sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
TrickBot has retrieved PuTTY credentials by querying the Software\SimonTatham\Putty\Sessions registry key
MITRE ATT&CK technique: T1552.002: Unsecured Credentials- Credentials in Registry
TrickBot collects local files and information from the victim’s local machine.
MITRE ATT&CK technique: T1005: Data from Local System
TrickBot decodes the configuration data and modules.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
TrickBot can disable Windows Defender.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
TrickBot can gather information about domain trusts by utilizing Nltest.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
TrickBot collects email addresses from Outlook.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
TrickBot uses an AES CBC encryption algorithm for its loader and configuration files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
TrickBot has been known to reach a command and control server via one of nine proxy IP addresses.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.
MITRE ATT&CK technique: T1008: Fallback Channels
TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.
MITRE ATT&CK technique: T1083: File and Directory Discovery
TrickBot module "Trickboot" can write or erase the UEFI/BIOS firmware of a compromised device.
MITRE ATT&CK technique: T1495: Firmware Corruption
TrickBot has used a hidden VNC window to monitor the victim and collect information stealthily.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
TrickBot downloads several additional files and saves them to the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
TrickBot collects the users of the system.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
TrickBot has attempted to get users to launch malicious documents to deliver its payload.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
The TrickBot downloader has used an icon to appear as a Microsoft Word document.
MITRE ATT&CK technique: T1036: Masquerading
TrickBot can modify registry entries.
MITRE ATT&CK technique: T1112: Modify Registry
TrickBot uses the Windows API call, CreateProcessW, to manage execution flow. TrickBot has also used Nt* API functions to perform Process Injection.
MITRE ATT&CK technique: T1106: Native API
TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.
MITRE ATT&CK technique: T1135: Network Share Discovery
Some TrickBot samples have used HTTP over ports 447 and 8082 for C2. Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443.
MITRE ATT&CK technique: T1571: Non-Standard Port
TrickBot uses non-descriptive names to hide functionality.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
TrickBot can steal passwords from the KeePass open source password manager.
MITRE ATT&CK technique: T1555.005: Credentials from Password Stores- Password Managers
TrickBot can identify the groups the user on a compromised host belongs to.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
TrickBot uses module networkDll for process list discovery.
MITRE ATT&CK technique: T1057: Process Discovery
TrickBot injects into the svchost.exe process.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
TrickBot has used Nt* Native API functions to inject code into legitimate processes such as wermgr.exe.
MITRE ATT&CK technique: T1055: Process Injection
TrickBot establishes persistence in the Startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
TrickBot uses vncDll module to remote control the victim machine.
MITRE ATT&CK technique: T1219: Remote Access Software
TrickBot can enumerate computers and network devices.
MITRE ATT&CK technique: T1018: Remote System Discovery
TrickBot creates a scheduled task on the system that provides persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
TrickBot leverages a custom packer to obfuscate its functionality.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
TrickBot has been delivered via malicious links in phishing e-mails.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
TrickBot can Base64-encode C2 commands.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.Newer versions of TrickBot have been known to use `bcrypt` to encrypt and digitally sign responses to their C2 server.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
TrickBot can identify the user and groups the user belongs to on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
TrickBot collects a list of install programs and services on the system’s machine.
MITRE ATT&CK technique: T1007: System Service Discovery
TrickBot has used printf and file I/O loops to delay process execution as part of API hammering.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Trojan.Karagany can monitor the titles of open windows to identify specific keywords.
MITRE ATT&CK technique: T1010: Application Window Discovery
Trojan.Karagany can secure C2 communications with SSL and TLS.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Trojan.Karagany can steal data and credentials from browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Trojan.Karagany has used plugins with a self-delete capability.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Trojan.Karagany can enumerate files and directories on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Trojan.Karagany can upload, download, and execute files on the victim.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Trojan.Karagany can capture keystrokes on a compromised host.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.
MITRE ATT&CK technique: T1003: OS Credential Dumping
Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Trojan.Karagany can use Tasklist to collect a list of running tasks.
MITRE ATT&CK technique: T1057: Process Discovery
Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Trojan.Karagany can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.
MITRE ATT&CK technique: T1113: Screen Capture
Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.
MITRE ATT&CK technique: T1082: System Information Discovery
Trojan.Karagany can gather information on the network configuration of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Trojan.Karagany can use netstat to collect a list of network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Trojan.Karagany can gather information about the user on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the ResumeThread API.
MITRE ATT&CK technique: T1055.003: Process Injection- Thread Execution Hijacking
Trojan.Karagany can communicate with C2 via HTTP POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Trojan.Mebromi performs BIOS modification and can download and execute a file as well as protect itself from removal.
MITRE ATT&CK technique: T1542.001: Pre-OS Boot- System Firmware
To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Truvasys adds a Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Turian can use WinRAR to create a password-protected archive for files of interest.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Turian can search for specific files and list directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Turian can download additional files and tools from its C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Turian can insert pseudo-random characters into its network encryption setup.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
Turian can store copied files in a specific directory prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Turian can disguise as a legitimate service to blend into normal operations.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Turian can use VMProtect for obfuscation.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Turian can scan for removable media to collect data.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Turian has the ability to use Python to spawn a Unix shell.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Turian can establish persistence by adding Registry Run keys.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Turian has the ability to take screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.
MITRE ATT&CK technique: T1082: System Information Discovery
Turian can retrieve the internal IP address of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Turian can retrieve usernames.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Turian has the ability to use /bin/sh to execute commands.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Turian has the ability to use HTTP for its C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Turian can create a remote shell and execute commands using cmd.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
UACMe contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.
MITRE ATT&CK technique: T1197: BITS Jobs
UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
UBoatRAT can upload and download files to the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
UBoatRAT can list running processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
UBoatRAT encrypts instructions in its C2 network payloads using a simple XOR cipher.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
UBoatRAT checks for virtualization software such as VMWare, VirtualBox, or QEmu on the compromised machine.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
UBoatRAT has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
UBoatRAT can start a command shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
UPPERCUT has the capability to gather the victim's current directory.
MITRE ATT&CK technique: T1083: File and Directory Discovery
UPPERCUT can download and upload files to and from the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.
MITRE ATT&CK technique: T1113: Screen Capture
Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
UPPERCUT has the capability to gather the system’s hostname and OS version.
MITRE ATT&CK technique: T1082: System Information Discovery
UPPERCUT has the capability to gather the victim's proxy information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
UPPERCUT has the capability to collect the current logged on user’s username from a machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.
MITRE ATT&CK technique: T1124: System Time Discovery
UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
UPPERCUT uses cmd.exe to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.
MITRE ATT&CK technique: T1119: Automated Collection
USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine.
MITRE ATT&CK technique: T1020: Automated Exfiltration
USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.
MITRE ATT&CK technique: T1092: Communication Through Removable Media
Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.
MITRE ATT&CK technique: T1025: Data from Removable Media
Most strings in USBStealer are encrypted using 3DES and XOR and reversed.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
USBStealer exfiltrates collected files via removable media from air-gapped victims.
MITRE ATT&CK technique: T1052.001: Exfiltration Over Physical Medium- Exfiltration over USB
USBStealer has several commands to delete files associated with the malware from the victim.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
USBStealer searches victim drives for files matching certain extensions or names.
MITRE ATT&CK technique: T1083: File and Directory Discovery
USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
USBStealer mimics a legitimate Russian program called USB Disk Security.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
USBStealer registers itself under a Registry Run key with the name "USB Disk Security."
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
USBferry can collect information from an air-gapped host machine.
MITRE ATT&CK technique: T1005: Data from Local System
USBferry can detect the victim's file or folder list.
MITRE ATT&CK technique: T1083: File and Directory Discovery
USBferry can use net user to gather information about local accounts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
USBferry can check for connected USB devices.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
USBferry can use tasklist to gather information about the process running on the infected system.
MITRE ATT&CK technique: T1057: Process Discovery
USBferry can use net view to gather information about remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
USBferry can copy its installer to attached USB storage devices.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
USBferry can execute rundll32.exe in memory to avoid detection.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
USBferry can detect the infected machine's network topology using ipconfig and arp.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
USBferry can use netstat and nbtstat to detect active network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
USBferry can execute various Windows commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Umbreon creates valid local users to provide access to the system.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.
MITRE ATT&CK technique: T1014: Rootkit
Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.
MITRE ATT&CK technique: T1205: Traffic Signaling
Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Unknown Logger is capable of downloading remote files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Unknown Logger is capable of recording keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Unknown Logger is capable of spreading to USB devices.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.
MITRE ATT&CK technique: T1082: System Information Discovery
Unknown Logger can obtain information about the victim's IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Unknown Logger can obtain information about the victim usernames.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Uroburos has used a combination of a Diffie-Hellman key exchange mixed with a pre-shared key to encrypt its top layer of C2 communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Uroburos has encoded outbound C2 communications in DNS requests consisting of character strings made to resemble standard domain names. The actual information transmitted by Uroburos is contained in the part of the character string prior to the first ‘.’ character.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Uroburos can use its `Get` command to exfiltrate specified files from the compromised system.
MITRE ATT&CK technique: T1005: Data from Local System
Uroburos can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Uroburos can use DLL injection to load embedded files and modules.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
The Uroburos Queue file contains embedded executable files along with key material, communication channels, and modes of operation.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
Uroburos can use AES and CAST-128 encryption to obfuscate resources.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Uroburos can use up to 10 channels to communicate between implants.
MITRE ATT&CK technique: T1008: Fallback Channels
Uroburos can run a `Clear Agents Track` command on an infected machine to delete Uroburos-related logs.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Uroburos can search for specific files on a compromised system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Uroburos can store configuration information for the kernel driver and kernel driver loader components in an encrypted blob typically found at `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds.`
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Uroburos can use concealed storage mechanisms including an NTFS or FAT-16 filesystem encrypted with CAST-128 in CBC mode.
MITRE ATT&CK technique: T1564.005: Hide Artifacts- Hidden File System
Uroburos can use a `Put` command to write files to an infected machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.
MITRE ATT&CK technique: T1559: Inter-Process Communication
Uroburos can add extra characters in encoded strings to help mimic DNS legitimate requests.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
Uroburos can use custom communications protocols that ride over SMTP.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
Uroburos has registered a service named `WerFaultSvc`, likely to spoof the legitimate Windows error reporting service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Uroburos can store configuration information in the Registry including the initialization vector and AES key needed to find and decrypt other Uroburos components.
MITRE ATT&CK technique: T1112: Modify Registry
Individual Uroburos implants can use multiple communication channels based on one of four available modes of operation.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
Uroburos can use implants on multiple compromised machines to proxy communications through its worldwide P2P network.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Uroburos can use native Windows APIs including `GetHostByName`.
MITRE ATT&CK technique: T1106: Native API
Uroburos can communicate through custom methodologies for UDP, ICMP, and TCP that use distinct sessions to ride over the legitimate protocols.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Uroburos can use a custom base62 and a de-facto base32 encoding that uses digits 0-9 and lowercase letters a-z in C2 communications.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
Uroburos can use its `Process List` command to enumerate processes on compromised hosts.
MITRE ATT&CK technique: T1057: Process Discovery
Uroburos has the ability to communicate over custom communications methodologies that ride over common network protocols including raw TCP and UDP sockets, HTTP, SMTP, and DNS.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Uroburos can use custom communication methodologies that ride over common protocols including TCP, UDP, HTTP, SMTP, and DNS in order to blend with normal network traffic.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
Uroburos can query the Registry, typically `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds`, to find the key and path to decrypt and load its kernel driver and kernel driver loader.
MITRE ATT&CK technique: T1012: Query Registry
Uroburos has the ability to load new modules directly into memory using its `Load Modules Mem` command.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.
MITRE ATT&CK technique: T1014: Rootkit
Uroburos uses a custom packer.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Uroburos can encrypt the data beneath its http2 or tcp encryption at the session layer with CAST-128, using a different key for incoming and outgoing data.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Uroburos has the ability to gather basic system information and run the POSIX API `gethostbyname`.
MITRE ATT&CK technique: T1082: System Information Discovery
Uroburos can intercept the first client to server packet in the 3-way TCP handshake to determine if the packet contains the correct unique value for a specific Uroburos implant. If the value does not match, the packet and the rest of the TCP session are passed to the legitimate listening application.
MITRE ATT&CK technique: T1205: Traffic Signaling
Uroburos can use a custom HTTP-based protocol for large data communications that can blend with normal network traffic by riding on top of standard HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Uroburos has the ability to use the command line for execution on the targeted system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Uroburos has registered a service, typically named `WerFaultSvc`, to decrypt and find a kernel driver and kernel driver loader to maintain persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Ursnif has injected HTML codes into banking sites to steal sensitive online banking information .
MITRE ATT&CK technique: T1185: Browser Session Hijacking
Ursnif droppers execute base64 encoded PowerShell commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Ursnif droppers have used COM objects to execute the malware's full executable payload.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
Ursnif has used encoded data in HTTP URLs for C2.
MITRE ATT&CK technique: T1132: Data Encoding
Ursnif has collected files from victim machines, including certificates and cookies.
MITRE ATT&CK technique: T1005: Data from Local System
Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Ursnif has used a DGA to generate domain names for C2.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk. Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Ursnif has used HTTP POSTs to exfil gathered information.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Ursnif has deleted data staged in tmp files after exfiltration.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Ursnif droppers have used COM properties to execute malware in hidden windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Ursnif has used tmp files to stage gathered information.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Ursnif has used Registry modifications as part of its installation routine.
MITRE ATT&CK technique: T1112: Modify Registry
Ursnif has used Tor for C2.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Ursnif has used CreateProcessW to create child processes.
MITRE ATT&CK technique: T1106: Native API
Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Ursnif has gathered information about running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Ursnif has used process hollowing to inject into child processes.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Ursnif has used a peer-to-peer network for C2.
MITRE ATT&CK technique: T1090: Proxy
Ursnif has used Reg to query the Registry for installed programs.
MITRE ATT&CK technique: T1012: Query Registry
Ursnif has used Registry Run keys to establish automatic execution at system startup.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Ursnif has copied itself to and infected removable drives for propagation.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Ursnif has used hooked APIs to take screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
Ursnif has used Systeminfo to gather system information.
MITRE ATT&CK technique: T1082: System Information Discovery
Ursnif has gathered information about running services.
MITRE ATT&CK technique: T1007: System Service Discovery
Ursnif has copied itself to and infected files in network drives for propagation.
MITRE ATT&CK technique: T1080: Taint Shared Content
Ursnif has injected code into target processes via thread local storage callbacks.
MITRE ATT&CK technique: T1055.005: Process Injection- Thread Local Storage
Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Ursnif has used HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Ursnif droppers have used WMI classes to execute PowerShell commands.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
VBShower has attempted to complicate forensic analysis by deleting all the files contained in %APPDATA%\..\Local\Temporary Internet Files\Content.Word and %APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
VBShower has the ability to download VBS files to the target computer.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\a-f0-9A-F{8} to maintain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
VBShower has the ability to execute VBScript files.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
VBShower has attempted to obtain a VBS script from command and control nodes over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
VERMIN encrypts the collected files using 3-DES.
MITRE ATT&CK technique: T1560: Archive Collected Data
VERMIN can perform audio capture.
MITRE ATT&CK technique: T1123: Audio Capture
VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .
MITRE ATT&CK technique: T1119: Automated Collection
VERMIN collects data stored in the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
VERMIN is obfuscated using the obfuscation tool called ConfuserEx.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
VERMIN can delete files on the victim’s machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
VERMIN can download and upload files to the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
VERMIN collects keystrokes from the victim machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
VERMIN can get a list of the processes and running tasks on the system.
MITRE ATT&CK technique: T1057: Process Discovery
VERMIN can perform screen captures of the victim’s machine.
MITRE ATT&CK technique: T1113: Screen Capture
VERMIN uses WMI to check for anti-virus software installed on the system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
VERMIN is initially packed.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
VERMIN collects the OS name, machine name, and architecture information.
MITRE ATT&CK technique: T1082: System Information Discovery
VERMIN gathers the local IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
VERMIN gathers the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
VERMIN uses HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
VPNFilter has the capability to wipe a portion of an infected device's firmware.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
Valak can download a module to search for and build a report of harvested credential data.
MITRE ATT&CK technique: T1119: Automated Collection
Valak can use the clientgrabber module to steal e-mail credentials from the Registry.
MITRE ATT&CK technique: T1552.002: Unsecured Credentials- Credentials in Registry
Valak has the ability to decode and decrypt downloaded files.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Valak has the ability to enumerate domain admin accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Valak can execute tasks via OLE.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
Valak has the ability to exfiltrate data over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Valak can communicate over multiple C2 hosts.
MITRE ATT&CK technique: T1008: Fallback Channels
Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Valak can execute JavaScript containing configuration data for establishing persistence.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Valak has the ability to enumerate local admin accounts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Valak has been executed via Microsoft Word documents containing malicious macros.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.
MITRE ATT&CK technique: T1112: Modify Registry
Valak can download additional modules and malware capable of using separate C2 channels.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
Valak has the ability save and execute files as alternate data streams .
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
Valak has the ability to base64 encode and XOR encrypt strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Valak has used PowerShell to download additional modules.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Valak has the ability to enumerate running processes on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
Valak can use the Registry for code updates and to collect credentials.
MITRE ATT&CK technique: T1012: Query Registry
Valak has used regsvr32.exe to launch malicious DLLs.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Valak has the ability to take screenshots on a compromised host.
MITRE ATT&CK technique: T1113: Screen Capture
Valak can determine if a compromised host has security products installed.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Valak has used packed DLL payloads.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Valak has been delivered via spearphishing e-mails with password protected ZIP files.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Valak has been delivered via malicious links in e-mail.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Valak has returned C2 data as encoded ASCII.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Valak can determine the Windows version and computer name on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Valak can gather information regarding the user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Valak has used HTTP in communications with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
Valak can use wmic process call create in a scheduled task to launch plugins and for execution.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
VaporRage can deobfuscate XOR-encoded shellcode prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.
MITRE ATT&CK technique: T1480: Execution Guardrails
VaporRage has the ability to download malicious shellcode to compromised systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
VaporRage can use HTTP to download shellcode from compromised websites.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Vasport can download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Vasport is capable of tunneling though a proxy.
MITRE ATT&CK technique: T1090: Proxy
Vasport copies itself to disk and creates an associated run key Registry entry to establish.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Vasport creates a backdoor by making a connection using a HTTP POST.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
VersaMem was delivered as a Java Archive that runs by attaching itself to the Apache Tomcat Java servlet and web server.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
VersaMem hooked and overrided Versa's built-in authentication method, `setUserPassword`, to intercept plaintext credentials when submitted to the server.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
VersaMem encrypted captured credentials with AES then Base64 encoded them before writing to local storage.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
VersaMem was installed through exploitation of CVE-2024-39717 in Versa Director servers.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
VersaMem deleted files related to initial installation such as temporary files related to the PID of the main web process.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
VersaMem staged captured credentials locally at `/tmp/.temp.data`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
VersaMem hooked the Catalina application filter chain `doFilter` on compromised systems to monitor all inbound requests to the local Tomcat web server, inspecting them for parameters like passwords and follow-on Java modules.
MITRE ATT&CK technique: T1040: Network Sniffing
VersaMem relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.
MITRE ATT&CK technique: T1129: Shared Modules
Some Volgmer variants use SSL to encrypt C2 communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Volgmer deobfuscates its strings and APIs once its executed.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
A Volgmer variant is encoded using a simple XOR cipher.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Volgmer can delete files and itself after infection to avoid analysis.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Volgmer can list directories on a victim.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Volgmer stores an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Volgmer can download remote files and additional payloads to the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Volgmer modifies the Registry to store an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.
MITRE ATT&CK technique: T1112: Modify Registry
Volgmer executes payloads using the Windows API call CreateProcessW.
MITRE ATT&CK technique: T1106: Native API
Volgmer can gather a list of processes.
MITRE ATT&CK technique: T1057: Process Discovery
Volgmer checks the system for certain Registry keys.
MITRE ATT&CK technique: T1012: Query Registry
Volgmer uses a simple XOR cipher to encrypt traffic and files.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Volgmer can gather the IP address from the victim's machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Volgmer can gather information about TCP connection state.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Volgmer queries the system to identify existing services.
MITRE ATT&CK technique: T1007: System Service Discovery