sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Mis-Type has used `cmd.exe` to run commands on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Misdat has created registry keys for persistence, including `HKCU\Software\dnimtsoleht\StubPath`, `HKCU\Software\snimtsOleht\StubPath`, `HKCU\Software\Backtsaleht\StubPath`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`.
MITRE ATT&CK technique: T1547: Boot or Logon Autostart Execution
Misdat is capable of deleting Registry keys used for persistence.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
Misdat has collected files and data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Misdat has uploaded files and data to its C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Misdat is capable of deleting the backdoor file.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Misdat is capable of downloading files from the C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Misdat has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.
MITRE ATT&CK technique: T1106: Native API
Misdat network traffic communicates over a raw socket.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Misdat was typically packed using UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Misdat network traffic is Base64-encoded plaintext.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
The initial beacon packet for Misdat contains the operating system version of the victim.
MITRE ATT&CK technique: T1082: System Information Discovery
Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Misdat is capable of providing shell functionality to the attacker to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Mispadu contains a copy of the OpenSSL library to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Mispadu utilizes malicious Google Chrome browser extensions to steal financial data.
MITRE ATT&CK technique: T1176: Browser Extensions
Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.
MITRE ATT&CK technique: T1115: Clipboard Data
Mispadu has obtained credentials from mail clients via NirSoft MailPassView.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Mispadu can steal credentials from Google Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Mispadu decrypts its encrypted configuration files prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Mispadu uses a custom algorithm to obfuscate its internal strings and uses hardcoded keys. Mispadu also uses encoded configuration files and has encoded payloads using Base64.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Mispadu can sends the collected financial data to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Mispadu searches for various filesystem paths to determine what banking applications are installed on the victim’s machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
Mispadu can log keystrokes on the victim's machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Mispadu has relied on users to execute malicious files in order to gain execution on victim machines.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Mispadu has been installed via MSI installer.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Mispadu has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.
MITRE ATT&CK technique: T1106: Native API
Mispadu can enumerate the running processes on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
Mispadu's binary is injected into memory via `WriteProcessMemory`.
MITRE ATT&CK technique: T1055: Process Injection
Mispadu creates a link in the startup folder for persistence. Mispadu adds persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Mispadu uses RunDLL32 for execution via its injector DLL.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Mispadu has the ability to capture screenshots on compromised hosts.
MITRE ATT&CK technique: T1113: Screen Capture
Mispadu can list installed security products in the victim’s environment.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Mispadu has been spread via malicious links embedded in emails.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Mispadu can run checks to verify if it is running within a virtualized environments including Hyper-V, VirtualBox or VMWare and will terminate execution if the computer name is “JOHN-PC.”
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Mispadu collects the OS version, computer name, and language ID.
MITRE ATT&CK technique: T1082: System Information Discovery
Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Mispadu’s dropper uses VBS files to install payloads and perform execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Mivast has the capability to download and execute .exe files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Mivast creates the following Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Mivast has the capability to gather NTLM password information.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Mivast has the capability to open a remote shell and run basic commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MobileOrder has a command to upload to its C2 server victim browser bookmarks.
MITRE ATT&CK technique: T1217: Browser Information Discovery
MobileOrder exfiltrates data collected from the victim mobile device.
MITRE ATT&CK technique: T1005: Data from Local System
MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.
MITRE ATT&CK technique: T1083: File and Directory Discovery
MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
MobileOrder has a command to upload information about all running processes to its C2 server.
MITRE ATT&CK technique: T1057: Process Discovery
MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.
MITRE ATT&CK technique: T1082: System Information Discovery
MoleNet can download additional payloads from the C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
MoleNet can use PowerShell to set persistence.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
MoleNet can achieve persitence on the infected machine by setting the Registry run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
MoleNet can use WMI commands to check the system for firewall and antivirus software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
MoleNet can collect information about the about the system.
MITRE ATT&CK technique: T1082: System Information Discovery
MoleNet can execute commands via the command line utility.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MoleNet can perform WMI commands on the system.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Moneybird targets a common set of file types such as documents, certificates, and database files for encryption while avoiding executable, dynamic linked libraries, and similar items.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Moneybird contains a configuration blob embedded in the malware itself.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
Mongall has the ability to upload files from victim's machines.
MITRE ATT&CK technique: T1005: Data from Local System
Mongall has the ability to decrypt its payload prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Mongall can inject a DLL into `rundll32.exe` for execution.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Mongall can upload files and information from a compromised host to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Mongall can download files to targeted systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Mongall has relied on a user opening a malicious document for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Mongall can identify removable media attached to compromised hosts.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Mongall can establish persistence with the auto start function including using the value `EverNoteTrayUService`.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Mongall can use `rundll32.exe` for execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Mongall has been packed with Themida.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Mongall can use Base64 to encode information sent to its C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Mongall has the ability to RC4 encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Mongall can identify drives on compromised hosts and retrieve the hostname via `gethostbyname`.
MITRE ATT&CK technique: T1082: System Information Discovery
Mongall can use HTTP for C2 communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
MoonWind can delete itself or specified files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
MoonWind has a command to return a directory listing for a specified directory.
MITRE ATT&CK technique: T1083: File and Directory Discovery
MoonWind has a keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
MoonWind saves information from its keylogging routine as a .zip file in the present working directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
MoonWind completes network communication via raw sockets.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.
MITRE ATT&CK technique: T1571: Non-Standard Port
MoonWind obtains the number of removable drives from the victim.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
MoonWind has a command to return a list of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
MoonWind encrypts C2 traffic using RC4 with a static key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
MoonWind can obtain the victim hostname, Windows version, RAM amount, number of drives, and screen resolution.
MITRE ATT&CK technique: T1082: System Information Discovery
MoonWind obtains the victim IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
MoonWind obtains the victim username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
MoonWind obtains the victim's current time.
MITRE ATT&CK technique: T1124: System Time Discovery
MoonWind can execute commands via an interactive command shell. MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library to create a reverse shell.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
More_eggs will decode malware components that are then dropped to the system.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
More_eggs can remove itself from a system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
More_eggs can download and launch additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
More_eggs has used HTTP GET requests to check internet connectivity.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
More_eggs has used regsvr32.exe to execute the malicious DLL.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
More_eggs can obtain information on installed anti-malware programs.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
More_eggs has used basE91 encoding, along with encryption, for C2 communication.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
More_eggs has used an RC4-based encryption method for its C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
More_eggs has the capability to gather the OS version and computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
More_eggs has the capability to gather the IP address from the victim's machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
More_eggs has the capability to gather the username from the victim's machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
More_eggs uses HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
More_eggs has used cmd.exe for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Mori can use DNS tunneling to communicate with C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Mori can resolve networking APIs from strings that are ADD-encrypted.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Mori can delete its DLL file and related files by Registry value.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Mori has obfuscated the FML.dll with 200MB of junk data.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
Mori can write data to `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\` and delete Registry values.
MITRE ATT&CK technique: T1112: Modify Registry
Mori can read data from the Registry including from `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\`.
MITRE ATT&CK technique: T1012: Query Registry
Mori can use `regsvr32.exe` for DLL execution.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Mori can use Base64 encoded JSON libraries used in C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Mosquito uses COM hijacking as a method of persistence.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Mosquito deletes files using DeleteFileW API call.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft\dllname.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Mosquito can upload and download files to the victim.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Mosquito can modify Registry keys under HKCU\Software\Microsoft\dllname to store configuration values. Mosquito also modifies Registry keys under HKCR\CLSID\...\InprocServer32 with a path to the launcher.
MITRE ATT&CK technique: T1112: Modify Registry
Mosquito leverages the CreateProcess and LoadLibrary calls to execute files with the .dll and .exe extensions.
MITRE ATT&CK technique: T1106: Native API
Mosquito can launch PowerShell Scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Mosquito runs tasklist to obtain running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Mosquito uses the ipconfig command.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Mosquito runs whoami on the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Mosquito's installer uses WMI to search for antivirus display names.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
MultiLayer Wiper removes Windows event logs during execution.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
MultiLayer Wiper deletes files on network drives, but corrupts and overwrites with random data files stored locally.
MITRE ATT&CK technique: T1485: Data Destruction
MultiLayer Wiper removes the Volume Shadow Copy service from infected devices along with all present shadow copies.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
MultiLayer Wiper opens a handle to \\\\\\\\.\\\\PhysicalDrive0 and wipes the first 512 bytes of data from this location, removing the boot sector.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
MultiLayer Wiper contains two binaries in its resources section, MultiList and MultiWip. MultiLayer Wiper drops and executes each of these items when run, then deletes them after execution.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
MultiLayer Wiper uses a batch file, remover.bat to delete malware artifacts and the batch file itself during execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
MultiLayer Wiper generates a list of all files and paths on the fixed drives of an infected system, enumerating all files on the system except specific folders defined in a hardcoded list.
MITRE ATT&CK technique: T1083: File and Directory Discovery
MultiLayer Wiper uses a batch script to clear file system cache memory via the ProcessIdleTasks export in advapi32.dll as an anti-analysis and anti-forensics technique.
MITRE ATT&CK technique: T1070: Indicator Removal
MultiLayer Wiper wipes the boot sector of infected systems to inhibit system recovery.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
MultiLayer Wiper creates a malicious scheduled task that launches a batch file to remove Windows Event Logs.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
MultiLayer Wiper changes the original path information of deleted files to make recovery efforts more difficult.
MITRE ATT&CK technique: T1565.001: Data Manipulation- Stored Data Manipulation
MultiLayer Wiper reboots the infected system following wiping and related tasks to prevent system recovery.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
MultiLayer Wiper changes timestamps of overwritten files to either 1601.1.1 for NTFS filesystems, or 1980.1.1 for all other filesystems.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
MultiLayer Wiper uses a batch script launched via a scheduled task to delete Windows Event Logs.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Mythic supports SSL encrypted C2.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Mythic supports scripting of file downloads from agents.
MITRE ATT&CK technique: T1119: Automated Collection
Mythic supports DNS-based C2 profiles.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Mythic provides various transform functions to encode and/or randomize C2 data.
MITRE ATT&CK technique: T1132: Data Encoding
Mythic supports custom chunk sizes used to upload/download files.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
Mythic supports domain fronting via custom request headers.
MITRE ATT&CK technique: T1090.004: Proxy- Domain Fronting
Mythic can leverage a modified SOCKS5 proxy to tunnel egress C2 traffic.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
Mythic can use a list of C2 URLs as fallback mechanisms in case one IP or domain gets blocked.
MITRE ATT&CK technique: T1008: Fallback Channels
Mythic supports SMB-based peer-to-peer C2 profiles.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
Mythic can leverage a peer-to-peer C2 profile between agents.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Mythic supports WebSocket and TCP-based C2 profiles.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Mythic can use SOCKS proxies to tunnel traffic through another protocol.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Mythic supports HTTP-based C2 profiles.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
NBTscan can be used to scan IP networks.
MITRE ATT&CK technique: T1046: Network Service Discovery
NBTscan can dump and print whole packet content.
MITRE ATT&CK technique: T1040: Network Sniffing
NBTscan can list NetBIOS computer names.
MITRE ATT&CK technique: T1018: Remote System Discovery
NBTscan can be used to collect MAC addresses.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
NBTscan can list active users on the system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
NDiskMonitor can obtain a list of all files and directories as well as logical drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
NDiskMonitor can download and execute a file from given URL.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.
MITRE ATT&CK technique: T1082: System Information Discovery
NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.
MITRE ATT&CK technique: T1071: Application Layer Protocol
NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.
MITRE ATT&CK technique: T1568: Dynamic Resolution
NETEAGLE is capable of reading files over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.
MITRE ATT&CK technique: T1008: Fallback Channels
NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.
MITRE ATT&CK technique: T1083: File and Directory Discovery
If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
NETEAGLE can send process listings over the C2 channel.
MITRE ATT&CK technique: T1057: Process Discovery
The "SCOUT" variant of NETEAGLE achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
NETEAGLE allows adversaries to execute shell commands on the infected host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
NETWIRE can discover and close windows on controlled systems.
MITRE ATT&CK technique: T1010: Application Window Discovery
NETWIRE has the ability to compress archived screenshots.
MITRE ATT&CK technique: T1560: Archive Collected Data
NETWIRE has used a custom encryption algorithm to encrypt collected data.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
NETWIRE can automatically archive collected data.
MITRE ATT&CK technique: T1119: Automated Collection
NETWIRE can retrieve passwords from messaging and mail client applications.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
NETWIRE can use crontabs to establish persistence.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
NETWIRE can encrypt C2 communications.
MITRE ATT&CK technique: T1573: Encrypted Channel
NETWIRE has the ability to search for files on the compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
NETWIRE can store its configuration information in the Registry under `HKCU:\Software\Netwire`.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
NETWIRE can copy itself to and launch itself from hidden folders.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
NETWIRE can downloaded payloads from C2 to the compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
The NETWIRE client has been signed by fake and invalid digital certificates.
MITRE ATT&CK technique: T1036.001: Masquerading- Invalid Code Signature
NETWIRE can perform keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
NETWIRE can use launch agents for persistence.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
NETWIRE can persist via startup options for Login items.
MITRE ATT&CK technique: T1547.015: Boot or Logon Autostart Execution- Login Items
NETWIRE has been executed through luring victims into opening malicious documents.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
NETWIRE has been executed through convincing victims into clicking malicious links.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
NETWIRE can modify the Registry to store its configuration information.
MITRE ATT&CK technique: T1112: Modify Registry
NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.
MITRE ATT&CK technique: T1106: Native API
NETWIRE can use TCP in C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
The NETWIRE binary has been executed via PowerShell script.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
NETWIRE can discover processes on compromised hosts.
MITRE ATT&CK technique: T1057: Process Discovery
The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.
MITRE ATT&CK technique: T1055: Process Injection
NETWIRE can implement use of proxies to pivot traffic.
MITRE ATT&CK technique: T1090: Proxy
NETWIRE creates a Registry start-up entry to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
NETWIRE can create a scheduled task to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
NETWIRE can capture the victim's screen.
MITRE ATT&CK technique: T1113: Screen Capture
NETWIRE has used .NET packer tools to evade detection.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
NETWIRE has been spread via e-mail campaigns utilizing malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
NETWIRE can use AES encryption for C2 data transferred.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
NETWIRE can discover and collect victim system information.
MITRE ATT&CK technique: T1082: System Information Discovery
NETWIRE can collect the IP address of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
NETWIRE can capture session logon details from a compromised host.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
NETWIRE has been executed through use of VBScripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
NETWIRE has the ability to communicate over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
NETWIRE has used web services including Paste.ee to host payloads.
MITRE ATT&CK technique: T1102: Web Service
NETWIRE can issue commands using cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
NETWIRE can use XDG Autostart Entries to establish persistence on Linux systems.
MITRE ATT&CK technique: T1547.013: Boot or Logon Autostart Execution- XDG Autostart Entries
NGLite has abused NKN infrastructure for its C2 communication.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
NGLite will use an AES encrypted channel for command and control purposes, in one case using the key WHATswrongwithUu.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
NGLite identifies the victim system MAC and IPv4 addresses and uses these to establish a victim identifier.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
NGLite will run the whoami command to gather system information and return this to the command and control server.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
NGLite will initially beacon out to the NKN network via an HTTP POST over TCP 30003.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
NKAbuse uses a Cron job to establish persistence when infecting Linux hosts.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
NKAbuse utilizes external services such as ifconfig.me to identify the victim machine's IP address.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
NKAbuse has abused the NKN public blockchain protocol for its C2 communications.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
NKAbuse enables multiple types of network denial of service capabilities across several protocols post-installation.
MITRE ATT&CK technique: T1498: Network Denial of Service
NKAbuse will check victim systems to ensure only one copy of the malware is running.
MITRE ATT&CK technique: T1057: Process Discovery
NKAbuse can take screenshots of the victim machine.
MITRE ATT&CK technique: T1113: Screen Capture
NKAbuse conducts multiple system checks and includes these in subsequent "heartbeat" messages to the malware's command and control server.
MITRE ATT&CK technique: T1082: System Information Discovery
NKAbuse is initially installed and executed through an initial shell script.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
NOKKI uses a unique, custom de-obfuscation technique.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
NOKKI can delete files to cover tracks.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
NOKKI has used FTP for C2 communications.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
NOKKI has downloaded a remote module for execution.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
NOKKI uses Base64 encoding for strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
NOKKI has established persistence by writing the payload to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
NOKKI has used rundll32 for execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
NOKKI can gather information on drives and the operating system on the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
NOKKI can gather information on the victim IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
NOKKI can collect the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
NOKKI can collect the current timestamp of the victim's machine.
MITRE ATT&CK technique: T1124: System Time Discovery
NOKKI has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
NPPSPY opens a new network listener for the mpnotify.exe process that is typically contacted by the Winlogon process in Windows. A new, alternative RPC channel is set up with a malicious DLL recording plaintext credentials entered into Winlogon, effectively intercepting and redirecting the logon information.
MITRE ATT&CK technique: T1557: Adversary-in-the-Middle
NPPSPY collection is automatically recorded to a specified file on the victim machine.
MITRE ATT&CK technique: T1119: Automated Collection
NPPSPY records data entered from the local system logon at Winlogon to capture credentials in cleartext.
MITRE ATT&CK technique: T1005: Data from Local System
NPPSPY creates a network listener using the misspelled label logincontroll recorded to the Registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order.
MITRE ATT&CK technique: T1656: Impersonation
NPPSPY captures user input into the Winlogon process by redirecting RPC traffic from legitimate listening DLLs within the operating system to a newly registered malicious item that allows for recording logon information in cleartext.
MITRE ATT&CK technique: T1056: Input Capture
NPPSPY modifies the Registry to record the malicious listener for output from the Winlogon process.
MITRE ATT&CK technique: T1112: Modify Registry
NPPSPY captures credentials by recording them through an alternative network listener registered to the mpnotify.exe process, allowing for cleartext recording of logon information.
MITRE ATT&CK technique: T1552: Unsecured Credentials
Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.
MITRE ATT&CK technique: T1112: Modify Registry
Naid collects a unique identifier from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Naid collects the domain name from a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Naid creates a new service to establish.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
NanHaiShu uses DNS for the C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
NanHaiShu encodes files in Base64.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
NanHaiShu launches a script to delete their original decoy file to cover tracks.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
NanHaiShu can download additional files from URLs.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
NanHaiShu executes additional Jscript code on the victim's machine.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
NanHaiShu uses mshta.exe to load its program and files.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
NanHaiShu can gather the victim computer name and serial number.
MITRE ATT&CK technique: T1082: System Information Discovery
NanHaiShu can gather information about the victim proxy server.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
NanHaiShu collects the username from the victim.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
NanHaiShu executes additional VBScript code on the victim's machine.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
NanoCore can capture audio feeds from the system.
MITRE ATT&CK technique: T1123: Audio Capture
NanoCore can modify the victim's firewall.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
NanoCore can modify the victim's anti-virus.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
NanoCore has the capability to download and activate additional modules for execution.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
NanoCore can perform keylogging on the victim’s machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
NanoCore has the capability to edit the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
NanoCore uses DES to encrypt the C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
NanoCore gathers the IP address from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
NanoCore can access the victim's webcam and capture data.
MITRE ATT&CK technique: T1125: Video Capture
NanoCore uses VBS files.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
NanoCore can open a remote command-line interface and execute commands. NanoCore uses JavaScript files.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
NativeZone can decrypt and decode embedded Cobalt Strike beacon stage shellcode.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.
MITRE ATT&CK technique: T1480: Execution Guardrails
NativeZone can display an RTF document to the user to enable execution of Cobalt Strike stage shellcode.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.
MITRE ATT&CK technique: T1036: Masquerading
NativeZone has used rundll32 to execute a malicious DLL.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
NavRAT can download files remotely.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
NavRAT logs the keystrokes on the targeted system.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
NavRAT writes multiple outputs to a TMP file using the >> method.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
NavRAT uses tasklist /v to check running processes.
MITRE ATT&CK technique: T1057: Process Discovery
NavRAT copies itself into a running Internet Explorer process to evade detection.
MITRE ATT&CK technique: T1055: Process Injection
NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
NavRAT uses systeminfo on a victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Nebulae can use DLL side-loading to gain execution.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Nebulae has the capability to upload collected files to C2.
MITRE ATT&CK technique: T1005: Data from Local System
Nebulae has the ability to delete files and directories.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Nebulae can list files and directories on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Nebulae can download files from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Nebulae has created a service named "Windows Update Agent1" to appear legitimate.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Nebulae uses functions named StartUserModeBrowserInjection and StopUserModeBrowserInjection indicating that it's trying to imitate chrome_frame_helper.dll.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Nebulae has the ability to use CreateProcess to execute a process.
MITRE ATT&CK technique: T1106: Native API
Nebulae can use TCP in C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Nebulae can enumerate processes on a target system.
MITRE ATT&CK technique: T1057: Process Discovery
Nebulae can achieve persistence through a Registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Nebulae can use RC4 and XOR to encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Nebulae can discover logical drive information including the drive type, free space, and volume information.
MITRE ATT&CK technique: T1082: System Information Discovery
Nebulae can use CMD to execute a process.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Nebulae can create a service to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Neoichor can use the Internet Explorer COM interface to connect and receive commands from C2.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
Neoichor can upload files from a victim's machine.
MITRE ATT&CK technique: T1005: Data from Local System