sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage. If the machine has the value 0x419 , 0x422 , or 0x423 , it stops execution.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol entries.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.
MITRE ATT&CK technique: T1205: Traffic Signaling
Ryuk has used cmd.exe to create a Registry entry to establish persistence.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Ryuk can launch icacls /grant Everyone:F /T /C /Q to delete every access-based restrictions on files and directories.
MITRE ATT&CK technique: T1222.001: File and Directory Permissions Modification- Windows File and Directory Permissions Modification
S-Type has deleted accounts it has created.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
S-Type has uploaded data and files from a compromised host to its C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
S-Type primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.
MITRE ATT&CK technique: T1008: Fallback Channels
S-Type has deleted files it has created on a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
S-Type can download additional files onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
S-Type has run the command `net user` on a victim.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
S-Type may create a temporary user on the system named `Lost_{Unique Identifier}` with the password `pond~!@6”{Unique Identifier}`.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
S-Type has used Windows APIs, including `GetKeyboardType`, `NetUserAdd`, and `NetUserDel`.
MITRE ATT&CK technique: T1106: Native API
S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious `msdtc.exe` file already created in the `%CommonFiles%` directory.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Some S-Type samples have been packed with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
S-Type uses Base64 encoding for C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
The initial beacon packet for S-Type contains the operating system version and file system of the victim.
MITRE ATT&CK technique: T1082: System Information Discovery
S-Type has attempted to determine if a compromised system was using a Japanese keyboard via the `GetKeyboardType` API call.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
S-Type has used `ipconfig /all` on a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
S-Type has run tests to determine the privilege level of the compromised user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
S-Type runs the command net start on a victim.
MITRE ATT&CK technique: T1007: System Service Discovery
S-Type uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
S-Type has provided the ability to execute shell commands on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.
MITRE ATT&CK technique: T1546.011: Event Triggered Execution- Application Shimming
SDBbot has the ability to access the file system on a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
SDBbot has the ability to decrypt and decompress its payload to enable code execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
SDBbot has sent collected data from a compromised host to its C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SDBbot has the ability to delete files from a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SDBbot has the ability to get directory listings or drive information on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.
MITRE ATT&CK technique: T1546.012: Event Triggered Execution- Image File Execution Options Injection
SDBbot has the ability to clean up and remove data structures from a compromised host.
MITRE ATT&CK technique: T1070: Indicator Removal
SDBbot has the ability to download a DLL from C2 to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SDBbot has the ability to communicate with C2 with TCP over port 443.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SDBbot can enumerate a list of running processes on a compromised machine.
MITRE ATT&CK technique: T1057: Process Discovery
SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.
MITRE ATT&CK technique: T1090: Proxy
SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
SDBbot has the ability to use RDP to connect to victim's machines.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
SDBbot has used rundll32.exe to execute DLLs.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
SDBbot has used a packed installer file.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
SDBbot has the ability to identify the OS version, OS bit information and computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
SDBbot can collected the country code of a compromised machine.
MITRE ATT&CK technique: T1614: System Location Discovery
SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
SDBbot has the ability to identify the user on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SDBbot has the ability to record video on a compromised host.
MITRE ATT&CK technique: T1125: Video Capture
SDBbot has the ability to use the command shell to execute commands on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SDelete deletes data in a way that makes it unrecoverable.
MITRE ATT&CK technique: T1485: Data Destruction
SDelete deletes data in a way that makes it unrecoverable.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SEASHARPEE can download remote files onto victims.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SEASHARPEE can timestomp files on victims using a Web shell.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
SEASHARPEE is a Web shell.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
SEASHARPEE can execute commands on victims.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
SHARPSTATS has the ability to upload and download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SHARPSTATS has the ability to employ a custom PowerShell script.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
SHARPSTATS has the ability to identify the domain of the compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
SHARPSTATS has the ability to identify the username on the compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SHARPSTATS has the ability to identify the current date and time on the compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
SHOTPUT has a command to obtain a directory listing.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SHOTPUT has a command to retrieve information about connected users.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SHOTPUT has a command to obtain a process listing.
MITRE ATT&CK technique: T1057: Process Discovery
SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.
MITRE ATT&CK technique: T1018: Remote System Discovery
SHOTPUT uses netstat to list TCP connection status.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
SHUTTERSPEED can download and execute an arbitary executable.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SHUTTERSPEED can capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
SHUTTERSPEED can collect system information.
MITRE ATT&CK technique: T1082: System Information Discovery
SILENTTRINITY can enumerate the active Window during keylogging through execution of `GetActiveWindowTitle`.
MITRE ATT&CK technique: T1010: Application Window Discovery
SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the `.msc` file extension.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
SILENTTRINITY can conduct an image hijack of an `.msc` file extension as part of its UAC bypass process.
MITRE ATT&CK technique: T1546.001: Event Triggered Execution- Change Default File Association
SILENTTRINITY can monitor Clipboard text and can use `System.Windows.Forms.Clipboard.GetText` to collect data from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
SILENTTRINITY can insert malicious shellcode into Excel.exe using a `Microsoft.Office.Interop` object.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
SILENTTRINITY can add a CLSID key for payload execution through `Registry.CurrentUser.CreateSubKey`.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
SILENTTRINITY can collect clear text web credentials for Internet Explorer/Edge.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
SILENTTRINITY's `amsiPatch.py` module can disable Antimalware Scan Interface functions.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
SILENTTRINITY can use `System` namespace methods to execute lateral movement using DCOM.
MITRE ATT&CK technique: T1021.003: Remote Services- Distributed Component Object Model
SILENTTRINITY can use `System.Security.AccessControl` namespaces to retrieve domain user information.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
SILENTTRINITY can use `System.DirectoryServices` namespace to retrieve domain group information.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
SILENTTRINITY can downgrade NTLM to capture NTLM hashes.
MITRE ATT&CK technique: T1562.010: Impair Defenses- Downgrade Attack
SILENTTRINITY can transfer files from an infected host to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SILENTTRINITY can remove files from the compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SILENTTRINITY's `credphisher.py` module can prompt a current user for their credentials.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
SILENTTRINITY has a module that can extract cached GPP passwords.
MITRE ATT&CK technique: T1552.006: Unsecured Credentials- Group Policy Preferences
SILENTTRINITY has the ability to set its window state to hidden.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
SILENTTRINITY can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.
MITRE ATT&CK technique: T1562.003: Impair Defenses- Impair Command History Logging
SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.
MITRE ATT&CK technique: T1070: Indicator Removal
SILENTTRINITY can load additional files and tools, including Mimikatz.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SILENTTRINITY contains a module to conduct Kerberoasting.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
SILENTTRINITY has a keylogging capability.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
SILENTTRINITY can obtain a list of local groups and members.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
SILENTTRINITY can make tokens from known credentials.
MITRE ATT&CK technique: T1134.003: Access Token Manipulation- Make and Impersonate Token
SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.
MITRE ATT&CK technique: T1556: Modify Authentication Process
SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol .
MITRE ATT&CK technique: T1112: Modify Registry
SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.
MITRE ATT&CK technique: T1106: Native API
SILENTTRINITY can scan for open ports on a compromised machine.
MITRE ATT&CK technique: T1046: Network Service Discovery
SILENTTRINITY can enumerate shares on a compromised host.
MITRE ATT&CK technique: T1135: Network Share Discovery
SILENTTRINITY can use PowerShell to execute commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime loaded.
MITRE ATT&CK technique: T1057: Process Discovery
SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.
MITRE ATT&CK technique: T1055: Process Injection
SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.
MITRE ATT&CK technique: T1012: Query Registry
SILENTTRINITY can run a .NET executable within the memory of a sacrificial process by loading the CLR.
MITRE ATT&CK technique: T1620: Reflective Code Loading
SILENTTRINITY can establish a LNK file in the startup folder for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
SILENTTRINITY can enumerate and collect the properties of domain computers.
MITRE ATT&CK technique: T1018: Remote System Discovery
SILENTTRINITY can take a screenshot of the current desktop.
MITRE ATT&CK technique: T1113: Screen Capture
SILENTTRINITY can determine if an anti-virus product is installed through the resolution of the service's virtual SID.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
SILENTTRINITY can collect information related to a compromised host, including OS version and a list of drives.
MITRE ATT&CK technique: T1082: System Information Discovery
SILENTTRINITY can gather a list of logged on users.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SILENTTRINITY can search for modifiable services that could be used for privilege escalation.
MITRE ATT&CK technique: T1007: System Service Discovery
SILENTTRINITY can collect start time information from a compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SILENTTRINITY can gather Windows Vault credentials.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
SILENTTRINITY can use WMI for lateral movement.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
SILENTTRINITY can create a WMI Event to execute a payload for persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
SILENTTRINITY tracks `TrustedHosts` and can move laterally to these targets via WinRM.
MITRE ATT&CK technique: T1021.006: Remote Services- Windows Remote Management
SILENTTRINITY can establish persistence by creating a new service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
SLIGHTPULSE contains functionality to execute arbitrary commands passed to it.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
SLIGHTPULSE can read files specified on the local system.
MITRE ATT&CK technique: T1005: Data from Local System
SLIGHTPULSE can deobfuscate base64 encoded and RC4 encrypted C2 messages.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
RAPIDPULSE can transfer files to and from compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SLIGHTPULSE has piped the output from executed commands to `/tmp/1`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
SLIGHTPULSE can base64 encode all incoming and outgoing C2 messages.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
SLIGHTPULSE can RC4 encrypt all incoming and outgoing C2 messages.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
SLIGHTPULSE has the ability to process HTTP GET requests as a normal web server and to insert logic that will read or write files or execute commands in response to HTTP POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SLIGHTPULSE is a web shell that can read, write, and execute files on compromised servers.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests.
MITRE ATT&CK technique: T1001: Data Obfuscation
SLOTHFULMEDIA has uploaded files and information from victim machines.
MITRE ATT&CK technique: T1005: Data from Local System
SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SLOTHFULMEDIA can enumerate files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
SLOTHFULMEDIA has downloaded files onto a victim machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SLOTHFULMEDIA has a keylogging capability.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry.
MITRE ATT&CK technique: T1112: Modify Registry
SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.
MITRE ATT&CK technique: T1057: Process Discovery
SLOTHFULMEDIA can inject into running processes on a compromised host.
MITRE ATT&CK technique: T1055: Process Injection
SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it "Filter3.jpg", and stored it in the local directory.
MITRE ATT&CK technique: T1113: Screen Capture
SLOTHFULMEDIA has the capability to start services.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
SLOTHFULMEDIA has the capability to stop processes and services.
MITRE ATT&CK technique: T1489: Service Stop
SLOTHFULMEDIA has collected system name, OS version, adapter information, memory usage, and disk information from a victim machine.
MITRE ATT&CK technique: T1082: System Information Discovery
SLOTHFULMEDIA can enumerate open ports on a victim machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
SLOTHFULMEDIA has collected the username from a victim machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SLOTHFULMEDIA has the capability to enumerate services.
MITRE ATT&CK technique: T1007: System Service Discovery
SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SLOTHFULMEDIA can open a command line to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
SLOWDRIFT uses cloud based services for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
SLOWDRIFT downloads additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SLOWDRIFT collects and sends system information to its C2.
MITRE ATT&CK technique: T1082: System Information Discovery
SLOWPULSE is applied in compromised environments through modifications to legitimate Pulse Secure files.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
SLOWPULSE can write logged ACE credentials to `/home/perl/PAUS.pm` in append mode, using the format string `%s:%s\n`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
SLOWPULSE can insert malicious logic to bypass RADIUS and ACE two factor authentication flows if a designated attacker-supplied password is provided.
MITRE ATT&CK technique: T1556.006: Modify Authentication Process- Multi-Factor Authentication
SLOWPULSE can log credentials on compromised Pulse Secure VPNs during the `DSAuth::AceAuthServer::checkUsernamePassword`ACE-2FA authentication procedure.
MITRE ATT&CK technique: T1111: Multi-Factor Authentication Interception
SLOWPULSE can modify LDAP and two factor authentication flows by inspecting login credentials and forcing successful authentication if the provided password matches a chosen backdoor password.
MITRE ATT&CK technique: T1556.004: Modify Authentication Process- Network Device Authentication
SLOWPULSE can hide malicious code in the padding regions between legitimate functions in the Pulse Secure `libdsplibs.so` file.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SMOKEDHAM has added user accounts to local Admin groups.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.
MITRE ATT&CK technique: T1090.004: Proxy- Domain Fronting
The SMOKEDHAM source code is embedded in the dropper as an encrypted string.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
SMOKEDHAM has exfiltrated data to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.
MITRE ATT&CK technique: T1564.002: Hide Artifacts- Hidden Users
SMOKEDHAM has used Powershell to download UltraVNC and ngrok from third-party file sharing sites.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SMOKEDHAM can continuously capture keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
SMOKEDHAM has used net.exe user and net.exe users to enumerate local accounts on a compromised host.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
SMOKEDHAM has created user accounts.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.
MITRE ATT&CK technique: T1112: Modify Registry
SMOKEDHAM can execute Powershell commands sent from its C2 server.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
SMOKEDHAM has used reg.exe to create a Registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
SMOKEDHAM can capture screenshots of the victim’s desktop.
MITRE ATT&CK technique: T1113: Screen Capture
SMOKEDHAM has been delivered via malicious links in phishing emails.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
SMOKEDHAM has encoded its C2 traffic with Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
SMOKEDHAM has encrypted its C2 traffic with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
SMOKEDHAM has used the systeminfo command on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
SMOKEDHAM has used whoami commands to identify system owners.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.
MITRE ATT&CK technique: T1102: Web Service
SNUGRIDE establishes persistence through a Registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
SNUGRIDE encrypts C2 traffic using AES with a static key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
SNUGRIDE communicates with its C2 server over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SNUGRIDE is capable of executing commands and spawning a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SOUNDBITE is capable of enumerating application windows.
MITRE ATT&CK technique: T1010: Application Window Discovery
SOUNDBITE communicates via DNS for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
SOUNDBITE is capable of enumerating and manipulating files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SOUNDBITE is capable of modifying the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
SOUNDBITE is capable of gathering system information.
MITRE ATT&CK technique: T1082: System Information Discovery
Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
SPACESHIP copies staged data to removable drives when they are inserted into the system.
MITRE ATT&CK technique: T1052.001: Exfiltration Over Physical Medium- Exfiltration over USB
SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
SQLRat has scripts that are responsible for deobfuscating additional scripts.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
SQLRat has used been observed deleting scripts once used.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SQLRat relies on users clicking on an embedded image to execute the scripts.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
SQLRat has used PowerShell to create a Meterpreter session.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
SQLRat has used SQL to execute JavaScript and VB scripts on the host system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
STARWHALE can collect data from an infected local host.
MITRE ATT&CK technique: T1005: Data from Local System
STARWHALE has been obfuscated with hex-encoded strings.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
STARWHALE can exfiltrate collected data to its C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
STARWHALE has stored collected data in a file called `stari.txt`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
STARWHALE has relied on victims opening a malicious Excel file for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
STARWHALE can establish persistence by installing itself in the startup folder, whereas the GO variant has created a `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OutlookM` registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
STARWHALE has the ability to hex-encode collected data from an infected host.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
STARWHALE can gather the computer name of an infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
STARWHALE has the ability to collect the IP address of an infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
STARWHALE can gather the username from an infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
STARWHALE can use the VBScript function `GetRef` as part of its persistence mechanism.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
STARWHALE has the ability to execute commands via `cmd.exe`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
STARWHALE has the ability to create the following Windows service to establish persistence on an infected host: `sc create Windowscarpstss binpath= "cmd.exe /c cscript.exe c:\\windows\\system32\\w7_1.wsf humpback_whale" start= "auto" obj= "LocalSystem"`.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
STEADYPULSE can URL decode key/value pairs sent over C2.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
STEADYPULSE can add lines to a Perl script on a targeted server to import additional Perl modules.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
STEADYPULSE can transmit URL encoded data over C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
STEADYPULSE can parse web requests made to a targeted server to determine the next stage of execution.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
STEADYPULSE is a web shell that can enable the execution of arbitrary commands on compromised web servers.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
SUGARDUMP has collected browser bookmark and history information.
MITRE ATT&CK technique: T1217: Browser Information Discovery
SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
SUGARDUMP has sent stolen credentials and other data to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SUGARDUMP has stored collected data under `%%\\CrashLog.txt`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
A SUGARDUMP variant used SMTP for C2.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
SUGARDUMP has created scheduled tasks called `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` and `MicrosoftEdgeCrashRepoeterTaskMachineUA`, which were configured to execute `CrashReporter.exe` during user logon.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.
MITRE ATT&CK technique: T1518: Software Discovery
A SUGARDUMP variant has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
SUGARUSH has used TCP for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
SUGARUSH has used port 4585 for a TCP connection to its C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
SUGARUSH has used `cmd` for execution on an infected host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
SUGARUSH has created a service named `Service1` for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
SUNBURST also removed the firewall rules it created during execution.
MITRE ATT&CK technique: T1070.007: Indicator Removal- Clear Network Connection History and Configurations
SUNBURST removed IFEO registry values to clean up traces of persistence.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
SUNBURST was digitally signed by SolarWinds from March - May 2020.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
SUNBURST collected information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.
MITRE ATT&CK technique: T1568: Dynamic Resolution
SUNBURST had a command to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SUNBURST had commands to enumerate files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SUNBURST created an Image File Execution Options Debugger registry value for the process dllhost.exe to trigger the installation of Cobalt Strike.
MITRE ATT&CK technique: T1546.012: Event Triggered Execution- Image File Execution Options Injection
SUNBURST removed HTTP proxy registry values to clean up traces of execution.
MITRE ATT&CK technique: T1070: Indicator Removal
SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
SUNBURST delivered different payloads, including TEARDROP in at least one instance.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
SUNBURST added junk bytes to its C2 over HTTP.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\\service_name\\Start registry entries to value 4. It also deleted previously-created Image File Execution Options Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.
MITRE ATT&CK technique: T1112: Modify Registry
SUNBURST strings were compressed and encoded in Base64. SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
MITRE ATT&CK technique: T1057: Process Discovery
SUNBURST masqueraded its network traffic as the Orion Improvement Program protocol.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
SUNBURST collected the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid from compromised hosts.
MITRE ATT&CK technique: T1012: Query Registry
SUNBURST used Rundll32 to execute payloads.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
SUNBURST used Base64 encoding in its C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
SUNBURST collected hostname and OS version.
MITRE ATT&CK technique: T1082: System Information Discovery
SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
SUNBURST collected the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
MITRE ATT&CK technique: T1007: System Service Discovery
SUNBURST collected device `UPTIME`.
MITRE ATT&CK technique: T1124: System Time Discovery
SUNBURST remained dormant after initial access for a period of up to two weeks.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
SUNBURST used VBScripts to initiate the execution of payloads.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
SUNSPOT modified its security token to grants itself debugging privileges by adding SeDebugPrivilege.
MITRE ATT&CK technique: T1134: Access Token Manipulation
SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.
MITRE ATT&CK technique: T1480: Execution Guardrails
Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named InventoryManager.bk after restoring the original SolarWinds Orion source code to the software library.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
SUNSPOT enumerated the Orion software Visual Studio solution directory path.
MITRE ATT&CK technique: T1083: File and Directory Discovery
SUNSPOT was identified on disk with a filename of taskhostsvc.exe and it created an encrypted log file at C:\Windows\Temp\vmware-vmdmp.log.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
SUNSPOT creates a mutex using the hard-coded value ` {12d61a41-4b74-7610-a4d8-3028d2f56395}` to ensure that only one instance of itself is running.
MITRE ATT&CK technique: T1480.002: Execution Guardrails- Mutual Exclusion
SUNSPOT used Windows API functions such as MoveFileEx and NtQueryInformationProcess as part of the SUNBURST injection process.
MITRE ATT&CK technique: T1106: Native API
SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion process.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.
MITRE ATT&CK technique: T1057: Process Discovery
SUNSPOT created a copy of the SolarWinds Orion software source file with a .bk extension to backup the original content, wrote SUNBURST using the same filename but with a .tmp extension, and then moved SUNBURST using MoveFileEx to the original filename with a .cs extension so it could be compiled within Orion software.
MITRE ATT&CK technique: T1565.001: Data Manipulation- Stored Data Manipulation
SUPERNOVA contained Base64-encoded strings.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability .
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
SUPERNOVA has masqueraded as a legitimate SolarWinds DLL.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
SUPERNOVA is a Web shell.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
SVCReady has created the `HKEY_CURRENT_USER\Software\Classes\CLSID\{E6D34FFC-AD32-4d6a-934C-D387FA873A19}` Registry key for persistence.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
SVCReady can collect data from an infected host.
MITRE ATT&CK technique: T1005: Data from Local System
SVCReady can send collected data in JSON format to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
SVCReady has the ability to download additional tools such as the RedLine Stealer to an infected host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer