sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
BOOSTWRITE has used the DWriteCreateFactory function to load additional modules.
MITRE ATT&CK technique: T1129: Shared Modules
BOOTRASH is a Volume Boot Record bootkit that uses the VBR to maintain persistence.
MITRE ATT&CK technique: T1542.003: Pre-OS Boot- Bootkit
BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.
MITRE ATT&CK technique: T1564.005: Hide Artifacts- Hidden File System
After initial execution, BPFDoor forks itself and runs the fork with the `--init` flag, which allows it to execute secondary clean up operations. The parent process terminates leaving the forked process to be inherited by the legitimate process init.
MITRE ATT&CK technique: T1036.009: Masquerading- Break Process Trees
BPFDoor starts a shell on a high TCP port starting at 42391 up to 43391, then changes the local `iptables` rules to redirect all packets from the attacker to the shell port.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
BPFDoor creates a zero byte PID file at `/var/run/haldrund.pid`. BPFDoor uses this file to determine if it is already running on a system to ensure only one instance is executing at a time.
MITRE ATT&CK technique: T1480: Execution Guardrails
After initial setup, BPFDoor's original execution process deletes the dropped binary and exits.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
BPFDoor set's it's process to ignore the following signals; `SIGHUP`, `SIGINT`, `SIGQUIT`, `SIGPIPE`, `SIGCHLD`, `SIGTTIN`, and `SIGTTOU`.
MITRE ATT&CK technique: T1564.011: Hide Artifacts- Ignore Process Interrupts
BPFDoor sets the `MYSQL_HISTFILE` and `HISTFILE` to `/dev/null` preventing the shell and MySQL from logging history in `/proc//environ`.
MITRE ATT&CK technique: T1562.003: Impair Defenses- Impair Command History Logging
BPFDoor clears the file location `/proc//environ` removing all environment variables for the process.
MITRE ATT&CK technique: T1070: Indicator Removal
BPFDoor overwrites the `argv0` value used by the Linux `/proc` filesystem to determine the command line and command name to display for each process. BPFDoor selects a name from 10 hardcoded names that resemble Linux system daemons, such as; `/sbin/udevd -d`, `dbus-daemon --system`, `avahi-daemon: chroot helper`, `/sbin/auditd -n`, and `/usr/lib/systemd/systemd-journald`.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
BPFDoor can require a password to activate the backdoor and uses RC4 encryption or static library encryption `libtomcrypt`.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
BPFDoor uses BPF bytecode to attach a filter to a network socket to view ICMP, UDP, or TCP packets coming through ports 22 , 80 , and 443 . When BPFDoor finds a packet containing its “magic” bytes, it parses out two fields and forks itself. The parent process continues to monitor filtered traffic while the child process executes the instructions from the parsed fields.
MITRE ATT&CK technique: T1205.002: Traffic Signaling- Socket Filters
BPFDoor uses the `utimes` function to change the executable's timestamp.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
BPFDoor can create a reverse shell and supports vt100 emulator formatting.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
BS2005 uses Base64 encoding for communication in the message body of an HTTP request.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
BUBBLEWRAP can communicate using SOCKS.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
BUBBLEWRAP collects system information, including the operating system version and hostname.
MITRE ATT&CK technique: T1082: System Information Discovery
BUBBLEWRAP can communicate using HTTP or HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BUSHWALK can embed into the legitimate `querymanifest.cgi` file on compromised Ivanti Connect Secure VPNs.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
BUSHWALK can Base64 decode and RC4 decrypt malicious payloads sent through a web request’s command parameter.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BUSHWALK can write malicious payloads sent through a web request’s command parameter.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BUSHWALK can encrypt the resulting data generated from C2 commands with RC4.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
BUSHWALK can modify the `DSUserAgentCap.pm` Perl module on Ivanti Connect Secure VPNs and either activate or deactivate depending on the value of the user agent in incoming HTTP requests.
MITRE ATT&CK technique: T1205: Traffic Signaling
BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Babuk can use ChaCha8 and ECDH to encrypt data.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Babuk has the ability to unpack itself into memory using XOR.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Babuk can stop anti-virus services on a compromised host.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Babuk has the ability to enumerate files on a targeted system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.
MITRE ATT&CK technique: T1106: Native API
Babuk has the ability to enumerate network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
Babuk has the ability to check running processes on a targeted system.
MITRE ATT&CK technique: T1057: Process Discovery
Babuk can stop specific services related to backups.
MITRE ATT&CK technique: T1489: Service Stop
Versions of Babuk have been packed.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Babuk can enumerate disk volumes, get disk information, and query service status.
MITRE ATT&CK technique: T1082: System Information Discovery
Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Babuk can enumerate all services running on a compromised host.
MITRE ATT&CK technique: T1007: System Service Discovery
Babuk has the ability to use the command line to control execution on compromised hosts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BabyShark has the ability to decode downloaded files prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BabyShark has cleaned up all files associated with the secondary payload execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
BabyShark has used dir to search for "programfiles" and "appdata".
MITRE ATT&CK technique: T1083: File and Directory Discovery
BabyShark has downloaded additional files from the C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
BabyShark has used mshta.exe to download and execute applications from a remote server.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
BabyShark has executed the tasklist command.
MITRE ATT&CK technique: T1057: Process Discovery
BabyShark has executed the reg query command for HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default.
MITRE ATT&CK technique: T1012: Query Registry
BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
BabyShark has used scheduled tasks to maintain persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
BabyShark has encoded data using certutil before exfiltration.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
BabyShark has executed the ver command.
MITRE ATT&CK technique: T1082: System Information Discovery
BabyShark has executed the ipconfig /all command.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
BabyShark has executed the whoami command.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
BabyShark has used cmd.exe to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
BackConfig has used compressed and decimal encoded VBS scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
BackConfig has used a custom routine to decrypt strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BackConfig has the ability to remove files and folders related to previous infections.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
BackConfig has the ability to identify folders and files related to previous infections.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
BackConfig can download and execute additional payloads on a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BackConfig has compromised victims via links to URLs hosting malicious content.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
BackConfig has hidden malicious payloads in %USERPROFILE%\Adobe\Driver\dwg\ and mimicked the legitimate DHCP service binary.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.
MITRE ATT&CK technique: T1106: Native API
BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.
MITRE ATT&CK technique: T1137.001: Office Application Startup- Office Template Macros
BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
BackConfig has the ability to gather the victim's computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
BackConfig has the ability to use HTTPS for C2 communiations.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BackConfig can download and run batch files to execute commands on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.
MITRE ATT&CK technique: T1560: Archive Collected Data
Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Backdoor.Oldrea collects address book information from Outlook.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Backdoor.Oldrea can download additional modules from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.
MITRE ATT&CK technique: T1046: Network Service Discovery
Backdoor.Oldrea collects information about running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Backdoor.Oldrea injects itself into explorer.exe.
MITRE ATT&CK technique: T1055: Process Injection
Backdoor.Oldrea adds Registry Run keys to achieve persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.
MITRE ATT&CK technique: T1018: Remote System Discovery
Backdoor.Oldrea can use rundll32 for execution on compromised hosts.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Backdoor.Oldrea collects information about the OS and computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
Backdoor.Oldrea collects information about the Internet adapter configuration.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Backdoor.Oldrea collects the current username from the victim.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Bad Rabbit has attempted to bypass UAC and gain elevated administrative privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a .js file.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.
MITRE ATT&CK technique: T1495: Firmware Corruption
Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Bad Rabbit has masqueraded as a Flash Player installer through the executable file install_flash_player.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Bad Rabbit has used various Windows API calls.
MITRE ATT&CK technique: T1106: Native API
Bad Rabbit enumerates open SMB shares on internal victim networks.
MITRE ATT&CK technique: T1135: Network Share Discovery
Bad Rabbit’s infpub.dat file uses NTLM login credentials to brute force Windows machines.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
Bad Rabbit can enumerate all running processes to compare hashes.
MITRE ATT&CK technique: T1057: Process Discovery
Bad Rabbit has used rundll32 to launch a malicious DLL as C:Windowsinfpub.dat.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Bad Rabbit’s infpub.dat file creates a scheduled task to launch a malicious executable.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Bad Rabbit drops a file named infpub.datinto the Windows directory and is executed through SCManager and rundll.exe.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.
MITRE ATT&CK technique: T1005: Data from Local System
BadPatch searches for files with specific file extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BadPatch can download and execute or update malware.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BadPatch has a keylogging capability.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
BadPatch stores collected data in log files before exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
BadPatch uses SMTP for C2.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
BadPatch captures screenshots in .jpg format and then exfiltrates them.
MITRE ATT&CK technique: T1113: Screen Capture
BadPatch uses WMI to enumerate installed security products in the victim’s environment.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
BadPatch attempts to detect if it is being run in a Virtual Machine using a WMI query for disk drive name, BIOS, and motherboard information.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
BadPatch uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Bandook has modules that are capable of capturing audio.
MITRE ATT&CK technique: T1123: Audio Capture
Bandook was signed with valid Certum certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Bandook can support commands to execute Java-based payloads.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Bandook can collect local files from the system .
MITRE ATT&CK technique: T1005: Data from Local System
Bandook has decoded its PowerShell script.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Bandook can upload files from a victim's machine over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Bandook has a command to delete a file.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Bandook has a command to list files on a system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Bandook can download files to the system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Bandook contains keylogging capabilities.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Bandook has used lure documents to convince the user to enable macros.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Bandook has used the ShellExecuteW function call.
MITRE ATT&CK technique: T1106: Native API
Bandook has a command built in to use a raw TCP socket.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Bandook can detect USB devices.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Bandook has used PowerShell loaders as part of execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Bandook can support commands to execute Python-based payloads.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Bandook is capable of taking an image of and uploading the current desktop.
MITRE ATT&CK technique: T1113: Screen Capture
Bandook is delivered via a malicious Word document inside a zip file.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Bandook has used .PNG images within a zip file to build the executable.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Bandook has used AES encryption for C2 communication.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Bandook can collect information about the drives available on the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Bandook has a command to get the public IP address from a system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Bandook has modules that are capable of capturing video from a victim's webcam.
MITRE ATT&CK technique: T1125: Video Capture
Bandook has used malicious VBA code against the target system.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Bandook is capable of spawning a Windows command shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Bankshot recursively generates a list of files within a directory and sends them back to the control server.
MITRE ATT&CK technique: T1119: Automated Collection
Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
Bankshot collects files from the local system.
MITRE ATT&CK technique: T1005: Data from Local System
Bankshot decodes embedded XOR strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Bankshot gathers domain and account names/information through process monitoring.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Bankshot exfiltrates data over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Bankshot searches for files on the victim's machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Bankshot deletes all artifacts associated with the malware from the infected machine.
MITRE ATT&CK technique: T1070: Indicator Removal
Bankshot uploads files and secondary payloads to the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Bankshot gathers domain and account names/information through process monitoring.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.
MITRE ATT&CK technique: T1112: Modify Registry
Bankshot creates processes using the Windows API calls: CreateProcessA and CreateProcessAsUserA.
MITRE ATT&CK technique: T1106: Native API
Bankshot encodes commands from the control server using a range of characters and gzip.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.
MITRE ATT&CK technique: T1571: Non-Standard Port
Bankshot identifies processes and collects the process ids.
MITRE ATT&CK technique: T1057: Process Discovery
Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
Bankshot searches for certain Registry keys to be configured before executing the payload.
MITRE ATT&CK technique: T1012: Query Registry
Bankshot gathers system information, network addresses, disk type, disk free space, and the operation system version.
MITRE ATT&CK technique: T1082: System Information Discovery
Bankshot modifies the time of a file as specified by the control server.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Bankshot uses HTTP for command and control communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Bankshot uses the command-line interface to execute arbitrary commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Bankshot can terminate a specific process by its process id.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Bazar can use TLS in C2 communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Bazar has been downloaded via Windows BITS functionality.
MITRE ATT&CK technique: T1197: BITS Jobs
Bazar's loader can delete scheduled tasks created by a previous instance of the malware.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Bazar can retrieve information from the infected machine.
MITRE ATT&CK technique: T1005: Data from Local System
Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Bazar has the ability to identify domain administrator accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Bazar can implement DGA using the current date as a seed variable.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
Bazar can use Nltest tools to obtain information about the domain.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.
MITRE ATT&CK technique: T1036.007: Masquerading- Double File Extension
Bazar can hash then resolve API calls at runtime.
MITRE ATT&CK technique: T1027.007: Obfuscated Files or Information- Dynamic API Resolution
Bazar has used XOR, RSA2, and RC4 encrypted files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Bazar has the ability to use an alternative C2 server if the primary server fails.
MITRE ATT&CK technique: T1008: Fallback Channels
Bazar can delete its loader using a batch file in the Windows temporary folder.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Bazar can enumerate the victim's desktop.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Bazar can identify administrator accounts on an infected host.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Bazar can create a task named to appear benign.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
The Bazar loader has named malicious shortcuts "adobe" and mimicked communications software.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
The Bazar loader is used to download and execute the Bazar backdoor.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
Bazar can use various APIs to allocate memory and facilitate code execution/injection.
MITRE ATT&CK technique: T1106: Native API
Bazar can enumerate shared drives on the domain.
MITRE ATT&CK technique: T1135: Network Share Discovery
Bazar can execute a PowerShell script received from C2.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Bazar can identity the current process on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
Bazar can inject into a target process using process doppelgänging.
MITRE ATT&CK technique: T1055.013: Process Injection- Process Doppelgänging
Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Bazar can inject code through calling VirtualAllocExNuma.
MITRE ATT&CK technique: T1055: Process Injection
Bazar can query Windows\CurrentVersion\Uninstall for installed applications.
MITRE ATT&CK technique: T1012: Query Registry
Bazar can create or add files to Registry Run Keys to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Bazar can enumerate remote systems using Net View.
MITRE ATT&CK technique: T1018: Remote System Discovery
Bazar can create a scheduled task for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Bazar can identify the installed antivirus engine.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Bazar can establish persistence by writing shortcuts to the Windows Startup folder.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Bazar can query the Registry for installed applications.
MITRE ATT&CK technique: T1518: Software Discovery
Bazar has a variant with a packed payload.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Bazar has been spread via emails with embedded malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Bazar can send C2 communications with XOR encryption.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.
MITRE ATT&CK technique: T1082: System Information Discovery
Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Bazar can collect the IP address and NetBIOS name of an infected machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Bazar can identify the username of the infected user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Bazar can collect the time on the compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
Bazar can use a timer to delay execution of core functionality.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Bazar can attempt to overload sandbox analysis by sending 1550 calls to printf.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Bazar downloads have been hosted on Google Docs.
MITRE ATT&CK technique: T1102: Web Service
Bazar can launch cmd.exe to perform reconnaissance commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Bazar can execute a WMI query to gather information about the installed antivirus engine.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Bazar can use Winlogon Helper DLL to establish persistence.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BendyBear has encrypted payloads using RC4 and XOR.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
BendyBear is designed to download an implant from a C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BendyBear has used byte randomization to obscure its behavior.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
BendyBear can load and execute modules and Windows Application Programming calls using standard shellcode API hashing.
MITRE ATT&CK technique: T1106: Native API
BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
BendyBear changes its runtime footprint during code execution to evade signature-based defenses.
MITRE ATT&CK technique: T1027.014: Obfuscated Files or Information- Polymorphic Code
BendyBear can query the host's Registry key at HKEY_CURRENT_USER\Console\QuickEdit to retrieve data.
MITRE ATT&CK technique: T1012: Query Registry
BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
BendyBear has the ability to determine local time on a compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
BendyBear can check for analysis environments and signs of debugging using the Windows API kernel32!GetTickCountKernel32 call.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Bisonal has been loaded through a `.wll` extension added to the ` %APPDATA%\microsoft\word\startup\` repository.
MITRE ATT&CK technique: T1137.006: Office Application Startup- Add-ins
Bisonal has appended random binary data to the end of itself to generate a large binary.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Bisonal has collected information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Bisonal has decoded strings in the malware using XOR and RC4.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Bisonal has used a dynamic DNS service for C2.
MITRE ATT&CK technique: T1568: Dynamic Resolution
Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Bisonal has added the exfiltrated data to the URL over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Bisonal will delete its dropper and VBS scripts from the victim’s machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Bisonal can retrieve a file listing from the system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Bisonal has the capability to download files to execute on the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.
MITRE ATT&CK technique: T1036: Masquerading
Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Bisonal has deleted Registry keys to clean up its prior activity.
MITRE ATT&CK technique: T1112: Modify Registry
Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.
MITRE ATT&CK technique: T1106: Native API
Bisonal has used raw sockets for network communication.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Bisonal can obtain a list of running processes on the victim’s machine.
MITRE ATT&CK technique: T1057: Process Discovery
Bisonal has supported use of a proxy server.
MITRE ATT&CK technique: T1090: Proxy
Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.
MITRE ATT&CK technique: T1012: Query Registry
Bisonal has added itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Bisonal has used the MPRESS packer and similar tools for obfuscation.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Bisonal has been delivered as malicious email attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Bisonal has encoded binary data with Base64 and ASCII.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Bisonal has used commands and API calls to gather system information.
MITRE ATT&CK technique: T1082: System Information Discovery
Bisonal can execute ipconfig on the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Bisonal can check the system time set on the infected host.
MITRE ATT&CK technique: T1124: System Time Discovery
Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount to compare the timing.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Bisonal can check to determine if the compromised system is running on VMware.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Bisonal's dropper creates VBS scripts on the victim’s machine.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Bisonal has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Bisonal has launched cmd.exe and used the ShellExecuteW API function to execute commands on the system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Bisonal has been modified to be used as a Windows service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7 and launching the eventvwr.msc process, which launches BitPaymer with elevated privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending .locked to the filename.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.
MITRE ATT&CK technique: T1480: Execution Guardrails
BitPaymer attempts to remove the backup shadow files from the host using vssadmin.exe Delete Shadows /All /Quiet.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
BitPaymer can enumerate the sessions for each user logged onto the infected host.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
BitPaymer can set values in the Registry to help in execution.
MITRE ATT&CK technique: T1112: Modify Registry
BitPaymer has copied itself to the :bin alternate data stream of a newly created file.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.
MITRE ATT&CK technique: T1106: Native API
BitPaymer can search for network shares on the domain or workgroup using net view .
MITRE ATT&CK technique: T1135: Network Share Discovery
BitPaymer can use the RegEnumKeyW to iterate through Registry keys.
MITRE ATT&CK technique: T1012: Query Registry
BitPaymer has set the run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
BitPaymer can use net view to discover remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.
MITRE ATT&CK technique: T1007: System Service Discovery
BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
BitPaymer can use the tokens of users to create processes on infected systems.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
BitPaymer can use icacls /reset and takeown /F to reset a targeted executable's permissions and then take ownership.
MITRE ATT&CK technique: T1222.001: File and Directory Permissions Modification- Windows File and Directory Permissions Modification
BitPaymer has attempted to install itself as a service to maintain persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Black Basta had added data prior to the Portable Executable header to prevent automatic scanners from identifying the payload.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
The Black Basta dropper has been digitally signed with a certificate issued by Akeo Consulting for legitimate executables used for creating bootable USB drives.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Black Basta can encrypt files with the ChaCha20 cypher and using a multithreaded process to increase speed.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
The Black Basta dropper can check system flags, CPU registers, CPU instructions, process timing, system libraries, and APIs to determine if a debugger is present.
MITRE ATT&CK technique: T1622: Debugger Evasion
Black Basta can enumerate specific files for encryption.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Black Basta can delete shadow copies using vssadmin.exe.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Black Basta has set the desktop wallpaper on victims' machines to display a ransom note.
MITRE ATT&CK technique: T1491.001: Defacement- Internal Defacement
The Black Basta binary can use `chmod` to gain full permissions to targeted files.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
Black Basta has been downloaded and executed from malicious Excel files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Black Basta has established persistence by creating a new service named `FAX` after deleting the legitimate service by the same name.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
The Black Basta dropper has mimicked an application for creating USB bootable drivers.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Black Basta can modify the Registry to enable itself to run in safe mode and to modify the icons and file extensions for encrypted files.
MITRE ATT&CK technique: T1112: Modify Registry
Black Basta will check for the presence of a hard-coded mutex `dsajdhas.0` before executing.
MITRE ATT&CK technique: T1480.002: Execution Guardrails- Mutual Exclusion
Black Basta has the ability to use native APIs for numerous functions including discovery and defense evasion.
MITRE ATT&CK technique: T1106: Native API
Black Basta has used PowerShell scripts for discovery and to execute files over the network.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Black Basta can use LDAP queries to connect to AD and iterate over connected workstations.
MITRE ATT&CK technique: T1018: Remote System Discovery
Black Basta can reboot victim machines in safe mode with networking via `bcdedit /set safeboot network`.
MITRE ATT&CK technique: T1562.009: Impair Defenses- Safe Mode Boot
Black Basta can check system flags and libraries, process timing, and API's to detect code emulation or sandboxing.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Black Basta can enumerate volumes and collect system boot configuration and CPU information.
MITRE ATT&CK technique: T1082: System Information Discovery
Black Basta can check whether the service name FAX is present.
MITRE ATT&CK technique: T1007: System Service Discovery
Black Basta can make a random number of calls to the `kernel32.beep` function to hinder log analysis.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Black Basta can use `cmd.exe` to enable shadow copy deletion.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Black Basta has used WMI to execute files over the network.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Black Basta can create a new service to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
BlackCat has the ability modify access tokens.
MITRE ATT&CK technique: T1134: Access Token Manipulation
BlackCat can bypass UAC to escalate privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
BlackCat can clear Windows event logs using `wevtutil.exe`.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
BlackCat has the ability to encrypt Windows devices, Linux devices, and VMWare instances.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
BlackCat has the ability to wipe VM snapshots on compromised networks.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
BlackCat can utilize `net use` commands to identify domain users.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
BlackCat can determine if a user on a compromised host has domain admin privileges.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
BlackCat can enumerate files for encryption.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BlackCat can delete shadow copies using `vssadmin.exe delete shadows /all /quiet` and `wmic.exe Shadowcopy Delete`; it can also modify the boot loader using `bcdedit /set {default} recoveryenabled No`.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
BlackCat can change the desktop wallpaper on compromised hosts.
MITRE ATT&CK technique: T1491.001: Defacement- Internal Defacement
BlackCat can replicate itself across connected servers via `psexec`.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters`
MITRE ATT&CK technique: T1112: Modify Registry
BlackCat has the ability to discover network shares on compromised networks.
MITRE ATT&CK technique: T1135: Network Share Discovery
BlackCat can broadcasts NetBIOS Name Service messages to search for servers connected to compromised networks.
MITRE ATT&CK technique: T1018: Remote System Discovery
BlackCat has the ability to stop VM services on compromised networks.
MITRE ATT&CK technique: T1489: Service Stop
BlackCat can obtain the computer name and UUID, and enumerate local drives.
MITRE ATT&CK technique: T1082: System Information Discovery
BlackCat can utilize `net use` commands to discover the user name on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
BlackCat can execute commands on a compromised network with the use of `cmd.exe`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell