sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
APT39 has used malware to decrypt encrypted CAB files.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BRONZE BUTLER downloads encoded payloads and decodes them on the victim.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Cinnamon Tempest has used weaponized DLLs to load and decrypt payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Darkhotel has decrypted strings and imports using RC4 during execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Earth Lusca has used certutil to decode a string into a cabinet file.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
FIN13 has utilized `certutil` to decode base64 encoded versions of custom malware.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Kimsuky has decoded malicious VBScripts using Base64.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Malteiro has the ability to deobfuscate downloaded files prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Molerats decompresses ZIP files once on the victim machine.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Rocke has extracted tar.gz files after downloading them from a C2 server.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
TA505 has decrypted packed DLLs with an XOR key.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
WIRTE has used Base64 to decode malicious VBS script.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used `certutil -decode` to decode files on the victim’s machine when dropping UPPERCUT.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ABK has the ability to decrypt AES encrypted payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Action RAT can use Base64 to decode actor-controlled C2 server communications.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Amadey has decoded antivirus name strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
AppleJeus has decoded files received from a C2.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
AppleSeed can decode its payload prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Aria-body has the ability to decrypt the loader configuration and payload DLL.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
AuditCred uses XOR and RC4 to perform decryption on the code functions.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Avaddon has decrypted encrypted strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Avenger has the ability to decrypt files downloaded from C2.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
AvosLocker has deobfuscated XOR-encoded strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BADFLICK can decode shellcode using a custom rotating XOR cipher.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BBK has the ability to decrypt AES encrypted payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BBSRAT uses Expand to decompress a CAB file into executable content.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BLINDINGCAN has used AES and XOR to decrypt its DLLs.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BUSHWALK can Base64 decode and RC4 decrypt malicious payloads sent through a web request’s command parameter.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Babuk has the ability to unpack itself into memory using XOR.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BabyShark has the ability to decode downloaded files prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BackConfig has used a custom routine to decrypt strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Bandook has decoded its PowerShell script.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Bankshot decodes embedded XOR strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Bisonal has decoded strings in the malware using XOR and RC4.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
BoomBox can decrypt AES-encrypted files downloaded from C2.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Brute Ratel C4 has the ability to deobfuscate its payload prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Bundlore has used `openssl` to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
COATHANGER decodes configuration items from a bundled file for command and control activity.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Carbon decrypts task and configuration files for execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Chaes has decrypted an AES encrypted binary file to trigger the download of other files.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
CharmPower can decrypt downloaded modules prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
The Chinoxy dropping function can initiate decryption of its config file.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Chrommme can decrypt its encrypted internal code.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Clambling can deobfuscate its payload prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Clop has used a simple XOR operation to decrypt strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Conti has decrypted its payload using a hardcoded AES-256 key.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
CookieMiner has used Google Chrome's decryption and extraction operations.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
CostaBricks has the ability to use bytecode to decrypt embedded payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Crimson can decode its encoded PE file prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Cyclops Blink can decrypt and parse instructions sent from C2.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
DDKONG decodes an embedded configuration using XOR.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
DEADEYE has the ability to combine multiple sections of a binary which were broken up to evade detection into a single .dll prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
DanBot can use a VBA macro to decode its payload prior to installation and execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
DarkGate installation includes binary code stored in a file located in a hidden directory, such as `shell.txt`, that is decrypted then executed. DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API `CallWindowProc()` to decode and then execute.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
DarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
DarkWatchman has the ability to self-extract as a RAR archive.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Denis will decrypt important strings used for C&C communication.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Dtrack has used a decryption routine that is part of an executable physical patch.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Dyre decrypts resources needed for targeting the victim.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Ecipekac has the ability to decrypt fileless loader modules.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Egregor has been decrypted before execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
EnvyScout can deobfuscate and write malicious ISO files to disk.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Exaramel for Linux can decrypt its configuration file.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Expand can be used to decompress a local or remote CAB file into an executable.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
FIVEHANDS has the ability to decrypt its payload prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
FRAMESTING can decompress data received within `POST` requests.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
FYAnti has the ability to decrypt an embedded .NET module.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
FatDuke can decrypt AES encrypted C2 communications.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Final1stspy uses Python code to deobfuscate base64-encoded strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
GLASSTOKEN has the ability to decode hexadecimal and Base64 C2 requests.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Gelsemium can decompress and decrypt DLLs and shellcode.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
GoldMax has decoded and decrypted the configuration file when executed.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Goopy has used a polymorphic decryptor to decrypt itself at runtime.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Grandoreiro can decrypt its encrypted internal strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Green Lambert can use multiple custom routines to decrypt strings prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
HUI Loader can decrypt and load files containing malicious payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
HermeticWiper can decompress and copy driver files using `LZCopy`.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Heyoka Backdoor can decrypt its payload prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
HiddenWasp uses a cipher to implement a decoding function.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Hildegard has decrypted ELF files with AES.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
HyperBro can unpack and decrypt its payload prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ISMInjector uses the `certutil` command to decode a payload file.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
IceApple can use a Base64-encoded AES key to decrypt tasking.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Imminent Monitor has decoded malware components that are then dropped to the system.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Industroyer decrypts code to connect to a remote C2 server.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
IronNetInjector has the ability to decrypt embedded .NET and PE payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
KEYPLUG can decode its configuration file to determine C2 protocols.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
KGH_SPY can decrypt encrypted strings and write them to a newly created folder.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
KOCTOPUS has deobfuscated itself before executing its commands.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Kessel has decrypted the binary's configuration once the `main` function was launched.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Kobalos decrypts strings right after the initial communication, but before the authentication process.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Kwampirs decrypts and extracts a copy of its main DLL payload when executing.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
LIGHTWIRE can RC4 decrypt and Base64 decode C2 commands.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
LightNeuron has used AES and XOR to decrypt configuration files and commands.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Lizar can decrypt its configuration data.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
LookBack has a function that decrypts malicious data.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Lucifer can decrypt its C2 address upon execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Machete’s downloaded data is decrypted using AES.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Mafalda can decrypt files and data.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
MegaCortex has used a Base64 key to decode its components.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
MirageFox has a function for decrypting data containing C2 configuration information.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Mispadu decrypts its encrypted configuration files prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Mongall has the ability to decrypt its payload prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
More_eggs will decode malware components that are then dropped to the system.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Mori can resolve networking APIs from strings that are ADD-encrypted.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
NOKKI uses a unique, custom de-obfuscation technique.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
NativeZone can decrypt and decode embedded  Cobalt Strike beacon stage shellcode.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
The Ninja loader component can decrypt and decompress the payload.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads. Versions of OSX/Shlayer pass encrypted and password-protected code to `openssl` and then write the payload to the `/tmp` folder.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D uses a decode routine combining bit shifting and XOR operations with a variable key that depends on the length of the string that was encoded. If the computation for the variable XOR key turns out to be 0, the default XOR key of 0x1B is used. This routine is also referenced as the `rotate` function in reporting.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
OnionDuke can use a custom decryption algorithm to decrypt strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PITSTOP can deobfuscate base64 encoded and AES encrypted commands.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
POWERSTATS can deobfuscate the main backdoor code.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Pillowmint has been decompressed by included shellcode prior to being launched.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PingPull can decrypt received data from its C2 server by using AES.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PipeMon can decrypt password-protected executables.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PowGoop can decrypt PowerShell scripts for execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Proton uses an encrypted file to store commands and configuration values.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Pteranodon can decrypt encrypted data strings prior to using them.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
PyDCrypt has decrypted and dropped the DCSrv payload to disk.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
QUIETCANARY can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
QakBot can deobfuscate and re-assemble code strings for execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
RAPIDPULSE listens for specific HTTP query parameters in received communications. If specific parameters match, a hard-coded RC4 key is used to decrypt the HTTP query paremter `hmacTime`. This decrypts to a filename that is then open, read, encrypted with the same RC4 key, base64-encoded, written to standard out, then passed as a response to the HTTP request.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
REvil can decode encrypted strings to enable execution of commands and payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ROKRAT can decrypt strings using the victim's hostname as the key.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
RainyDay can decrypt its payload via a XOR key.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Ramsay can extract its agent from the body of a malicious document.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Remexi decrypts the configuration data using XOR with 25-character keys.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
RogueRobin decodes an embedded executable using base64 and decompresses it.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
RotaJakiro uses the AES algorithm, bit shifts in a function called `rotate`, and an XOR cipher to decrypt resources required for persistence, process guarding, and file locking. It also performs this same function on encrypted stack strings and the `head` and `key` sections in the network packet structure used for C2 communications.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
SDBbot has the ability to decrypt and decompress its payload to enable code execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
SLIGHTPULSE can deobfuscate base64 encoded and RC4 encrypted C2 messages.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
SQLRat has scripts that are responsible for deobfuscating additional scripts.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
STEADYPULSE can URL decode key/value pairs sent over C2.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Saint Bot can deobfuscate strings and files for execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ShadowPad has decrypted a binary blob to start execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Shark can extract and decrypt downloaded .zip files.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
SharpStage has decompressed data received from the C2 server.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Sibot can decrypt data received from a C2 and save to a file.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
SideTwist can decode and decrypt messages received from C2.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the `unzip` binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Skidmap has the ability to download, unpack, and decrypt tar.gz files .
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Smoke Loader deobfuscates its code.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Snip3 can decode its second-stage PowerShell script prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
SombRAT can run `upload` to decrypt and upload files from storage.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
SoreFang can decode and decrypt exfiltrated data sent to C2.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Spark has used a custom XOR algorithm to decrypt the payload.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Starloader decrypts and executes shellcode from a file called Stars.jps.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Stuxnet decrypts resources that are loaded into memory and executed.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
SysUpdate can deobfuscate packed binaries in memory.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
TSCookie has the ability to decrypt, load, and execute a DLL and its resources.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Taidoor can use a stream cipher to decrypt stings used by the malware.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Torisma has used XOR and Base64 to decode C2 data.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
TrickBot decodes the configuration data and modules.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Uroburos can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Valak has the ability to decode and decrypt downloaded files.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
VaporRage can deobfuscate XOR-encoded shellcode prior to execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Volgmer deobfuscates its strings and APIs once its executed.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
WIREFIRE can decode, decrypt, and decompress data received in C2 HTTP `POST` requests.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Waterbear has the ability to decrypt its RC4 encrypted payload for execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
WellMail can decompress scripts received from C2.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
WellMess can decode and decrypt data received from C2.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
WindTail has the ability to decrypt strings using hard-coded AES keys.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
The Winnti for Windows dropper can decrypt and decompresses a data blob.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Woody RAT can deobfuscate Base64-encoded strings and scripts.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
YAHOYAH decrypts downloaded files before execution.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Zeus Panda decrypts strings in the code during the execution process.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
ZxxZ has used a XOR key to decrypt strings.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
certutil has been used to decode binaries hidden inside certificate files as Base64 information.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
metaMain can decrypt and load other modules.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
xCaon has decoded strings from the C2 server before executing commands.
Technique: T1140 Deobfuscate/Decode Files or Information, Tactic: TA0005 Defense Evasion
Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.
Technique: T1176 Browser Extensions, Tactic: TA0003 Persistence
Bundlore can install malicious browser extensions that are used to hijack user searches.
Technique: T1176 Browser Extensions, Tactic: TA0003 Persistence
Grandoreiro can use malicious browser extensions to steal cookies and other user information.
Technique: T1176 Browser Extensions, Tactic: TA0003 Persistence
Mispadu utilizes malicious Google Chrome browser extensions to steal financial data.
Technique: T1176 Browser Extensions, Tactic: TA0003 Persistence
OSX/Shlayer can install malicious Safari browser extensions to serve ads.
Technique: T1176 Browser Extensions, Tactic: TA0003 Persistence
Agent Tesla has the ability to use form-grabbing to extract data from web data forms.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
Carberp has captured credentials when a user performs login through a SSL session.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials.  IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
QakBot can use advanced web injects to steal web banking credentials.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords).
Technique: T1185 Browser Session Hijacking, Tactic: TA0009 Collection
DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.
Technique: T1187 Forced Authentication, Tactic: TA0006 Credential Access
Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.
Technique: T1187 Forced Authentication, Tactic: TA0006 Credential Access
EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.
Technique: T1187 Forced Authentication, Tactic: TA0006 Credential Access
During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
APT28 has compromised targets via strategic web compromise utilizing custom exploit kits. APT28 used reflected cross-site scripting (XSS) against government websites to redirect users to phishing webpages.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
APT32 has infected victims by tricking them into visiting compromised watering hole websites.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access
APT38 has conducted watering holes schemes to gain initial access to victims.
Technique: T1189 Drive-by Compromise, Tactic: TA0001 Initial Access