested file name (Figure 5). The encrypted file path and name values visible in web logs can be decrypted using key material obtained from the database used by the targeted FTA. Given the complex nature of this process, if your organization needs assistance reviewing relevant logs, please contact Mandiant or Accellion.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1505.003: Server Software Component - Web Shell
- T1573: Encrypted Channel
- T1005: Data from Local System
- T1119: Automated Collection
- T1074: Data Staged
- T1074.001: Data Staged - Local Data Staging
Threat description: 
Gather all system information using the "systeminfo" command and record to a file: cmd.exe /c systeminfo >>"%s" where %s = <file_path>.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1074.001: Data Staged - Local Data Staging
- T1074: Data Staged
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
- T1059: Command and Scripting Interpreter
Threat description: 
Interestingly, this IP address also had some associated domain names, as shown in the zoomed-in box as well, including letstrade-bit[.]com, lesbtc[.]com (and mail.lesbtc[.]com) and secure-trade24[.]com with the former two domains being registered December 20th and the latter on December 14th. All three domains mention trading or Bitcoins (BTC) but from the samples analysed, it is not clear how these subdomains are being used, however such terms are indicative of contemporary ransomware that requests ransom payments using BTC.
MITRE ATT&CK techniques:
- T1583.001: Acquire Infrastructure - Domains
Threat description: 
The module sets a timer with a callback function to be executed every 900 seconds and starts a Windows message loop.
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: 
We uncovered two new espionage backdoors associated with Operation Earth Kitsune: agfSpy and dneSpy. This post provides details about these malware types, including the relationship between them and their command and control (C&C) servers .
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: 
Agent ORM began circulating alongside Sekur in campaigns throughout the second half of 2015. The malware collects basic system information and is able to take screenshots of victim systems. It is used to download next-stage payloads when systems of interest are identified. It is strongly suspected that Agent ORM has been deprecated in favor of script-based first-stage implants (VB Flash, JS Flash, and Bateleur).
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1113: Screen Capture
- T1082: System Information Discovery
- T1119: Automated Collection
- T1059.005: Command and Scripting Interpreter - Visual Basic
- T1059.007: Command and Scripting Interpreter - JavaScript
- T1005: Data from Local System
Threat description: 
The second stage of the attack is downloaded from “http://www.hotinfonews.com/news/dailynews2.php”and executed by the payload of the Java exploit. It acts as a downloader for the next stage of the attack.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1203: Exploitation for Client Execution
Threat description: 
During our analysis, we identified follow on POST requests containing screenshots of the compromised desktop and process activity lists which were encrypted and appended to a false JPEG header as described previously.
MITRE ATT&CK techniques:
- T1113: Screen Capture
- T1140: Deobfuscate/Decode Files or Information
- T1057: Process Discovery
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: 
One such self-extracting archive (ca87eb1a21c6d4ffd782b225b178ba65463f73de6f4c736eb135be5864f556dc) was first observed around April of 2014.  The password (reused by many of the password protected SFX payloads) it used to extract itself is “1234567890__”. The files included in this SFX file we observed include a batch file named “123.cmd” and another SFX named “setting.exe”. This second SFX contains a .MSI installer package which installs Remote Manipulator System and a batch script which handles the installation.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1027: Obfuscated Files or Information
- T1059: Command and Scripting Interpreter
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: 
Zebrocy has continued adding new tools to its arsenal using various kinds of programming languages. We found Zebrocy deploying a compiled Python script, which we call PythocyDbg, within a Southeast Asian foreign affairs organization. This module primarily provides for the stealthy collection of network proxy and communications debug capabilities. In early 2019, Zebrocy shifted its development efforts with the use of Nimrod/Nim, a programming language with syntax resembling both Pascal and Python that can be compiled down to JavaScript or C targets. Both the Nim downloaders that the group mainly uses for spear phishing, and other Nim backdoor code, are currently being produced by Zebrocy and delivered alongside updated compiled AutoIT scripts, Go, and Delphi modules. In September, Zebrocy spear-phished multiple NATO and alliance partners throughout Europe, attempting to gain access to email communications, credentials and sensitive documents. This campaign is similar to past Zebrocy activity, with target-relevant content used within emails, and ZIP attachments containing harmless documents alongside executables with altered icons and identical filenames. The group also makes use of remote Word templates pulling contents from the legitimate Dropbox file-sharing site. In this campaign, Zebrocy targeted defense and diplomatic targets located throughout Europe and Asia with its Go backdoor and Nimcy variants.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
- T1036: Masquerading
- T1119: Automated Collection
- T1204: User Execution
- T1587.001: Develop Capabilities - Malware
- T1204.002: User Execution - Malicious File
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1059.006: Command and Scripting Interpreter - Python
- T1027.009: Obfuscated Files or Information - Embedded Payloads
- T1027.002: Obfuscated Files or Information - Software Packing
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: 
Cardinal RAT is deployed using an interesting technique of compiling and executing a downloader via a malicious macro embedded within a Microsoft Excel file. The Excel files themselves contain lures that have financial themes. This threat has had a low volume of samples in the past two years, with 11 instances of Carp Downloader and 27 instances of Cardinal RAT observed. Palo Alto Networks customers are protected by these threats in the following ways:
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1204: User Execution
- T1204.002: User Execution - Malicious File
- T1203: Exploitation for Client Execution
Threat description: 
The ability to launch a .exe or .dll file in memory. The ability to leverage schtasks.exe to add or modify task schedules. The ability to launch custom PowerShell commands. The ability to leverage a standalone executable to load the DLL if the attacker otherwise has no way of doing so.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1053: Scheduled Task/Job
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
The evolution of the reflective DLL injection technique can be found from the relevant PDB paths, and there are a lot of variants of this series of backdoors.
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1055.001: Process Injection - Dynamic-link Library Injection
- T1620: Reflective Code Loading
Threat description: 
In June of 2015 a custom downloader used by many newer samples was first seen in the wild and is often included in SFX implants with the name “LocalSMS.dll”. This downloader makes requests to adobe.update-service[.]net (hardcoded in the sample) and is further discussed in Appendix A.
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1027.002: Obfuscated Files or Information - Software Packing
- T1105: Ingress Tool Transfer
Threat description: 
After the execution of qnxfhfim.cmdline, PowerShell initiated the first connection to the fronted domain lumiahelptipsmscdnqa[.]microsoft[.]com used by SMOKEDHAM.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
During the course of our investigations, we noticed that the PowerPepper C2 name servers were actually open DNS resolvers that always resolved arbitrary hostnames with the same IP addresses: 128.49.4.4 (a US Navy-owned server), 91.214.6.100 and 91.214.6.101 (HSBC UK-owned servers). Using this fact and historical reverse DNS resolutions data, we have been able to preemptively identify the PowerPepper C2 domains.
MITRE ATT&CK techniques:
- T1583.002: Acquire Infrastructure - DNS Server
Threat description: 
The global reach of the January 2017 campaign which we analyzed in this post is a marked departure from previous Dimnie targeting tactics. Multiple factors have contributed to Dimnie’s relatively long-lived existence. By masking upload and download network traffic as innocuous user activity, Dimnie has taken advantage of defenders’ assumptions about what normal traffic looks like. This blending in tactic, combined with a prior penchant for targeting systems used by Russian speakers, likely allowed Dimnie to remain relatively unknown.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1132: Data Encoding
- T1027: Obfuscated Files or Information
Threat description: 
The main Trojan body is encrypted “XOR 0xDE” and stored as hex text inside the RTF file. The shellcode simply writes the main dropper to a file named “msmx21.exe” in the %TEMP% folder and runs it. It also extracts a fake document which is shown to the victim if the exploit has been successful.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1027: Obfuscated Files or Information
- T1036: Masquerading
Threat description: 
BokBot has several executable modules that can be downloaded and injected into a svchost.exe child process. Once the relevant DAT file is decoded using RC4, no additional decoding or decompression is necessary for the executable module DAT files. The executable module header contains information necessary to ID the module:
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1055.003: Process Injection - Thread Execution Hijacking
Threat description: 
Vesta Control Panel command injection is one of the several newly included exploits. The version released on May 18 also included Python versions of EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147) exploits with a Windows download command line as the payload. The addition of new exploits shows that the actor is actively developing new methods of spreading and following the latest vulnerabilities with published PoCs. In the newest instances discovered on May 22, the bot improved its ability to supply credentials for SMB but excluded it from the main exploit function. The usernames and passwords are now in a separate two arrays and extended to include many other usernames and passwords. The exploitation function of this sample does not contain EternalBlue and EternalRomance but attempts to connect over SMB (port 445) and create a service remotely to download and run the main bot file. This latest sample is a pyinstaller-generated sample but is PE file rather than ELF, which was seen previously.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
- T1203: Exploitation for Client Execution
- T1210: Exploitation of Remote Services
- T1059: Command and Scripting Interpreter
- T1021: Remote Services
- T1570: Lateral Tool Transfer
- T1021.002: Remote Services - SMB/Windows Admin Shares
- T1543.003: Create or Modify System Process - Windows Service
Threat description: 
This Zip archive contained a file named [redacted]-ITsoftwareUpdate.exe (SHA256: 5f42deb792d8d6f347c58ddbf634a673b3e870ed9977fdd88760e38088cd7336), which is a variant of the OopsIE Trojan we described in detail in a blog we published in September 2018. This suggests that the server displayed in the VPS control panel may have indeed been in use by the OilRig threat actors at the time of attack. In addition, two of the other IPs listed in this panel, 185.161.209[.]57 and 185.161.210[.]25 are in the same 185.161.208[.]0/22 range as an IP associated with the DNSpionage campaign, 185.161.211[.]72. This is a tenuous relationship at best and does not indicate that the OilRig group is the one executing the DNSpionage campaign, but with the combination of the use of DeltaHost and IPs belonging to a fairly small range, there may be reason to believe that these are related to some extent.
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
- T1036: Masquerading
Threat description: 
12. Execute the exported function “updater” within “MSO1234.win” using rundll32.exe .
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: 
The decrypted payload belongs to the malware family POISONPLUG (MD5: 84b69b5d14ba5c5c9258370c9505438f). POISONPLUG is a highly obfuscated modular backdoor with plug-in capabilities. The malware is capable of registry or service persistence, self-removal, plug-in execution, and network connection forwarding. POISONPLUG has been observed using social platforms to host encoded command and control commands.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
- T1112: Modify Registry
- T1543.003: Create or Modify System Process - Windows Service
- T1070.004: Indicator Removal - File Deletion
- T1569.002: System Services - Service Execution
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
This new version was dubbed “GandCrab 2” by the infosec community. However, upon closer inspection of the ‘version’ string embedded into GandCrab’s C&C check-in, you can see that the gang uses their own nomenclature: the really early versions are 1.1, the later versions go up to 2.1, the first versions of GandCrab 2 were  1.0.0r and the latest version is kto_zaskrinit_tot_pidor (a colorful Russian snarl, aimed at the people who see the version string and reach for their PrintScreen key).
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: 
Another sample discovered in late August 2021 consisted of the C2 host URI xxx[.]xxxx[.]tk and the host header setting configured to point to test[.]softlemon[.]net.
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols