sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Raspberry Robin uses regsvr32.exe execution without any command line parameters for command and control requests to IP addresses associated with Tor nodes.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Raspberry Robin has historically used infected USB media to spread to new victims.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Raspberry Robin uses rundll32 execution without any command line parameters to contact command and control infrastructure, such as IP addresses associated with Tor nodes.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Raspberry Robin attempts to identify security software running on the victim machine, such as BitDefender, Avast, and Kaspersky.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Raspberry Robin contains multiple payloads that are packed for defense evasion purposes and unpacked on runtime.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Raspberry Robin performs a variety of system environment checks to determine if it is running in a virtualized or sandboxed environment, such as querying CPU temperature information and network card MAC address information.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Raspberry Robin performs several system checks as part of anti-analysis mechanisms, including querying the operating system build number, processor vendor and type, video controller, and CPU temperature.
MITRE ATT&CK technique: T1082: System Information Discovery
Raspberry Robin determines whether it is successfully running on a victim system by querying the running account information to determine if it is running in Session 0, indicating running with elevated privileges.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Raspberry Robin execution can rely on users directly interacting with malicious LNK files.
MITRE ATT&CK technique: T1204: User Execution
Raspberry Robin contains real and fake second-stage payloads following initial execution, with the real payload only delivered if the malware determines it is not running in a virtualized environment.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Raspberry Robin uses outbound HTTP requests containing victim information for retrieving second stage payloads. Variants of Raspberry Robin can download archive files via the victim web browser for second stage execution.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Raspberry Robin second stage payloads can be hosted as RAR files, containing a malicious EXE and DLL, on Discord servers.
MITRE ATT&CK technique: T1102: Web Service
Raspberry Robin uses cmd.exe to read and execute a file stored on an infected USB device as part of initial installation.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Raspberry Robin can execute via LNK containing a command to run a legitimate executable, such as wmic.exe, to download a malicious Windows Installer package.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.
MITRE ATT&CK technique: T1485: Data Destruction
RawDisk has been used to directly access the hard disk to help overwrite arbitrarily sized portions of disk content.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
RawDisk was used in Shamoon to help overwrite components of disk structure like the MBR and disk partitions.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
RawPOS encodes credit card data it collected from the victim with XOR.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.
MITRE ATT&CK technique: T1005: Data from Local System
Data captured by RawPOS is placed in a temporary file under a directory named "memdump".
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
RawPOS installs itself as a service to maintain persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Rclone can compress files using `gzip` prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
Rclone can exfiltrate data over SFTP or HTTPS via WebDAV.
MITRE ATT&CK technique: T1048.002: Exfiltration Over Alternative Protocol- Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Reaver encrypts collected data with an incremental XOR key prior to exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Reaver drops and executes a malicious CPL file as its payload.
MITRE ATT&CK technique: T1218.002: System Binary Proxy Execution- Control Panel
Reaver encrypts some of its files with XOR.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Reaver deletes the original dropped file from the victim.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Some Reaver variants use raw TCP for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Reaver queries the Registry to determine the correct Startup path to use for persistence.
MITRE ATT&CK technique: T1012: Query Registry
Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Reaver collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.
MITRE ATT&CK technique: T1082: System Information Discovery
Reaver collects the victim's IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Reaver collects the victim's username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Some Reaver variants use HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Reaver installs itself as a new service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
RedLeaves can gather browser usernames and passwords.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
RedLeaves can delete specified files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
RedLeaves can enumerate and search for files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
RedLeaves is capable of downloading a file from a specified URL.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RedLeaves can use HTTP over non-standard ports, such as 995, for C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
RedLeaves can capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.
MITRE ATT&CK technique: T1082: System Information Discovery
RedLeaves can obtain information about network parameters.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
RedLeaves can enumerate drives and Remote Desktop sessions.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Reg may be used to find credentials in the Windows Registry.
MITRE ATT&CK technique: T1552.002: Unsecured Credentials- Credentials in Registry
Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.
MITRE ATT&CK technique: T1112: Modify Registry
Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.
MITRE ATT&CK technique: T1012: Query Registry
RegDuke can use Dropbox as its C2 server.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
RegDuke can store its encryption key in the Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
RegDuke can download files from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RegDuke can create seemingly legitimate Registry key to store its encryption key.
MITRE ATT&CK technique: T1112: Modify Registry
RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
RegDuke can extract and execute PowerShell scripts from C2 communications.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
RegDuke can hide data in images, including use of the Least Significant Bit .
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
Regin leveraged several compromised universities as proxies to obscure its origin.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
The Regin malware platform supports many standard protocols, including SMB.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
Regin has used a hidden file system to store some of its components.
MITRE ATT&CK technique: T1564.005: Hide Artifacts- Hidden File System
Regin stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.
MITRE ATT&CK technique: T1036.001: Masquerading- Invalid Code Signature
Regin contains a keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Regin appears to have functionality to modify remote Registry information.
MITRE ATT&CK technique: T1112: Modify Registry
The Regin malware platform uses Extended Attributes to store encrypted executables.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.
MITRE ATT&CK technique: T1040: Network Sniffing
The Regin malware platform can use ICMP to communicate between infected computers.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
The Regin malware platform can use Windows admin shares to move laterally.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
The Regin malware platform supports many standard protocols, including HTTP and HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Remcos can capture data from the system’s microphone.
MITRE ATT&CK technique: T1123: Audio Capture
Remcos has a command for UAC bypassing.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Remcos steals and modifies data from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
Remcos can search for files on the infected machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Remcos can upload and download files to and from the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Remcos has a command for keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Remcos has full control of the Registry, including the ability to modify it.
MITRE ATT&CK technique: T1112: Modify Registry
Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Remcos has a command to hide itself through injecting into another process.
MITRE ATT&CK technique: T1055: Process Injection
Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.
MITRE ATT&CK technique: T1090: Proxy
Remcos uses Python scripts.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Remcos can add itself to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Remcos takes automated screenshots of the infected machine.
MITRE ATT&CK technique: T1113: Screen Capture
Remcos searches for Sandboxie and VMware on the system.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Remcos can access a system’s webcam and take pictures.
MITRE ATT&CK technique: T1125: Video Capture
Remcos can launch a remote command line to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Remexi has a command to capture active windows on the machine and retrieve window titles.
MITRE ATT&CK technique: T1010: Application Window Discovery
Remexi encrypts and adds all gathered browser data into files for upload to C2.
MITRE ATT&CK technique: T1560: Archive Collected Data
Remexi collects text from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
Remexi decrypts the configuration data using XOR with 25-character keys.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Remexi obfuscates its configuration data with XOR.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Remexi searches for files on the system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Remexi gathers and exfiltrates keystrokes from the machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Remexi utilizes scheduled tasks as a persistence mechanism.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Remexi takes screenshots of windows of interest.
MITRE ATT&CK technique: T1113: Screen Capture
Remexi uses AutoIt and VBS scripts throughout its execution process.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Remexi uses BITSAdmin to communicate with the C2 server over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Remexi silently executes received commands with cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Remexi executes received commands with wmic.exe .
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Remexi achieves persistence using Userinit by adding the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
RemoteCMD copies a file over to the remote system before execution.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RemoteCMD can execute commands remotely by creating a new schedule task on the remote system
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
RemoteCMD can execute commands remotely by creating a new service on the remote system.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
RemoteUtilities can enumerate files and directories on a target machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
RemoteUtilities can upload and download files to and from a target machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RemoteUtilities can use Msiexec to install a service.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
RemoteUtilities can take screenshots on a compromised host.
MITRE ATT&CK technique: T1113: Screen Capture
Remsec is capable of using DNS for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Remsec has a package that collects documents from any inserted USB sticks.
MITRE ATT&CK technique: T1025: Data from Removable Media
Remsec has a plugin to detect active drivers of some security products.
MITRE ATT&CK technique: T1652: Device Driver Discovery
Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Remsec can perform DLL injection.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.
MITRE ATT&CK technique: T1052.001: Exfiltration Over Physical Medium- Exfiltration over USB
Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Remsec contains a keylogger component.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Remsec can obtain a list of users.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Remsec can use modules written in Lua for execution.
MITRE ATT&CK technique: T1059.011: Command and Scripting Interpreter- Lua
Remsec is capable of using SMTP for C2.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Remsec has a plugin that can perform ARP scanning as well as port scanning.
MITRE ATT&CK technique: T1046: Network Service Discovery
Remsec is capable of using ICMP, TCP, and UDP for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Remsec harvests plain-text credentials as a password filter registered on domain controllers.
MITRE ATT&CK technique: T1556.002: Modify Authentication Process- Password Filter DLL
Remsec can obtain a process list from the victim.
MITRE ATT&CK technique: T1057: Process Discovery
Remsec can ping or traceroute a remote host.
MITRE ATT&CK technique: T1018: Remote System Discovery
Remsec schedules the execution one of its modules by creating a new scheduler task.
MITRE ATT&CK technique: T1053: Scheduled Task/Job
Remsec can dump the SAM database.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Remsec has a plugin detect security products via active drivers.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.
MITRE ATT&CK technique: T1082: System Information Discovery
Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Remsec can obtain a list of active connections and open ports.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Remsec can obtain information about the current user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Remsec is capable of using HTTP and HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Responder is used to poison name services to gather hashes and credentials from systems within a local network.
MITRE ATT&CK technique: T1557.001: Adversary-in-the-Middle- LLMNR/NBT-NS Poisoning and SMB Relay
Responder captures hashes and credentials that are sent to the system after the name services have been poisoned.
MITRE ATT&CK technique: T1040: Network Sniffing
Revenge RAT has a plugin for microphone interception.
MITRE ATT&CK technique: T1123: Audio Capture
Revenge RAT used blogpost.com as its primary command and control server during a campaign.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Revenge RAT uses the Forfiles utility to execute commands on the system.
MITRE ATT&CK technique: T1202: Indirect Command Execution
Revenge RAT has the ability to upload and download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Revenge RAT has a plugin for keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Revenge RAT uses mshta.exe to run malicious scripts on the system.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Revenge RAT has a plugin for credential harvesting.
MITRE ATT&CK technique: T1003: OS Credential Dumping
Revenge RAT uses the PowerShell command Reflection.Assembly to load itself into memory to aid in execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Revenge RAT has a plugin to perform RDP access.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Revenge RAT schedules tasks to run malicious scripts at different intervals.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Revenge RAT has a plugin for screen capture.
MITRE ATT&CK technique: T1113: Screen Capture
Revenge RAT uses Base64 to encode information sent to the C2 server.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Revenge RAT collects the CPU information, OS information, and system language.
MITRE ATT&CK technique: T1082: System Information Discovery
Revenge RAT collects the IP address and MAC address from the system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Revenge RAT gathers the username from the system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Revenge RAT has the ability to access the webcam.
MITRE ATT&CK technique: T1125: Video Capture
Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Revenge RAT creates a Registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell to survive a system reboot.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Rifdoor has encrypted strings with a single byte XOR algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Rifdoor has been executed from malicious Excel or Word documents containing macros.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Rifdoor has created a new registry entry at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of C:\ProgramData\Initech\Initech.exe /run.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Rifdoor has been distributed in e-mails with malicious Excel or Word documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Rifdoor has encrypted command and control communications with a stream cipher.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Rifdoor has the ability to identify the Windows version on the compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Rifdoor has the ability to identify the IP address of the compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Rifdoor has the ability to identify the username on the compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Rising Sun variants can use SSL for encrypting C2 communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Rising Sun has collected data and files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Rising Sun can delete files and artifacts it creates.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Rising Sun can modify file attributes to hide files.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.
MITRE ATT&CK technique: T1070: Indicator Removal
Rising Sun can test a connection to a specified network IP address over a specified port number.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
Rising Sun used dynamic API resolutions to various Windows APIs by leveraging `LoadLibrary` and `GetProcAddress`.
MITRE ATT&CK technique: T1106: Native API
Rising Sun can enumerate all running processes and process information on an infected machine.
MITRE ATT&CK technique: T1057: Process Discovery
Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\MICROSOFT\Windows NT\ CurrentVersion | ProductName`.
MITRE ATT&CK technique: T1012: Query Registry
Rising Sun can detect the computer name, operating system, and drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume.
MITRE ATT&CK technique: T1082: System Information Discovery
Rising Sun can detect network adapter and IP address information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Rising Sun can detect the username of the infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Rising Sun has used HTTP and HTTPS for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Rising Sun has executed commands using `cmd.exe /c “ > <%temp%>\AM. tmp” 2>&1`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
RobbinHood disconnects all network shares from the computer with the command net use * /DELETE /Y.
MITRE ATT&CK technique: T1070.005: Indicator Removal- Network Share Connection Removal
RobbinHood stops 181 Windows services on the system before beginning the encryption process.
MITRE ATT&CK technique: T1489: Service Stop
RobbinHood uses cmd.exe on the victim's computer.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
RogueRobin has used Google Drive as a Command and Control channel.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in `Invoke-Obfuscation`.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
RogueRobin decodes an embedded executable using base64 and decompresses it.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
RogueRobin can save a new file to the system from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.
MITRE ATT&CK technique: T1057: Process Discovery
RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
RogueRobin uses regsvr32.exe to run a .sct file for execution.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
RogueRobin has a command named $screenshot that may be responsible for taking screenshots of the victim machine.
MITRE ATT&CK technique: T1113: Screen Capture
RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
RogueRobin establishes persistence by creating a shortcut in the Windows startup folder to run a script each time the user logs in.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
RogueRobin uses WMI to check BIOS version for VBOX, bochs, qemu, virtualbox, and vm to check for evidence that the script might be executing within an analysis environment.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
RogueRobin gathers the IP address and domain from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
RogueRobin collects the victim’s username and whether that user is an admin.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
RogueRobin uses Windows Script Components.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
RogueRobin uses various WMI queries to check if the sample is running in a sandbox.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Depending on the Linux distribution, RotaJakiro executes a set of commands to collect device information and sends the collected information to the C2 server.
MITRE ATT&CK technique: T1119: Automated Collection
Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a `.conf` file in the `/etc/init/` folder.
MITRE ATT&CK technique: T1037: Boot or Logon Initialization Scripts
RotaJakiro uses the AES algorithm, bit shifts in a function called `rotate`, and an XOR cipher to decrypt resources required for persistence, process guarding, and file locking. It also performs this same function on encrypted stack strings and the `head` and `key` sections in the network packet structure used for C2 communications.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
RotaJakiro sends device and other collected data back to the C2 using the established C2 channels over TCP.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
When executing with non-root permissions, RotaJakiro uses the the `shmget API` to create shared memory between other known RotaJakiro processes. This allows processes to communicate with each other and share their PID.
MITRE ATT&CK technique: T1559: Inter-Process Communication
RotaJakiro has used the filename `systemd-daemon` in an attempt to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
When executing with non-root permissions, RotaJakiro uses the the `shmget` API to create shared memory between other known RotaJakiro processes. RotaJakiro also uses the `execvp` API to help its dead process "resurrect".
MITRE ATT&CK technique: T1106: Native API
RotaJakiro uses a custom binary protocol using a type, length, value format over TCP.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
RotaJakiro uses a custom binary protocol over TCP port 443.
MITRE ATT&CK technique: T1571: Non-Standard Port
RotaJakiro can monitor the `/proc/PID` directory of known RotaJakiro processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. RotaJakiro processes can be matched to an associated Advisory Lock, in the `/proc/locks` folder, to ensure it doesn't spawn more than one process.
MITRE ATT&CK technique: T1057: Process Discovery
RotaJakiro uses dynamically linked shared libraries to execute additional functionality using `dlopen` and `dlsym`.
MITRE ATT&CK technique: T1129: Shared Modules
RotaJakiro uses ZLIB Compression to compresses data sent to the C2 server in the `payload` section network communication packet.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
RotaJakiro encrypts C2 communication using a combination of AES, XOR, ROTATE encryption, and ZLIB compression.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
RotaJakiro executes a set of commands to collect device information, including `uname`. Another example is the `cat /etc/*release | uniq` command used to collect the current OS distribution.
MITRE ATT&CK technique: T1082: System Information Discovery
Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a `.service` file under the `/lib/systemd/system/` folder.
MITRE ATT&CK technique: T1543.002: Create or Modify System Process- Systemd Service
When executing with non-root level permissions, RotaJakiro can install persistence by adding a command to the .bashrc file that executes a binary in the `${HOME}/.gvfsd/.profile/` folder.
MITRE ATT&CK technique: T1546.004: Event Triggered Execution- Unix Shell Configuration Modification
When executing with user-level permissions, RotaJakiro can install persistence using a .desktop file under the `$HOME/.config/autostart/` folder.
MITRE ATT&CK technique: T1547.013: Boot or Logon Autostart Execution- XDG Autostart Entries
Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.
MITRE ATT&CK technique: T1119: Automated Collection
Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Rover searches for files on local drives based on a predefined list of file extensions.
MITRE ATT&CK technique: T1005: Data from Local System
Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.
MITRE ATT&CK technique: T1025: Data from Removable Media
Rover automatically searches for files on local drives based on a predefined list of file extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Rover has keylogging functionality.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Rover copies files from removable drives to C:\system.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Rover has functionality to remove Registry Run key persistence as a cleanup procedure.
MITRE ATT&CK technique: T1112: Modify Registry
Rover persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Rover takes screenshots of the compromised system's desktop and saves them to C:\system\screenshot.bmp for exfiltration every 60 minutes.
MITRE ATT&CK technique: T1113: Screen Capture
Royal uses a multi-threaded encryption process that can partially encrypt targeted files with the OpenSSL library and the AES256 algorithm.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Royal can identify specific files and directories to exclude from the encryption process.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Royal can delete shadow copy backups with vssadmin.exe using the command `delete shadows /all /quiet`.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Royal can use multiple APIs for discovery, communication, and execution.
MITRE ATT&CK technique: T1106: Native API
Royal can scan the network interfaces of targeted systems.
MITRE ATT&CK technique: T1046: Network Service Discovery
Royal can enumerate the shared resources of a given IP addresses using the API call `NetShareEnum`.
MITRE ATT&CK technique: T1135: Network Share Discovery
Royal establishes a TCP socket for C2 communication using the API `WSASocketW`.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Royal has been spread through the use of phishing campaigns including "call back phishing" where victims are lured into calling a number provided through email.
MITRE ATT&CK technique: T1566: Phishing
Royal can use `GetCurrentProcess` to enumerate processes.
MITRE ATT&CK technique: T1057: Process Discovery
Royal can use SMB to connect to move laterally.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Royal can use `RmShutDown` to kill applications and services using the resources that are targeted for encryption.
MITRE ATT&CK technique: T1489: Service Stop
Royal can use `GetNativeSystemInfo` and `GetLogicalDrives` to enumerate system processors and logical drives.
MITRE ATT&CK technique: T1082: System Information Discovery
Royal can enumerate IP addresses using `GetIpAddrTable`.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Rubeus can reveal the credentials of accounts that have Kerberos pre-authentication disabled through AS-REP roasting.
MITRE ATT&CK technique: T1558.004: Steal or Forge Kerberos Tickets- AS-REP Roasting
Rubeus can gather information about domain trusts.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Rubeus can forge a ticket-granting ticket.
MITRE ATT&CK technique: T1558.001: Steal or Forge Kerberos Tickets- Golden Ticket
Rubeus can use the `KerberosRequestorSecurityToken.GetRequest` method to request kerberoastable service tickets.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
Rubeus can create silver tickets.
MITRE ATT&CK technique: T1558.002: Steal or Forge Kerberos Tickets- Silver Ticket
Ruler can be used to enumerate Exchange users and dump the GAL.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
Ruler can be used to automate the abuse of Outlook Forms to establish persistence.
MITRE ATT&CK technique: T1137.003: Office Application Startup- Outlook Forms
Ruler can be used to automate the abuse of Outlook Home Pages to establish persistence.
MITRE ATT&CK technique: T1137.004: Office Application Startup- Outlook Home Page
Ruler can be used to automate the abuse of Outlook Rules to establish persistence.
MITRE ATT&CK technique: T1137.005: Office Application Startup- Outlook Rules
RunningRAT contains code to compress files.
MITRE ATT&CK technique: T1560: Archive Collected Data
RunningRAT contains code to clear event logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
RunningRAT contains code to open and copy data from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
RunningRAT kills antimalware running process.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
RunningRAT contains code to delete files from the victim’s machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
RunningRAT captures keystrokes and sends them back to the C2 server.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
RunningRAT adds itself to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to establish persistence upon reboot.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
RunningRAT gathers the OS version, logical drives information, processor information, and volume information.
MITRE ATT&CK technique: T1082: System Information Discovery
RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Ryuk has used a combination of symmetric and asymmetric encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Ryuk has stopped services related to anti-virus.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Ryuk can use stolen domain admin accounts to move laterally within a victim domain.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Ryuk has enumerated files and folders on all mounted drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Ryuk has used vssadmin Delete Shadows /all /quiet to to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Ryuk can create .dll files that actually contain a Rich Text File format document.
MITRE ATT&CK technique: T1036: Masquerading
Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as C:\Users\Public.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.
MITRE ATT&CK technique: T1106: Native API
Ryuk can use anti-disassembly and code transformation obfuscation techniques.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.
MITRE ATT&CK technique: T1055: Process Injection
Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Ryuk has used the C$ network share for lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Ryuk can remotely create a scheduled task to execute itself on a system.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Ryuk has called kill.bat for stopping services, disabling services and killing processes.
MITRE ATT&CK technique: T1489: Service Stop
Ryuk has called GetLogicalDrives to emumerate all mounted drives, and GetDriveTypeW to determine the drive type.
MITRE ATT&CK technique: T1082: System Information Discovery