sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Gold Dragon uses cmd.exe to execute commands for discovery.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.
MITRE ATT&CK technique: T1119: Automated Collection
GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
GoldFinder has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
GoldMax has RSA-encrypted its communication with the C2 server.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
The GoldMax Linux variant has used a crontab entry with a @reboot line to gain persistence.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
GoldMax has decoded and decrypted the configuration file when executed.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
GoldMax can exfiltrate files over the existing C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
The GoldMax Linux variant has been executed with the `nohup` command to ignore hangup signals and continue to run if the terminal session was terminated.
MITRE ATT&CK technique: T1564.011: Hide Artifacts- Ignore Process Interrupts
GoldMax can download and execute additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
GoldMax has impersonated systems management software to avoid detection.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
GoldMax has used scheduled tasks to maintain persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
GoldMax has been packed for obfuscation.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to c8:27:cc:c2:37:5a.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
GoldMax retrieved a list of the system's network interface after execution.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.
MITRE ATT&CK technique: T1124: System Time Discovery
GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
GoldMax can spawn a command shell, and execute native commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
GoldenSpy has been packaged with a legitimate tax preparation software.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
GoldenSpy's uninstaller has base64-encoded its variables.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.
MITRE ATT&CK technique: T1083: File and Directory Discovery
GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
GoldenSpy can create new users on an infected system.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
GoldenSpy's setup file installs initial executables under the folder %WinDir%\System32\PluginManager.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
GoldenSpy can execute remote commands in the Windows command shell using the WinExec API.
MITRE ATT&CK technique: T1106: Native API
GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.
MITRE ATT&CK technique: T1571: Non-Standard Port
GoldenSpy has gathered operating system information.
MITRE ATT&CK technique: T1082: System Information Discovery
GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
GoldenSpy can execute remote commands via the command-line interface.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
GoldenSpy has established persistence by running in the background as an autostart service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Goopy has had null characters padded in its malicious DLL payload.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Goopy has the ability to delete emails used for C2 once the content has been copied.
MITRE ATT&CK technique: T1070.008: Indicator Removal- Clear Mailbox Data
Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Goopy has the ability to communicate with its C2 over DNS.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Goopy has the ability to exfiltrate documents from infected systems.
MITRE ATT&CK technique: T1005: Data from Local System
Goopy has used a polymorphic decryptor to decrypt itself at runtime.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Goopy has the ability to enumerate the infected system's user name via GetUserNameW.
MITRE ATT&CK technique: T1106: Native API
Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.
MITRE ATT&CK technique: T1057: Process Discovery
Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Goopy has the ability to enumerate the infected system's user name.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Goopy has the ability to communicate with its C2 over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Gootloader has the ability to decode and decrypt malicious payloads prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Gootloader can determine if a targeted system is part of an Active Directory domain by expanding the %USERDNSDOMAIN% environment variable.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Gootloader has used compromised legitimate domains to as a delivery network for malicious payloads.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
Gootloader can fetch second stage code from hardcoded web domains.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Gootloader can execute a Javascript file for initial infection.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Gootloader has been executed through malicious links presented to users as internet search results.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
The Gootloader first stage script is obfuscated using random alpha numeric strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Gootloader can use its own PE loader to execute payloads in memory.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
Gootloader can use an encoded PowerShell stager to write to the Registry for persistence.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Gootloader can inject its Delphi executable into ImagingDevices.exe using a process hollowing technique.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Gootloader can create an autorun entry for a PowerShell script to run at reboot.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Gootloader can retrieve a Base64 encoded stager from C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Gootloader can inspect the User-Agent string in GET request header information to determine the operating system of targeted systems.
MITRE ATT&CK technique: T1082: System Information Discovery
Gootloader can determine if a victim's computer is running an operating system with specific language preferences.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Gootloader can use IP geolocation to determine if the person browsing to a compromised site is within a targeted territory such as the US, Canada, Germany, and South Korea.
MITRE ATT&CK technique: T1614: System Location Discovery
Gootloader can use an embedded script to check the IP address of potential victims visiting compromised websites.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Gootloader can designate a sleep period of more than 22 seconds between stages of infection.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Gootloader can insert malicious scripts to compromise vulnerable content management systems .
MITRE ATT&CK technique: T1584.006: Compromise Infrastructure- Web Services
Grandoreiro can identify installed security tools based on window names.
MITRE ATT&CK technique: T1010: Application Window Discovery
Grandoreiro can use SSL in C2 communication.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Grandoreiro can utilize web services including Google sites to send and receive C2 data.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Grandoreiro has added BMP images to the resources section of its Portable Executable file increasing each binary to at least 300MB in size.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Grandoreiro can use malicious browser extensions to steal cookies and other user information.
MITRE ATT&CK technique: T1176: Browser Extensions
Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
Grandoreiro can bypass UAC by registering as the default handler for .MSC files.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Grandoreiro can capture clipboard data from a compromised host.
MITRE ATT&CK technique: T1115: Clipboard Data
Grandoreiro can steal cookie data and credentials from Google Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Grandoreiro can obtain C2 information from Google Docs.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
Grandoreiro can decrypt its encrypted internal strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Grandoreiro can parse Outlook .pst files to extract e-mail addresses.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Grandoreiro can send data it retrieves to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Grandoreiro can delete .LNK files created in the Startup folder.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Grandoreiro can store its configuration in the Registry at `HKCU\Software\` under frequently changing names including %USERNAME% and ToolTech-RM.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Grandoreiro can download its second stage from a hardcoded URL within the loader's code.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Grandoreiro can log keystrokes on the victim's machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Grandoreiro has infected victims via malicious attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Grandoreiro has used malicious links to gain execution on victim machines.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Grandoreiro has named malicious browser extensions and update files to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Grandoreiro can modify the Registry to store its configuration at `HKCU\Software\` under frequently changing names including %USERNAME% and ToolTech-RM.
MITRE ATT&CK technique: T1112: Modify Registry
Grandoreiro can use MSI files to execute DLLs.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Grandoreiro can execute through the WinExec API.
MITRE ATT&CK technique: T1106: Native API
Grandoreiro can identify installed security tools based on process names.
MITRE ATT&CK technique: T1057: Process Discovery
Grandoreiro can use run keys and create link files in the startup folder for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Grandoreiro has been spread via malicious links embedded in e-mails.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
Grandoreiro can detect VMWare via its I/O port and Virtual PC via the vpcext instruction.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Grandoreiro can collect the computer name and OS version from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Grandoreiro can collect the username from the victim's machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Grandoreiro can determine the time on the victim machine via IPinfo.
MITRE ATT&CK technique: T1124: System Time Discovery
Grandoreiro can use VBScript to execute malicious code.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Grandoreiro has the ability to use HTTP in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Grandoreiro can modify the binary ACL to prevent security tools from running.
MITRE ATT&CK technique: T1222.001: File and Directory Permissions Modification- Windows File and Directory Permissions Modification
GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.
MITRE ATT&CK technique: T1005: Data from Local System
GravityRAT steals files based on an extension list if a USB drive is connected to the system.
MITRE ATT&CK technique: T1025: Data from Removable Media
GravityRAT has been delivered via Word documents using DDE for execution.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
GravityRAT supports file encryption .
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.
MITRE ATT&CK technique: T1083: File and Directory Discovery
The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.
MITRE ATT&CK technique: T1571: Non-Standard Port
GravityRAT lists the running processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
GravityRAT creates a scheduled task to ensure it is re-executed everyday.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
GravityRAT uses WMI to check the BIOS and manufacturer information for strings like "VMWare", "Virtual", and "XEN" and another WMI request to get the current temperature of the hardware to determine if it's a virtual machine environment.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
GravityRAT collects the MAC address, computer name, and CPU information.
MITRE ATT&CK technique: T1082: System Information Discovery
GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
GravityRAT uses the netstat command to find open ports on the victim’s machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
GravityRAT collects the victim username along with other account information .
MITRE ATT&CK technique: T1033: System Owner/User Discovery
GravityRAT has a feature to list the available services on the system.
MITRE ATT&CK technique: T1007: System Service Discovery
GravityRAT can obtain the date and time of a system.
MITRE ATT&CK technique: T1124: System Time Discovery
GravityRAT uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
GravityRAT executes commands remotely on the infected host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry .
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Green Lambert can use DNS for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Green Lambert can collect data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Green Lambert can use multiple custom routines to decrypt strings prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Green Lambert can delete the original executable after initial installation in addition to unused functions.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Green Lambert can use Keychain Services API functions to find and collect passwords, such as `SecKeychainFindInternetPassword` and `SecKeychainItemCopyAttributesAndData`.
MITRE ATT&CK technique: T1555.001: Credentials from Password Stores- Keychain
Green Lambert can create a Launch Agent with the `RunAtLoad` key-value pair set to true, ensuring the `com.apple.GrowlHelper.plist` file runs every time a user logs in.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
Green Lambert can add a plist file in the `Library/LaunchDaemons` to establish persistence.
MITRE ATT&CK technique: T1543.004: Create or Modify System Process- Launch Daemon
Green Lambert can add Login Items to establish persistence.
MITRE ATT&CK technique: T1547.015: Boot or Logon Autostart Execution- Login Items
Green Lambert has created a new executable named `Software Update Check` to appear legitimate.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Green Lambert has been disguised as a Growl help file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Green Lambert has encrypted strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Green Lambert can use proxies for C2 traffic.
MITRE ATT&CK technique: T1090: Proxy
Green Lambert can add init.d and rc.d files in the /etc folder to establish persistence.
MITRE ATT&CK technique: T1037.004: Boot or Logon Initialization Scripts- RC Scripts
Green Lambert can use `uname` to identify the operating system name, version, and processor type.
MITRE ATT&CK technique: T1082: System Information Discovery
Green Lambert can obtain proxy information from a victim's machine using system environment variables.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Green Lambert can collect the date and time from a compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
Green Lambert can use shell scripts for execution, such as /bin/sh -c.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Green Lambert can establish persistence on a compromised host through modifying the `profile`, `login`, and run command files associated with the `bash`, `csh`, and `tcsh` shells.
MITRE ATT&CK technique: T1546.004: Event Triggered Execution- Unix Shell Configuration Modification
GreyEnergy encrypts communications using RSA-2048.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
GreyEnergy digitally signs the malware with a code-signing certificate.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
GreyEnergy can download additional modules and payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
GreyEnergy has a module to harvest pressed keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
GreyEnergy modifies conditions in the Registry and adds keys.
MITRE ATT&CK technique: T1112: Modify Registry
GreyEnergy has used Tor relays for Command and Control servers.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
GreyEnergy has a module to inject a PE binary into a remote process.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges .
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
GreyEnergy is packed for obfuscation.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
GreyEnergy encrypts communications using AES256.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
GreyEnergy enumerates all Windows services.
MITRE ATT&CK technique: T1007: System Service Discovery
GreyEnergy uses HTTP and HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
GreyEnergy uses cmd.exe to execute itself in-memory.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
GrimAgent has the ability to add bytes to change the file hash.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
GrimAgent can delete previously created tasks on a compromised host.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
GrimAgent can collect data and files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
GrimAgent can use a decryption algorithm for strings based on Rotate on Right and Rotate on Left functionality.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
GrimAgent has sent data related to a compromise host over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
GrimAgent can delete old binaries on a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
GrimAgent has the ability to enumerate files and directories on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
GrimAgent has the ability to download and execute additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
GrimAgent can pad C2 messages with random generated values.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
GrimAgent uses the last 64 bytes of the binary to compute a mutex name. If the generated name is invalid, it will default to the generic `mymutex`.
MITRE ATT&CK technique: T1480.002: Execution Guardrails- Mutual Exclusion
GrimAgent can use Native API including GetProcAddress and ShellExecuteW.
MITRE ATT&CK technique: T1106: Native API
GrimAgent has used Rotate on Right and Rotate on Left functionality to encrypt strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
GrimAgent can set persistence with a Registry run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
GrimAgent has the ability to set persistence using the Task Scheduler.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
GrimAgent can base64 encode C2 replies.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
GrimAgent can use an AES key to encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
GrimAgent can collect the OS, and build version on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
GrimAgent has used Accept-Language to identify hosts in the United Kingdom, United States, France, and Spain.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
GrimAgent can identify the country code on a compromised host.
MITRE ATT&CK technique: T1614: System Location Discovery
GrimAgent can enumerate the IP and domain of a target system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
GrimAgent can identify the user id on a target machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
GrimAgent has the ability to use HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
GrimAgent can use the Windows Command Shell to execute commands, including its own removal.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
GuLoader can delete its executable from the AppData\Local\Temp directory on the compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
GuLoader can download further malware for execution on the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
The GuLoader executable has been retrieved via embedded macros in malicious Word documents.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
GuLoader has relied upon users clicking on links to malicious documents.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
GuLoader can use a number of different APIs for discovery and execution.
MITRE ATT&CK technique: T1106: Native API
GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.
MITRE ATT&CK technique: T1055: Process Injection
GuLoader can establish persistence via the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
GuLoader has been spread in phishing campaigns using malicious web links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
GuLoader has the ability to perform anti-VM and anti-sandbox checks using string hashing, the API call EnumWindows, and checking for Qemu guest agent.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
GuLoader can use HTTP to retrieve additional binaries.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
GuLoader has the ability to download malware from Google Drive.
MITRE ATT&CK technique: T1102: Web Service
H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer .
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
H1N1 obfuscates C2 traffic with an altered version of base64.
MITRE ATT&CK technique: T1132: Data Encoding
H1N1 kills and disables services for Windows Firewall.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
H1N1 kills and disables services for Windows Security Center, and Windows Defender.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
H1N1 disable recovery options and deletes shadow copies from the victim.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
H1N1 uses multiple techniques to obfuscate strings, including XOR.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
H1N1 has functionality to copy itself to removable media.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
H1N1 uses a custom packing algorithm.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
H1N1 encrypts C2 traffic using an RC4 key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
H1N1 has functionality to copy itself to network shares.
MITRE ATT&CK technique: T1080: Taint Shared Content
H1N1 kills and disables services by using cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HALFBAKED can delete a specified file.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
HALFBAKED can execute PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
HALFBAKED can obtain information about running processes on the victim.
MITRE ATT&CK technique: T1057: Process Discovery
HALFBAKED can obtain screenshots from the victim.
MITRE ATT&CK technique: T1113: Screen Capture
HALFBAKED can obtain information about the OS, processor, and BIOS.
MITRE ATT&CK technique: T1082: System Information Discovery
HALFBAKED can use WMI queries to gather system information.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
HAMMERTOSS has used -WindowStyle hidden to conceal PowerShell windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
The "tDiscoverer" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.
MITRE ATT&CK technique: T1102.003: Web Service- One-Way Communication
HAMMERTOSS is known to use PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
HAMMERTOSS is controlled via commands that are appended to image files.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
can download and execute a second-stage payload.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.
MITRE ATT&CK technique: T1082: System Information Discovery
can collect the victim user name.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
HARDRAIN opens the Windows Firewall to modify incoming connections.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
HARDRAIN binds and listens on port 443 with a FakeTLS method.
MITRE ATT&CK technique: T1571: Non-Standard Port
HARDRAIN uses FakeTLS to communicate with its C2 server.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.
MITRE ATT&CK technique: T1090: Proxy
HARDRAIN uses cmd.exe to execute netshcommands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HAWKBALL has encrypted data with XOR before sending it over the C2 channel.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
HAWKBALL has used an OLE object that uses Equation Editor to drop the embedded shellcode.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
HAWKBALL has encrypted the payload with an XOR-based algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
HAWKBALL has sent system information and files over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
HAWKBALL has the ability to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.
MITRE ATT&CK technique: T1106: Native API
HAWKBALL can collect the OS version, architecture information, and computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
HAWKBALL can collect the user name of the system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HDoor kills anti-virus found on the victim.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
HDoor scans to identify open ports on the victim.
MITRE ATT&CK technique: T1046: Network Service Discovery
HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
HELLOKITTY can delete volume shadow copies on compromised hosts.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
HELLOKITTY has the ability to enumerate network resources.
MITRE ATT&CK technique: T1135: Network Share Discovery
HELLOKITTY can search for specific processes to terminate.
MITRE ATT&CK technique: T1057: Process Discovery
HELLOKITTY can enumerate logical drives on a target system.
MITRE ATT&CK technique: T1082: System Information Discovery
HELLOKITTY can use WMI to delete volume shadow copies.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
HIDEDRV injects a DLL for Downdelph into the explorer.exe process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
HIDEDRV is a rootkit that hides certain operating system artifacts.
MITRE ATT&CK technique: T1014: Rootkit
Some strings in HOMEFRY are obfuscated with XOR x56.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
HOMEFRY can perform credential dumping.
MITRE ATT&CK technique: T1003: OS Credential Dumping
HOMEFRY uses a command-line interface.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HOPLIGHT can enumerate device drivers located in the registry at `HKLM\Software\WBEM\WDM`.
MITRE ATT&CK technique: T1652: Device Driver Discovery
HOPLIGHT has modified the firewall using netsh.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
HOPLIGHT has used its C2 channel to exfiltrate data.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
HOPLIGHT has multiple C2 channels in place in case one fails.
MITRE ATT&CK technique: T1008: Fallback Channels
HOPLIGHT has been observed enumerating system drives and partitions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
HOPLIGHT has the ability to connect to a remote host in order to upload and download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
HOPLIGHT has modified Managed Object Format files within the Registry to run specific commands and create persistence on the system.
MITRE ATT&CK technique: T1112: Modify Registry
HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.
MITRE ATT&CK technique: T1571: Non-Standard Port
HOPLIGHT has been observed loading several APIs associated with Pass the Hash.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
HOPLIGHT has injected into running processes.
MITRE ATT&CK technique: T1055: Process Injection
HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.
MITRE ATT&CK technique: T1090: Proxy
A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key SYSTEM\CurrentControlSet\Control\Lsa Name.
MITRE ATT&CK technique: T1012: Query Registry
HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
HOPLIGHT has used svchost.exe to execute a malicious DLL .
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
HOPLIGHT has been observed collecting victim machine information like OS version, volume information, and more.
MITRE ATT&CK technique: T1082: System Information Discovery
HOPLIGHT has been observed collecting system time from victim machines.
MITRE ATT&CK technique: T1124: System Time Discovery
HOPLIGHT can launch cmd.exe to execute commands on the system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HOPLIGHT has used WMI to recompile the Managed Object Format files in the WMI repository.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
HOPLIGHT can use WMI event subscriptions to create persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
HTRAN can inject into into running processes.
MITRE ATT&CK technique: T1055: Process Injection
HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.
MITRE ATT&CK technique: T1090: Proxy
HTRAN can install a rootkit to hide network connections from the host OS.
MITRE ATT&CK technique: T1014: Rootkit
HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
HTTPBrowser has used DLL side-loading.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
HTTPBrowser has used DNS for command and control.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
HTTPBrowser deletes its original installer file once installation is complete.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
HTTPBrowser is capable of listing files, folders, and drives on a victim.
MITRE ATT&CK technique: T1083: File and Directory Discovery
HTTPBrowser is capable of writing a file to the compromised system from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
HTTPBrowser is capable of capturing keystrokes on victims.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
HTTPBrowser has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable. It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe” to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
HTTPBrowser has used HTTP and HTTPS for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
HTTPBrowser is capable of spawning a reverse shell on a victim.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HUI Loader can be deployed to targeted systems via legitimate programs that are vulnerable to DLL search order hijacking.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
HUI Loader can decrypt and load files containing malicious payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
HUI Loader has the ability to disable Windows Event Tracing for Windows and Antimalware Scan Interface functions.
MITRE ATT&CK technique: T1562.006: Impair Defenses- Indicator Blocking
Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.
MITRE ATT&CK technique: T1014: Rootkit
Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.
MITRE ATT&CK technique: T1542.001: Pre-OS Boot- System Firmware
Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Hancitor has deleted files using the VBA kill function.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Hancitor has the ability to download additional files from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Hancitor has relied upon users clicking on a malicious link delivered through phishing.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Hancitor has used CallWindowProc and EnumResourceTypesA to interpret and execute shellcode.
MITRE ATT&CK technique: T1106: Native API
Hancitor has used Base64 to encode malicious links. Hancitor has also delivered compressed payloads in ZIP files to victims.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Hancitor has used PowerShell to execute commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell