QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Several  malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another  malware sample XORs C2 traffic.  malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, evading SSL man-in-the-middle decryption attacks.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: Some  malware uses multiple channels for C2, such as RomeoWhiskey-Two, which consists of a RAT channel that parses data in datagram form and a Proxy channel that forms virtual point-to-point sessions.
MITRE ATT&CK techniques:
- T1026: Multiband Communication
Threat description: Some  samples contain a publicly available Web browser password recovery tool.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Some  samples have a module to extract email from Microsoft Exchange servers using compromised credentials.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
- T1114: Email Collection
Threat description: Some  samples use AES to encrypt C2 traffic.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: Some  variants use HTTP for C2.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Some versions of  have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: spearphished victims via Facebook and Whatsapp.
MITRE ATT&CK techniques:
- T1566.003: Phishing - Spearphishing via Service
Threat description: stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: steals credentials from compromised hosts. 's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by  include ones associated with The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, Internet Explorer, Microsoft Outlook, WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: steals credentials from its victims.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: steals credentials stored in Web browsers by querying the sqlite database and leveraging the Windows Vault mechanism.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: The "tDiscoverer" variant of  establishes a C2 channel by downloading resources from Web services like Twitter and GitHub.  binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: The "Uploader" variant of  visits a hard-coded server over HTTP/S to download the images  uses to receive commands.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: The "ZR" variant of  will check to see if known host-based firewalls are installed on the infected systems.  will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: The  C2 channel uses HTTP POST requests.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: The  client has been signed by fake and invalid digital certificates.
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: The  component KillDisk is capable of deleting Windows Event Logs.
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: The  crimeware toolkit has refined its detection of sandbox analysis environments by inspecting the process list and Registry.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: The discovery modules used with  can collect information on accounts and permissions.
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by  as a name for malware.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: The  group has used other forms of obfuscation, include commingling legitimate traffic with communications traffic so that network streams appear legitimate. Some malware that has been used by  also uses steganography to hide communication in PNG image files.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: The  malware communicates to its command server using HTTP with an encrypted payload.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: To establish persistence,  adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: To establish persistence,  identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1036: Masquerading
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: transfers files from the compromised host via HTTP or HTTPS to a C2 server.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: TRINITY malware used by  identifies payment card track data on the victim and then copies it to a local file in a subdirectory of C:\Windows\. Once the malware collects the data,  actors compressed data and moved it to another staging system before exfiltration.
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: used a cron job for persistence on Mac devices.
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
Threat description: used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
- T1046: Network Service Discovery
Threat description: used spearphishing emails with malicious Microsoft Word attachments to infect victims.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: used the Plink command-line utility to create SSH tunnels to C2 servers.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1071: Application Layer Protocol
Threat description: used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: used  to download payloads, run a reverse shell, and execute malware on the victim's machine.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: used  to launch an authentication window for users to enter their credentials.
MITRE ATT&CK techniques:
- T1187: Forced Authentication
Threat description: used VBS and JavaScript scripts to help perform tasks on the victim's machine.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: uses 's malleable C2 functionality to blend in with network traffic.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: uses a batch file that configures the ComSysApp service to autostart in order to establish persistence.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: uses a batch file to kill a security program task and then attempts to remove itself.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: uses a copy of tor2web proxy for HTTPS communications.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: uses a custom binary protocol to beacon back to its C2 server. It has also used XOR for encrypting communications.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1043: Commonly Used Port
Threat description: uses a custom command and control protocol that communicates over commonly used ports. The C2 protocol is encapsulated in common application layer protocols.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
- T1074: Data Staged
Threat description: uses a module to execute Mimikatz with PowerShell to perform .
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1064: Scripting
Threat description: uses AppleScript to create a login item for persistence.
MITRE ATT&CK techniques:
- T1059.002: Command and Scripting Interpreter - AppleScript
Threat description: uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: uses a variation of the XOR cipher to encrypt files before exfiltration.
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: uses command line for execution.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: uses FakeTLS to communicate with its C2 server.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: uses HTTP TCP port 80 and HTTPS TCP port 443 for communications.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: uses RDP to tunnel traffic from a victim environment.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: uses reg add to add a Registry Run key for persistence.
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
- T1569.002: System Services - Service Execution
Threat description: uses the command line and rundll32.exe to execute.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.
MITRE ATT&CK techniques:
- T1125: Video Capture
- T1123: Audio Capture
Threat description: uses  to inject shellcode into PowerShell.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: uses VNC to connect into systems.
MITRE ATT&CK techniques:
- T1021: Remote Services
Threat description: uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1047: Windows Management Instrumentation
Threat description: uses ZPP, a .NET console program, to compress files with ZIP.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe, as well as by adding a new service named OfficeUpdateService.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: will attempt to detect if the infected host is configured to a proxy. If so,  will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.  will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2. Adversaries can also use  to establish an RDP connection with a controller over TCP/7519.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: will identify Microsoft Office documents on the victim's computer.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: will sleep until after a date/time value loaded from a .dat file has passed. This allows the RAT to remain dormant until a set date, which could allow a means to regain access if other parts of the actors' toolset are removed from a victim.
MITRE ATT&CK techniques:
- T1108: Redundant Access
Threat description: will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS instead if the DES decoding fails.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: From these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems – Windows, OSX, Linux, even mobile iOS
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: This targeting of third party organizations to attack further targets is a risky move on the attackers’ part, as it potentially reveals their activity within the compromised third party organizations to the new target (those receiving the malicious documents  Making sense of MuddyWater When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East, we were somewhat confused as the previous public reporting had attributed these attacks to FIN7
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: The payload delivered in these November 2017 attacks using DDE enabled documents was SofacyCarberp, which differs from the Zebrocy downloader delivered in the February 2018 attacks
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: Intrusions and campaigns conducted by this group are in-line with PRC goals and self-interest in Taiwan
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Figure 3: ALFA TEaM Shell v2-Fake Mail (Default) Figure 4 shows an example email containing the default values the shell
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: !CMD  Trojan executes a command prompt command
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: The Trojan will save the output of the command to %TEMP%\win<random number>.txt and send the contents to the C2 server or “The length of Cmd result file is ziro!” if the command was unsuccessful
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: The Visual Basic macro uses the following command line:  cmd /c expand %TEMP%\setup.cab -F:* %TEMP% && cd /d %TEMP% && del /f /q setup.cab && uacme.exe  The control server credential information contained in the CAB files is different:   Decoded credential data contained in another ipnet.ini
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: It is responsible for executing commands in cmd.exe (later down in the functions, not seen in the screenshot, it looks for cmd.exe and executes it using CreateProcessA)
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Supported commands “upload“, “screenshot“, “Excel“, “Outlook“, “risk“, “reboot“, “shutdown“, “clean“
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal:   Figure 28. Commands used for downloading and executing, and running a command in terminal   Figure 29. Commands used in uploading and downloading file Figure 30
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: cmd.exe /C choice /C Y /N /D Y /T 2 & Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\Windows\GDI.bin
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: The malware basically provides a remote CMD/PowerShell terminal for the attackers, enabling them to execute scripts/commands and receive the results via HTTP requests
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Open interactive python shells with auto-completion on the all-in-memory remote python interpreter
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Figure 1: SpeakUp’s Victim Distribution  Figure 2: SpeakUp’s propagation rate per day Infection Vector The initial infection vector is targeting the recently reported vulnerability in ThinkPHP and uses command injection techniques for uploading a PHP shell that serves and executes a Perl backdoor
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: UserInstall.exe will abuse the BITSadmin command-line tool to create a job and launch sidebar.exe
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: This parameter transmits the agent_id to the C2 server to obtain commands the actor wishes to execute on the compromised system
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Messages are encrypted using AES with a static key
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Tool Type Internal Name Industry Name   Backdoor Poison Frog BONDUPDATER   Backdoor Glimpse Updated BONDUPDATER   Webshell HyperShell TwoFace loader   Webshell HighShell TwoFace payload   Webshell Minion TwoFace payload variant   DNS Hijacking Toolkit webmask Related to DNSpionage     Table 1
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: The HyperShell and HighShell webshells are variants of what we track as TwoFace, with HyperShell being related to the TwoFace loader and HighShell being related to the TwoFace payload, as we reported in July 2017
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Specifically, the following GitHub repositories appear to be controlled by the MuddyWater threat actor(s):  [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/ArabicBrowserFont.exe   [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/FontArabic.exe     9b5e36bb7518a9e333c31d09b589102f89e3425571dd434820ab3c437dc4e0d9 (and several others)  Downloads payload from: hxxps://raw.githubusercontent[.]com/ReactDeveloper2017/react/master/src/test/test.js    Interestingly, both profiles were populated with forked repositories to give them an air of legitimacy as shown in figure 2
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Malicious obfuscated VBA code is executed when the macro is first enabled
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: The encrypted file contains a config file of 0x78 bytes. The data is decrypted with an 0xD9 XOR operation.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: The actors have made some small changes, such as altering the variable names to avoid Yara detection
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: The encryption/decryption routine (refer to Figure 5) can be summarized as follows:      Figure 5: Encryption/ Decryption Function  Generate an array of integers from 0x00 to 0xff Scrambles the state of the table using the given key Encrypts or decrypts a string using the scrambled table from (b)
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: Version 2 Rather than using the host ID as the key, this version uses a random XOR key between 32 and 64 bytes in length that is generated for each session
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: A build tool is likely being used by these attackers that allows the operator to configure details such as C2 addresses, C2 encryption keys, and a campaign code
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: The BONDUPDATER script, which was named based on the hard-coded string “B007”, uses a custom DGA algorithm to generate subdomains for communication with the C2 server
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: The structure of each of these outbound DNS requests is as follows: <system ID>-<job ID>-<offset in data><more data flag>-<random length of base64 encoded data between 30 and 42 characters>.<c2 domain> The payload will look for different responses to these outbound queries depending on the type of DNS request that the payload uses to communicate with the C2
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: <encoded system data>.<same random number between 100000 and 999999 above>.<c2 name>   After obtaining a session ID and pre-shared key, the PowerShell script will continue to communicate with its C2 server to obtain data to treat as a command
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: Instead, it immediately issues a query to resolve the following domain, which embeds the session ID value to transmit it to the C2:   <encoded session id>.<same random number between 100000 and 999999>.<c2 domain name>   To transmit the data via the DNS tunneling, the C2 server will respond to the above query with an IPv6 address that contains the number of DNS queries the payload must issue to obtain the entirety of the data from subsequent IPv6 answers
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: Table 4: URL parameters Additionally, the command string is hashed using the same RGPH hashing algorithm as before
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: In one instance, a log file recovered from an open indexed server revealed that an IP address (112.66.188.28) located in Hainan, China had been used to administer the command and control node that was communicating with malware on victim machines
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Instructions within guide.txt explaining how to carry out DNS hijacking attack In one part of guide.txt, an example target appears to be provided, with a corresponding adversary IP (185.162.235[.]106) for the legitimate domain to be redirected to
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Backdoor.Pirpi also collects information about the target’s local network, including the domain controller and workstations
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: DHS and FBI recommend that network administrators review the IP addresses, file hashes, network signatures, and YARA rules provided, and add the IPs to their watchlist to determine whether malicious activity has been observed within their organization.When reviewing network perimeter logs for the IP addresses, organizations may find numerous instances of these IP addresses attempting to connect to their systems
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: text=  from=  ai= ags=  oe= aq= btnG=  oprnd=  ai= utm=  channel=  The page address in the domain of the command and control server is chosen randomly from the list
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Similar to Reaver as posted by Palo Alto, it gets the IP or domain of the C&C server, the port, name of the binary, a sleep timer, and what Palo Alto calls a “campaign identifier.” Technical Details At this moment, we were unable to retrieve the original infection vector and other information regarding what other tools the APT15 group is using to attack their targets
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: The structure of the domain mimics the Mercator Institute for China Studies (MERICS), whose actual domain is merics.org
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: mericcs.org 221.121.138.141 Domain used for spear phish sender e-mail address and to host malicious documents
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: (Source: Dell SecureWorks) As shown in Figure 10, the unpacked JavaScript code reveals an iframe pointing to an IP address that is hosting the exploit
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: Furthermore, this group has routinely identified and exploited vulnerable web servers of targeted organizations to install web shells, such as ANTAK and ASPXSPY, and used stolen legitimate credentials to compromise externally facing Outlook Web Access (OWA) resources
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: Attack Lifecycle  Initial Compromise APT40 has been observed leveraging a variety of techniques for initial compromise, including web server exploitation, phishing campaigns delivering publicly available and custom backdoors, and strategic web compromises
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: (Source: SecureWorks) Reentry attempt After BRONZE UNION was evicted from a compromised environment, which involved blocking the group's known infrastructure, CTU researchers observed the group attempting to reconnect to its OWA web shells and a backup web shell it had deployed during the intrusion
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: To report an intrusion and request resources for incident response or technical assistance, you are encouraged to contact DHS NCCIC (NCCICCustomerService@hq.dhs.gov or 888-282-0870), the FBI through a local field office, or the FBI’s Cyber Division (CyWatch@fbi.gov or 855-292-3937).Protect Against SQL Injection and Other Attacks on Web ServicesTo protect against code injections and other attacks, system operators should routinely evaluate known and published vulnerabilities, periodically perform software updates and technology refreshes, and audit external-facing systems for known web application vulnerabilities
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: (Source: Dell SecureWorks) Passwords, like "admin-na-google123!@#" shown in Figure 4, are required to interact with the web shell
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: TG-3390 has used additional web shells containing similarly formatted passwords
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: ASPXTool — A modified version of the ASPXSpy web shell (see Figure 6)
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: TG-3390 actors have deployed the OwaAuth web shell to Exchange servers, disguising it as an ISAPI filter
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
Threat description: Offset Description   0x0 Victim GUID (8C8CEED9-4326-448B-919E-249EEC0238A3)   0x25 Victim IP Address (192.168.180.154)   0x45 Command (0x66660001)   0x49 Length of payload (0x2f – 47)   0x4d Field 1 – Windows major version (0x6 – Windows Vista+)   0x51 Field 2 – Windows minor version (0x1 – Windows 7)   0x55 Field 3 – Unknown (0x20)   0x59 Payload (default flag:4/2/2018 1:01:33 AM)    Table 5 – Beacon structure for PLAINTEE
MITRE ATT&CK techniques:
- T1010: Application Window Discovery
Threat description: Linux malware detection and prevention is not prevalent at this time, but Palo Alto Networks customers are protected through our next-generation security platform:  IPS signature 14917 deployed to identify and prevent command and control activity The C2 domains and files mentioned in this report are blocked in our Threat Prevention product
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: For example, at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Appendix Malware Family Descriptions    Malware Family  Description  Availability    DROPSHOT  Dropper that has been observed dropping and launching the TURNEDUP backdoor, as well as the SHAPESHIFT wiper malware  Non-Public    NANOCORE  Publicly available remote access Trojan (RAT) available for purchase
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: The dropped executable (MD5: 78734CD268E5C9AB4184E1BBE21A6EB9) contains the compressed FELIXROOT dropper component in the Portable Executable (PE) binary overlay section
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: This version of the campaign made malicious use of unins000.exe, a process that belongs to the Brazilian information security company GAS Tecnologia, to gather personal information undetected
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: The autonomous system name of the IP shows that the allocation is controlled by Serverius Holding B.V., which is an autonomous system name we have previously seen associated with the OilRig group
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: To obtain a job, the Trojan builds a subdomain that has the following structure and issues a DNS query to the C2 server: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c The generated subdomain is then subjected to a number-to-character substitution function that is the inverse of the Table 4, which effectively converts all the digits in the subdomain into characters
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: One computer that was infected with both Cadelspy and Remexi was a system that ran a SIM card editing application
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Reaver continues to collect various information from the victim machine, including the following:  Computer name Volume serial number Microsoft Windows version CPU speed ANSI code page OEM code page identifier for the operating system Physical and virtual memory information  Reaver encrypts this data using an incremental XOR key and uploads it to the configured remote server on the port specified
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: Here is an example of the result of ps ax on an infected system:       $ ps ax[...] 566 ?? Ss 0:00.01 /usr/libexec/icloudsyncd -launchd netlogon.bundle[...]     Figure 8: Result of ps ax on an infected system Keychain stealing The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: This phase will often leverage a specialized tool that automatically collects a wide array of information including credentials, group management policies, and even system logs to better hone further attacks and assure execution of their malware
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: A noteworthy addition to the Poseidon toolkit is the IGT supertool (Information Gathering toolkit), a bulking 15 megabyte executable that orchestrates a series of different information collections steps, exfiltration, and the cleanup of components
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: A multilayered approach is a must to securing the organization’s perimeter, especially for information security professionals and system/IT administrators
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: The verb get can be used in a myriad of ways to retrieve information for a machine, however in this case os get /format: is being abused to download payloads from non-local resources with .xsl extensions
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: The key differences in this variant:  Two CAB files are encoded into the Word document in text boxes instead of being appended in the DOC file There is one CAB file for an x86 system and another for an x64 system This malware sample uses uacme.exe with dummy.dll to implement the UAC bypass  exe is the program vulnerable to the UAC bypass attack dll runs install.bat to set up the service (same as NTWDBLIB.dll)   exe and dummy.dll may be either 64-bit or 32-bit binaries based on the OS
MITRE ATT&CK techniques:
- T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control
Threat description: Its encoding method has been modified from time to time, aligned with major upgrade of PlugX itself
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: When the backdoor establishes a connection to the command and control server, it sets the request period time equal to the specified dwell time for the standby mode
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: This action is repeated until the dwell time value is bigger or equal to the dwell time value for the standby mode
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: In another case the attackers use another code snippet borrowed from the SubTee GitHub project, this time filling in a fully templated .NET application whitelist bypass file: SHA256: 3e9136f95fa55852993cd15b82fe6ec54f78f34584f7689b512a46f0a22907f2: This time the attacker didn’t have to write any of their own code, instead they were simply able to paste their shellcode directly into a template, in order to launch PlugX as a child process of a trusted application
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: The state command sets a global variable containing a series of Boolean values represented as ASCII values ‘0’ or ‘1’ and also adds itself to the configuration file
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Figure 11 Embedded BMP file containing encrypted string data RC4 is used to decrypt this data using a 16-byte key that is stored within the BMP file at offset 0x502
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Once decrypted, we are provided with a large list of strings, as seen below (note that the data has been truncated for brevity):  Figure 12 Decrypted strings from embedded BMP file After these strings are decrypted, the malware will load a series of Microsoft Windows API calls to be used later on
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: This DLL serves three main functions: killing antimalware, unpacking and executing the main RAT DLL, and obtaining persistence
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Its purpose is to load Msadoz<n>.dll in order to decrypt and execute it in memory
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: The decrypted code resolves the necessary API functions, decompresses the embedded PE file with RtlCompressBuffer() using LZNT1 and maps it into memory
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Figure 2 – The GitHub profile for F0R3X containing both legitimate forked code and the binaries created by the attacker
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: It also allows macro code to access internal VBA objects for stealthier macro code execution in future attacks
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: ESET’s analysis of a recent backdoor used by TeleBots – the group behind the massive NotPetya ransomware outbreak – uncovers strong code similarities to the Industroyer main backdoor, revealing a rumored connection that was not previously proven The post New TeleBots backdoor: First evidence linking Industroyer to NotPetya appeared first on WeLiveSecurity
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: This exception invokes the exception handler containing the HTTP communication code, allowing it to run
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Figure 1 – The main code from the .NET wrapper, with the Shellcode array being created and executed in a new thread
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Interestingly, the delivery document borrowed a technique which was publicized in late 2017 as being used by the Sofacy threat actors, embedding the main malicious code in a EXIF metadata property of the document
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: The main function of the Trojan interacts with its configured C2 server to obtain additional code to execute
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: “Knock” also appears in several strings inside the code of SpeakUp
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: It maintains both code and data in the raw, encrypted blobs of data to be decrypted and used at runtime, and hidden functionality that isn’t exposed until runtime
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: In total, 29 unique CARROTBAT samples have been identified to date, containing a total of 12 confirmed unique decoy documents
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: "The following function written in Python may be used to decode this file:def decode(data): 
MITRE ATT&CK techniques:
Threat description: The following code example shows the false flag being set (5 > 115) and the ETransaksi.diomadnfagaghagh method being called:  int num = 5; int num2 = 155; bool flag = num > num2; if (flag) {     <legitimate Sales System Application code>     }            else {     NewLateBinding.LateCall(ETransaksi.diomadnfagaghagh(), null, "Invoke", new object[]     {         null,         new object[0]     }, null, null, null, true);The payload uses this technique to run a chain of methods that eventually carry out its malicious task
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: (Source: Dell SecureWorks) Both the redirect code on the compromised site and the exploit code appear and disappear, indicating that the adversaries add the code when they want to leverage the SWC and remove the code when it is not in use to limit the visibility of their operations
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Further collaboration between FireEye as a Service (FaaS), Mandiant and FireEye iSIGHT intelligence uncovered additional victims worldwide, a new suite of tools and novel techniques
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1543.003: Create or Modify System Process - Windows Service
Threat description: In addition, web traffic between a service provider’s customer and a service provider is likely to be viewed as benign by network defenders at the customer, allowing the attacker to exfiltrate data stealthily
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1543.003: Create or Modify System Process - Windows Service
Threat description: These parameters install it as a service
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1543.003: Create or Modify System Process - Windows Service
Threat description: The malware operates on victims’ systems as a svchost-based service and is capable of downloading executables, changing its own configuration, updating its own binaries, terminating its own processes, and activating and terminating denial-of-service attacks
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1543.003: Create or Modify System Process - Windows Service
Threat description: The malicious DLL is not a service DLL because it lacks ServiceMain()
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1543.003: Create or Modify System Process - Windows Service
Threat description: The victims Data from Cadelle’s C&C servers shows that a large number of Backdoor.Cadelspy infections affected individual users of Iranian internet service providers (ISPs) and hosting services
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1543.003: Create or Modify System Process - Windows Service
Threat description: The document brought Talos a new gift - a new version of ROKRAT
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Displayed below are these new, xml formatted plugin names “weap_hwi”, “ps”, and “vsnet” in a BlackEnergy configuration file download from a c2 server
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: One of the discovered config files contained a URL with an as yet unidentified md5: hxxps://46.165.222(dot)28/upgrade/bf0dac805798cc1f633f19ce8ed6382f/upgrade.php Victim set #4 A set of victims discovered installed Siemens SCADA software in their ICS environment was responsible for downloading and executing BlackEnergy
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: HighShell v5.0 explorer tab allows actor to navigate the file system The HighShell v7.1 variant from the data dump contains similar functionality to its predecessors and continued the tabular approach but expanded even further by splitting out the main functionality across multiple tabs, specifically “Command”, “Explorer”, “Upload”, “Download”, “Sql Server” and “Change Time”
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: It uses the Dropbox API with a hardcoded bearer access token and has the ability to download, upload, and execute files
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Figure 4 Microsoft Word attempting to download the remote template If the C2 server is active at the time the document is opened, it will successfully retrieve the malicious macro and load it in the same Microsoft Word session
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: The POSHSPY backdoor is designed to download and execute additional PowerShell code and Windows binaries
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: The IRC variant of MPK has a command set (Table 2) that makes this an effective backdoor Trojan, specifically allowing the actors to steal credentials from the targeted system via keylogging, to navigate and interact with the file system, to run arbitrary commands, and to download and execute additional tools on the system
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Figure 8 shows the network communication of the Pause.ps1 download
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: It will:  Download and execute the backdoor component Replace the content of the downloader Mach-O executable with a decoy, either using a base64-encoded embedded file or by downloading it from the internet Open a decoy document (described later) Close the Terminal window that just opened  The decoy document replaces the downloader Mach-O file, which means the malicious executable is only present in the ZIP file now
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Figure 2 SYSCON network traffic witnessed during execution   Pivoting on the domain hosting the SYSCON sample, 881.000webhostapp[.]com, revealed a number of additional samples, including a sample of the KONNI malware family, and four 64-bit executable files belonging to the CARROTBAT malware family
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: CARROTBAT itself is a dropper that allows an attacker to drop and open an embedded decoy file, followed by the execution of a command that will download and run a payload on the targeted machine
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: The script self-scheduling, as well as the scheduling of a script that repeatedly attempts to download and execute the Revenge RAT binary, significantly contribute to the persistence of this infection
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: We found a mechanism for decrypting, executing, and downloading an additional payload from the C&C server.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: The backdoor has the capability to download and upload files, execute shell commands, and update its configuration.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: We mentioned earlier that due to the nature of the IE injection technique used by the HTTP-based backdoors, a number of C2 commands were cached to disk
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Figure 1: Configuration file that adds new C2 server and forces the data-stealing backdoor to use it   Figure 2: Configuration file that adds TCP tunnels and records desktop video Command and Control CARBANAK communicates to its C2 servers via pseudo-HTTP or a custom binary protocol
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol