sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Prestige has leveraged the CryptoPP C++ library to encrypt files on target systems using AES and appended filenames with `.enc`.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Prestige can traverse the file system to discover files to encrypt by identifying specific extensions defined in a hardcoded list.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Prestige has been deployed using the Default Domain Group Policy Object from an Active Directory Domain Controller.
MITRE ATT&CK technique: T1484.001: Domain or Tenant Policy Modification- Group Policy Modification
Prestige can delete the backup catalog from the target system using: `c:\Windows\System32\wbadmin.exe delete catalog -quiet` and can also delete volume shadow copies using: `\Windows\System32\vssadmin.exe delete shadows /all /quiet`.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Prestige has the ability to register new registry keys for a new extension handler via `HKCR\.enc` and `HKCR\enc\shell\open\command`.
MITRE ATT&CK technique: T1112: Modify Registry
Prestige has used the `Wow64DisableWow64FsRedirection` and `Wow64RevertWow64FsRedirection` functions to disable and restore file system redirection.
MITRE ATT&CK technique: T1106: Native API
Prestige can use PowerShell for payload execution on targeted systems.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Prestige has been executed on a target system through a scheduled task created by Sandworm Team using Impacket.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using `C:\Windows\System32\net.exe stop MSSQLSERVER`.
MITRE ATT&CK technique: T1489: Service Stop
After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.
MITRE ATT&CK technique: T1560: Archive Collected Data
A module in Prikormka collects passwords stored in applications installed on the victim.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.
MITRE ATT&CK technique: T1025: Data from Removable Media
Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
A module in Prikormka collects information on available printers and disk drives.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Prikormka uses rundll32.exe to load its DLL.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Prikormka contains a module that captures screenshots of the victim's desktop.
MITRE ATT&CK technique: T1113: Screen Capture
A module in Prikormka collects information from the victim about installed anti-virus software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Prikormka encodes C2 traffic with Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Prikormka encrypts some C2 traffic with the Blowfish cipher.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.
MITRE ATT&CK technique: T1082: System Information Discovery
A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
A module in Prikormka collects information from the victim about the current user name.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
ProLock can use BITS jobs to download its malicious payload.
MITRE ATT&CK technique: T1197: BITS Jobs
ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
ProLock can remove files containing its payload after they are executed.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ProLock can use vssadmin.exe to remove volume shadow copies.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
ProLock can use .jpg and .bmp files to store its payload.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
ProLock can use WMIC to execute scripts on targeted hosts.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Proton zips up files before exfiltrating them.
MITRE ATT&CK technique: T1560: Archive Collected Data
Proton removes logs from /var/logs and /Library/logs.
MITRE ATT&CK technique: T1070.002: Indicator Removal- Clear Linux or Mac System Logs
Proton gathers credentials for Google Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Proton uses an encrypted file to store commands and configuration values.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Proton kills security tools like Wireshark that are running.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Proton removes all files in the /tmp directory.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Proton prompts users for their credentials.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
Proton gathers credentials in files for keychains.
MITRE ATT&CK technique: T1555.001: Credentials from Password Stores- Keychain
Proton uses a keylogger to capture keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Proton persists via Launch Agent.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
Proton gathers credentials in files for 1password.
MITRE ATT&CK technique: T1555.005: Credentials from Password Stores- Password Managers
Proton captures the content of the desktop with the screencapture binary.
MITRE ATT&CK technique: T1113: Screen Capture
Proton modifies the tty_tickets line in the sudoers file.
MITRE ATT&CK technique: T1548.003: Abuse Elevation Control Mechanism- Sudo and Sudo Caching
Proton uses macOS' .command file type to script actions.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Proton uses VNC to connect into systems.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
Proxysvc automatically collects data about the victim and sends it to the control server.
MITRE ATT&CK technique: T1119: Automated Collection
Proxysvc can overwrite files indicated by the attacker before deleting them.
MITRE ATT&CK technique: T1485: Data Destruction
Proxysvc searches the local system and gathers data.
MITRE ATT&CK technique: T1005: Data from Local System
Proxysvc performs data exfiltration over the control server channel using a custom protocol.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Proxysvc lists files in directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Proxysvc lists processes running on the system.
MITRE ATT&CK technique: T1057: Process Discovery
Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.
MITRE ATT&CK technique: T1012: Query Registry
Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Proxysvc collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Proxysvc collects the network adapter information and domain/username information based on current remote sessions.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.
MITRE ATT&CK technique: T1124: System Time Discovery
Proxysvc uses HTTP over SSL to communicate commands with the control server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c " > %temp%\PM* .tmp 2>&1".
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PsExec has the ability to remotely create accounts on target systems.
MITRE ATT&CK technique: T1136.002: Create Account- Domain Account
PsExec can be used to download or upload a file over a network share.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
PsExec, a tool that has been used by adversaries, writes programs to the ADMIN$ network share to execute commands on remote systems.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the -s argument.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Psylo has a command to download a file to the system from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Psylo uses HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Pteranodon can decrypt encrypted data strings prior to using them.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Pteranodon can use a dynamic Windows hashing algorithm to map API components.
MITRE ATT&CK technique: T1027.007: Obfuscated Files or Information- Dynamic API Resolution
Pteranodon exfiltrates screenshot files to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Pteranodon can download and execute additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\\AppData\Roaming\Microsoft\store to store screenshot JPEG files.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Pteranodon has used various API calls.
MITRE ATT&CK technique: T1106: Native API
Pteranodon copies itself to the Startup folder to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Pteranodon executes functions using rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Pteranodon schedules tasks to invoke its components in order to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Pteranodon can capture screenshots at a configurable interval.
MITRE ATT&CK technique: T1113: Screen Capture
Pteranodon has the ability to use anti-detection functions to identify sandbox environments.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Pteranodon can use a malicious VBS file for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Pteranodon can use HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Pteranodon can use `cmd.exe` for execution on victim systems.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Pupy can compress data with Zip before sending it over C2.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Pupy can record sound with the microphone.
MITRE ATT&CK technique: T1123: Audio Capture
Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Pupy can use Lazagne for harvesting credentials.
MITRE ATT&CK technique: T1003.005: OS Credential Dumping- Cached Domain Credentials
Pupy has a module to clear event logs with PowerShell.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Pupy can use Lazagne for harvesting credentials.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Pupy can use Lazagne for harvesting credentials.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Pupy can use Lazagne for harvesting credentials.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Pupy can user PowerView to execute “net user” commands and create domain accounts.
MITRE ATT&CK technique: T1136.002: Create Account- Domain Account
Pupy can migrate into another process using reflective DLL injection.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Pupy can walk through directories and recursively search for strings in files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Pupy can upload and download to/from a victim machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.
MITRE ATT&CK technique: T1557.001: Adversary-in-the-Middle- LLMNR/NBT-NS Poisoning and SMB Relay
Pupy can use Lazagne for harvesting credentials.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
Pupy can execute Lazagne as well as Mimikatz using PowerShell.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Pupy can user PowerView to execute “net user” commands and create local system accounts.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Pupy can interact with a victim’s Outlook session and look through folders and emails.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Pupy has a built-in module for port scanning.
MITRE ATT&CK technique: T1046: Network Service Discovery
Pupy can list local and remote shared drives and folders over SMB.
MITRE ATT&CK technique: T1135: Network Share Discovery
Pupy can also perform pass-the-ticket.
MITRE ATT&CK technique: T1550.003: Use Alternate Authentication Material- Pass the Ticket
Pupy has a module for loading and executing PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Pupy can list the running processes and get the process ID and parent process’s ID.
MITRE ATT&CK technique: T1057: Process Discovery
Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts to perform tasks offline such as sandbox detection, adding persistence, etc.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Pupy adds itself to the startup folder or adds itself to the Registry key SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.
MITRE ATT&CK technique: T1113: Screen Capture
Pupy uses PsExec to execute a payload or commands on a remote host.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Pupy can grab a system’s information including the OS version, architecture, etc.
MITRE ATT&CK technique: T1082: System Information Discovery
Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Pupy has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Pupy can be used to establish persistence using a systemd service.
MITRE ATT&CK technique: T1543.002: Create or Modify System Process- Systemd Service
Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
Pupy can access a connected webcam and capture pictures.
MITRE ATT&CK technique: T1125: Video Capture
Pupy can communicate over HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Pupy can use an XDG Autostart to establish persistence.
MITRE ATT&CK technique: T1547.013: Boot or Logon Autostart Execution- XDG Autostart Entries
PyDCrypt has decrypted and dropped the DCSrv payload to disk.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
PyDCrypt has modified firewall rules to allow incoming SMB, NetBIOS, and RPC connections using `netsh.exe` on remote machines.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
PyDCrypt has been compiled and encrypted with PyInstaller, specifically using the --key flag during the build phase.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
PyDCrypt will remove all created artifacts such as dropped executables.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
PyDCrypt has dropped DCSrv under the `svchost.exe` name to disk.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
PyDCrypt has attempted to execute with PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
PyDCrypt, along with its functions, is written in Python.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
PyDCrypt has used netsh to find RPC connections on remote machines.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
PyDCrypt has probed victim machines with whoami and has collected the username from the machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
PyDCrypt has used `cmd.exe` for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PyDCrypt has attempted to execute with WMIC.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.
MITRE ATT&CK technique: T1110: Brute Force
Pysa has extracted credentials from the password database before encrypting the files.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Pysa has the capability to stop antivirus services and disable Windows Defender.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Pysa has deleted batch files after execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Pysa has the functionality to delete shadow copies.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Pysa can perform OS credential dumping using Mimikatz.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Pysa has executed a malicious executable by naming it svchost.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Pysa has modified the registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” and added the ransom note.
MITRE ATT&CK technique: T1112: Modify Registry
Pysa can perform network reconnaissance using the Advanced Port Scanner tool.
MITRE ATT&CK technique: T1046: Network Service Discovery
Pysa has used Powershell scripts to deploy its ransomware.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Pysa has used Python scripts to deploy ransomware.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Pysa has laterally moved using RDP connections.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Pysa has used PsExec to copy and execute the ransomware.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Pysa can stop services and processes.
MITRE ATT&CK technique: T1489: Service Stop
Pysa can perform network reconnaissance using the Advanced IP Scanner tool.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
QUADAGENT was likely obfuscated using `Invoke-Obfuscation`.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
QUADAGENT uses DNS for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
QUADAGENT uses multiple protocols for its C2 server as fallback channels if communication with one is unsuccessful.
MITRE ATT&CK technique: T1008: Fallback Channels
QUADAGENT has a command to delete its Registry key and scheduled task.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key in the `HKCU` hive.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
QUADAGENT used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.
MITRE ATT&CK technique: T1112: Modify Registry
QUADAGENT uses PowerShell scripts for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.
MITRE ATT&CK technique: T1012: Query Registry
QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
QUADAGENT encodes C2 communications with base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
QUADAGENT gathers the current domain the victim system belongs to.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
QUADAGENT gathers the victim username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
QUADAGENT uses VBScripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
QUADAGENT uses HTTPS and HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
QUIETCANARY has the ability to stage data prior to exfiltration.
MITRE ATT&CK technique: T1074: Data Staged
QUIETCANARY can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
QUIETCANARY can execute processes in a hidden window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
QUIETCANARY can call `System.Net.HttpWebRequest` to identify the default proxy configured on the victim computer.
MITRE ATT&CK technique: T1106: Native API
QUIETCANARY has the ability to retrieve information from the Registry.
MITRE ATT&CK technique: T1012: Query Registry
QUIETCANARY can base64 encode C2 communications.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
QUIETCANARY can RC4 encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
QUIETCANARY can identify the default proxy setting on a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
QUIETCANARY can use HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
QUIETEXIT can use an inverse negotiated SSH connection as part of its C2.
MITRE ATT&CK technique: T1071: Application Layer Protocol
QUIETEXIT can proxy traffic via SOCKS.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
QUIETEXIT can attempt to connect to a second hard-coded C2 if the first hard-coded C2 address fails.
MITRE ATT&CK technique: T1008: Fallback Channels
QUIETEXIT has attempted to change its name to `cron` upon startup. During incident response, QUIETEXIT samples have been identified that were renamed to blend in with other legitimate files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
QUIETEXIT can establish a TCP connection as part of its initial connection to the C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
QakBot has the ability to enumerate windows on a compromised host.
MITRE ATT&CK technique: T1010: Application Window Discovery
QakBot can use large file sizes to evade detection.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
QakBot can use advanced web injects to steal web banking credentials.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
QakBot can conduct brute force attacks to capture credentials.
MITRE ATT&CK technique: T1110: Brute Force
QakBot can use signed loaders to evade detection.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
QakBot can use obfuscated and encoded scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
QakBot has collected usernames and passwords from Firefox and Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
QakBot has the ability to use DLL side-loading for execution.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.
MITRE ATT&CK technique: T1005: Data from Local System
QakBot can deobfuscate and re-assemble code strings for execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
QakBot can use domain generation algorithms in C2 communication.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
QakBot can run nltest /domain_trusts /all_trusts for domain trust discovery.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
QakBot can move laterally using worm-like functionality through exploitation of SMB.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
QakBot has a module that can proxy C2 communications.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
QakBot can delete folders and files including overwriting its executable with legitimate programs.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
QakBot can identify whether it has been run previously on a host by checking for a specified folder.
MITRE ATT&CK technique: T1083: File and Directory Discovery
QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
QakBot has been delivered in ZIP files via HTML smuggling.
MITRE ATT&CK technique: T1027.006: Obfuscated Files or Information- HTML Smuggling
QakBot has placed its payload in hidden subdirectories.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
QakBot can make small changes to itself in order to change its checksum and hash value.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
QakBot has the ability to download additional components and malware.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
QakBot can measure the download speed on a targeted host.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
The QakBot web inject module can inject Java Script into web banking pages visited by the victim.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
QakBot can capture keystrokes on a compromised host.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
QakBot has stored stolen emails and other data into new folders prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
QakBot can use net localgroup to enable discovery of local groups.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
QakBot has gained execution through users opening malicious attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
QakBot has gained execution through users opening malicious links.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
QakBot has been packaged in ISO files in order to bypass Mark of the Web security measures.
MITRE ATT&CK technique: T1553.005: Subvert Trust Controls- Mark-of-the-Web Bypass
The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.
MITRE ATT&CK technique: T1036.008: Masquerading- Masquerade File Type
QakBot can modify the Registry to store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.
MITRE ATT&CK technique: T1112: Modify Registry
QakBot can use MSIExec to spawn multiple cmd.exe processes.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
QakBot can use GetProcAddress to help delete malicious strings from memory.
MITRE ATT&CK technique: T1106: Native API
QakBot can use net share to identify network shares for use in lateral movement.
MITRE ATT&CK technique: T1135: Network Share Discovery
QakBot has the ability use TCP to send or receive C2 packets.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
QakBot has hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
QakBot can identify peripheral devices on targeted systems.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
QakBot can use PowerShell to download and execute payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
QakBot has the ability to check running processes.
MITRE ATT&CK technique: T1057: Process Discovery
QakBot can use process hollowing to execute its main payload.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
QakBot can inject itself into processes including explore.exe, Iexplore.exe, Mobsync.exe., and wermgr.exe.
MITRE ATT&CK technique: T1055: Process Injection
The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.
MITRE ATT&CK technique: T1572: Protocol Tunneling
QakBot can maintain persistence by creating an auto-run Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
QakBot can use Regsvr32 to execute malicious DLLs.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
QakBot can identify remote systems through the net view command.
MITRE ATT&CK technique: T1018: Remote System Discovery
QakBot has the ability to use removable drives to spread through compromised networks.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
QakBot has the ability to create scheduled tasks for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
QakBot can identify the installed antivirus product on a targeted system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
QakBot can enumerate a list of installed programs.
MITRE ATT&CK technique: T1518: Software Discovery
QakBot can encrypt and pack malicious payloads.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
QakBot has spread through emails with malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
QakBot has spread through emails with malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
QakBot can Base64 encode system information sent to C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
QakBot has the ability to capture web session cookies.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
QakBot can RC4 encrypt strings in C2 communication.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
QakBot can collect system information including the OS version and domain on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
QakBot can use net config workstation, arp -a, `nslookup`, and ipconfig /all to gather network configuration information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
QakBot can use netstat to enumerate current network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
QakBot can identify the user name on a compromised system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
QakBot can identify the system time on a targeted host.
MITRE ATT&CK technique: T1124: System Time Discovery
The QakBot dropper can delay dropping the payload to evade detection.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
QakBot can use VBS to download and execute malicious files.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
QakBot can execute WMI queries to gather information.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
QakBot can remotely create a temporary service on a target host.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
QuasarRAT can generate a UAC pop-up Window to prompt the target user to run a command as the administrator.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
QuasarRAT can obtain passwords from FTP clients.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
QuasarRAT can obtain passwords from common FTP clients.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
QuasarRAT can obtain passwords from common web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
QuasarRAT can retrieve files from compromised client machines.
MITRE ATT&CK technique: T1005: Data from Local System
QuasarRAT has the ability to set file attributes to "hidden" to hide files from the compromised user's view in Windows File Explorer.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string `Mozilla/5.0 AppleWebKit/537.75.14 Version/7.0.3 Safari/7046A194A` though QuasarRAT can only be run on Windows systems.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
QuasarRAT can download files to the victim’s machine and execute them.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
QuasarRAT has a built-in keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
QuasarRAT has a command to edit the Registry on the victim’s machine.
MITRE ATT&CK technique: T1112: Modify Registry
QuasarRAT can use TCP for C2 communication.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
QuasarRAT can use port 4782 on the compromised host for TCP callbacks.
MITRE ATT&CK technique: T1571: Non-Standard Port
QuasarRAT can communicate over a reverse proxy using SOCKS5.
MITRE ATT&CK technique: T1090: Proxy
If the QuasarRAT client process does not have administrator privileges it will add a registry key to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
QuasarRAT has a module for performing remote desktop access.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
QuasarRAT can gather system information from the victim’s machine including the OS type.
MITRE ATT&CK technique: T1082: System Information Discovery
QuasarRAT can determine the country a victim host is located in.
MITRE ATT&CK technique: T1614: System Location Discovery
QuasarRAT has the ability to enumerate the Wide Area Network IP through requests to ip-api.com, freegeoip.net, or api.ipify.org observed with user-agent string `Mozilla/5.0 Gecko/20100101 Firefox/48.0`.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
QuasarRAT can enumerate the username and account type.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
QuasarRAT can perform webcam viewing.
MITRE ATT&CK technique: T1125: Video Capture
QuasarRAT can launch a remote shell to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
QuietSieve can collect files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.
MITRE ATT&CK technique: T1083: File and Directory Discovery
QuietSieve has the ability to execute payloads in a hidden window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
QuietSieve can download and execute payloads on a target host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 .
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
QuietSieve can identify and search networked drives for specific file name extensions.
MITRE ATT&CK technique: T1135: Network Share Discovery
QuietSieve can identify and search removable drives for specific file name extensions.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\SymbolSourceSymbols\icons` or `Temp\ModeAuto\icons`.
MITRE ATT&CK technique: T1113: Screen Capture
QuietSieve can use HTTPS in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
RAPIDPULSE retrieves files from the victim system via encrypted commands sent to the web shell.
MITRE ATT&CK technique: T1005: Data from Local System
RAPIDPULSE listens for specific HTTP query parameters in received communications. If specific parameters match, a hard-coded RC4 key is used to decrypt the HTTP query paremter hmacTime. This decrypts to a filename that is then open, read, encrypted with the same RC4 key, base64-encoded, written to standard out, then passed as a response to the HTTP request.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
RAPIDPULSE has the ability to RC4 encrypt and base64 encode decrypted files on compromised servers prior to writing them to stdout.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
RAPIDPULSE is a web shell that is capable of arbitrary file read on targeted web servers to exfiltrate items of interest on the victim device.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.
MITRE ATT&CK technique: T1083: File and Directory Discovery
RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RARSTONE uses SSL to encrypt its communication with its C2 server.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
RATANKBA performs a reflective DLL injection using a given pid.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
RATANKBA uploads and downloads information.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RATANKBA uses the net user command.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
RATANKBA lists the system’s processes.
MITRE ATT&CK technique: T1057: Process Discovery
RATANKBA uses the command reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”.
MITRE ATT&CK technique: T1012: Query Registry
RATANKBA runs the net view /domain and net view commands.
MITRE ATT&CK technique: T1018: Remote System Discovery
RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.
MITRE ATT&CK technique: T1082: System Information Discovery
RATANKBA gathers the victim’s IP address via the ipconfig -all command.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
RATANKBA uses netstat -ano to search for specific IP address ranges.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
RATANKBA runs the whoami and query user commands.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
RATANKBA uses tasklist /svc to display running tasks.
MITRE ATT&CK technique: T1007: System Service Discovery
RATANKBA uses HTTP/HTTPS for command and control communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
RATANKBA uses cmd.exe to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
RATANKBA uses WMI to perform process monitoring.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
RCSession can bypass UAC to escalate privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
RCSession can be installed via DLL side-loading.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
RCSession can collect data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System