sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Linfo creates a backdoor through which remote attackers can retrieve system information.
MITRE ATT&CK technique: T1082: System Information Discovery
Linfo creates a backdoor through which remote attackers can start a remote shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.
MITRE ATT&CK technique: T1132: Data Encoding
Linux Rabbit attempts to gain access to the server via SSH.
MITRE ATT&CK technique: T1133: External Remote Services
Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Linux Rabbit maintains persistence on an infected machine through rc.local and .bashrc files.
MITRE ATT&CK technique: T1546.004: Event Triggered Execution- Unix Shell Configuration Modification
Linux Rabbit acquires valid SSH accounts through brute force.
MITRE ATT&CK technique: T1078: Valid Accounts
LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
LiteDuke can securely delete files by first writing random data to the file.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
LiteDuke has the ability to download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
LiteDuke can query the Registry to check for the presence of HKCU\Software\KasperskyLab.
MITRE ATT&CK technique: T1012: Query Registry
LiteDuke can create persistence by adding a shortcut in the CurrentVersion\Run Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
LiteDuke has the ability to check for the presence of Kaspersky security software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
LiteDuke has been packed with multiple layers of encryption.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
LiteDuke has used image files to hide its loader component.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
LiteDuke can enumerate the CPUID and BIOS version on a compromised system.
MITRE ATT&CK technique: T1082: System Information Discovery
LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
LiteDuke can enumerate the account name on a targeted system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
LiteDuke can wait 30 seconds before executing additional code if security software is detected.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
LiteDuke can use HTTP GET requests in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
LitePower can send collected data, including screenshots, over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
LitePower has the ability to download payloads containing system commands to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
LitePower can use various API calls.
MITRE ATT&CK technique: T1106: Native API
LitePower can use a PowerShell script to execute commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
LitePower can query the Registry for keys added to execute COM hijacking.
MITRE ATT&CK technique: T1012: Query Registry
LitePower can create a scheduled task to enable persistence mechanisms.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
LitePower can take system screenshots and save them to `%AppData%`.
MITRE ATT&CK technique: T1113: Screen Capture
LitePower can identify installed AV software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
LitePower has the ability to list local drives and enumerate the OS architecture.
MITRE ATT&CK technique: T1082: System Information Discovery
LitePower can determine if the current user has admin privileges.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
LitePower can use HTTP and HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Lizar has encrypted data before sending it to the server.
MITRE ATT&CK technique: T1560: Archive Collected Data
Lizar can retrieve browser history and database files.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Lizar has a module to collect usernames and passwords stored in browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Lizar can decrypt its configuration data.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Lizar has used the PowerKatz plugin that can be loaded into the address space of a PowerShell process through reflective DLL loading.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
Lizar can support encrypted communications between the client and server.
MITRE ATT&CK technique: T1573: Encrypted Channel
Lizar can download additional plugins, files, and tools.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Lizar can run Mimikatz to harvest credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Lizar has used various Windows API functions on a victim's machine.
MITRE ATT&CK technique: T1106: Native API
Lizar can execute PE files in the address space of the specified process.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
Lizar has used PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Lizar has a plugin designed to obtain a list of processes.
MITRE ATT&CK technique: T1057: Process Discovery
Lizar can migrate the loader into another process.
MITRE ATT&CK technique: T1055: Process Injection
Lizar can take JPEG screenshots of an infected system.
MITRE ATT&CK technique: T1113: Screen Capture
Lizar can search for processes associated with an anti-virus product from list.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Lizar can collect the computer name from the machine,.
MITRE ATT&CK technique: T1082: System Information Discovery
Lizar can retrieve network information from a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Lizar has a plugin to retrieve information about all active network sessions on the infected server.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Lizar can collect the username from the system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Lizar has a command to open the command-line on the infected system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
LoFiSe can collect files into password-protected ZIP-archives for exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
LoFiSe can collect all the files from the working directory every three hours and place them into a password-protected archive for further exfiltration.
MITRE ATT&CK technique: T1119: Automated Collection
LoFiSe has been executed as a file named DsNcDiag.dll through side-loading.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
LoFiSe can collect files of interest from targeted systems.
MITRE ATT&CK technique: T1005: Data from Local System
LoFiSe can monitor the file system to identify files less than 6.4 MB in size with file extensions including .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .tif, .odt, .ods, .odp, .eml, and .msg.
MITRE ATT&CK technique: T1083: File and Directory Discovery
LoFiSe can save files to be evaluated for further exfiltration in the `C:\Programdata\Microsoft\` and `C:\windows\temp\` folders.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’.
MITRE ATT&CK technique: T1112: Modify Registry
LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’ in order to execute its payload during Windows startup.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.
MITRE ATT&CK technique: T1014: Rootkit
LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.
MITRE ATT&CK technique: T1542.001: Pre-OS Boot- System Firmware
LockerGoga has been observed changing account passwords and logging off current users.
MITRE ATT&CK technique: T1531: Account Access Removal
LockerGoga has been signed with stolen certificates in order to make it look more legitimate.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
LockerGoga has been observed deleting its original launcher after execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
LockerGoga has been observed shutting down infected systems.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
Lokibot has utilized multiple techniques to bypass UAC.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Lokibot has the ability to initiate contact with command and control to exfiltrate stolen data.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Lokibot will delete its dropped files after bypassing UAC.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Lokibot can search for specific files on an infected host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Lokibot has the ability to copy itself to a hidden file and directory.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Lokibot downloaded several staged items onto the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Lokibot has the ability to capture input on the compromised host via keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Lokibot has modified the Registry as part of its UAC bypass process.
MITRE ATT&CK technique: T1112: Modify Registry
Lokibot has used LoadLibrary, GetProcAddress and CreateRemoteThread API functions to execute its shellcode.
MITRE ATT&CK technique: T1106: Native API
Lokibot has obfuscated strings with base64 encoding.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Lokibot has used PowerShell commands embedded inside batch scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Lokibot has used process hollowing to inject itself into legitimate Windows process.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Lokibot has reflectively loaded the decoded DLL into memory.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.
MITRE ATT&CK technique: T1053: Scheduled Task/Job
Lokibot has used several packing methods for obfuscation.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Lokibot has the ability to discover the computer name and Windows product name/version.
MITRE ATT&CK technique: T1082: System Information Discovery
Lokibot has the ability to discover the domain name of the infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Lokibot has the ability to discover the username on the infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Lokibot has performed a time-based anti-debug check before downloading its third stage.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Lokibot has used VBS scripts and XLS macros for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Lokibot has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Lokibot has used cmd /c commands embedded within batch scripts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
LookBack side loads its communications module as a DLL into the libcurl.dll loader.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
LookBack has a function that decrypts malicious data.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
LookBack removes itself after execution and can delete files on the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
LookBack can retrieve file listings from the victim machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
LookBack has a C2 proxy tool that masquerades as GUP.exe, which is software used by Notepad++.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
LookBack uses a custom binary protocol over sockets for C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
LookBack can list running processes.
MITRE ATT&CK technique: T1057: Process Discovery
LookBack sets up a Registry Run key to establish a persistence mechanism.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
LookBack can take desktop screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
LookBack can kill processes and delete services.
MITRE ATT&CK technique: T1489: Service Stop
LookBack uses a modified version of RC4 for data transfer.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
LookBack can enumerate services on the victim machine.
MITRE ATT&CK technique: T1007: System Service Discovery
LookBack can shutdown and reboot the victim machine.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
LookBack’s C2 proxy tool sends data to a C2 server over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
LookBack executes the cmd.exe command.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
LoudMiner has obfuscated various scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
LoudMiner is typically bundled with pirated copies of Virtual Studio Technology for Windows and macOS.
MITRE ATT&CK technique: T1189: Drive-by Compromise
LoudMiner has encrypted DMG files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
LoudMiner deleted installation files after completion.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
LoudMiner used SCP to update the miner from the C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
LoudMiner adds plist files with the naming format com.random_name.plist in the /Library/LaunchDaemons folder with the RunAtLoad and KeepAlive keys set to true.
MITRE ATT&CK technique: T1543.004: Create or Modify System Process- Launch Daemon
LoudMiner launched the QEMU services in the /Library/LaunchDaemons/ folder using launchctl. It also uses launchctl to unload all Launch Daemons when updating to a newer version of LoudMiner.
MITRE ATT&CK technique: T1569.001: System Services- Launchctl
LoudMiner used an MSI installer to install the virtualization software.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
LoudMiner used the ps command to monitor the running processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.
MITRE ATT&CK technique: T1564.006: Hide Artifacts- Run Virtual Instance
LoudMiner started the cryptomining virtual machine as a service on the infected machine.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
LoudMiner has monitored CPU usage.
MITRE ATT&CK technique: T1082: System Information Discovery
LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
LoudMiner used a batch script to run the Linux virtual machine as a service.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Lslsass can dump active logon session password hashes from the lsass process.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.
MITRE ATT&CK technique: T1071: Application Layer Protocol
Lucifer can clear and remove event logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
Lucifer can decrypt its C2 address upon execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Lucifer can exploit multiple vulnerabilities including EternalBlue and EternalRomance .
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Lucifer can download and execute a replica of itself using certutil.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Lucifer can use certutil for propagation on Windows hosts within intranets.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Lucifer can execute TCP, UDP, and HTTP denial of service attacks.
MITRE ATT&CK technique: T1498: Network Denial of Service
Lucifer can scan for open ports including TCP ports 135 and 1433.
MITRE ATT&CK technique: T1046: Network Service Discovery
Lucifer has attempted to brute force TCP ports 135 and 1433 with the default username or list of usernames and passwords.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
Lucifer can identify the process that owns remote connections.
MITRE ATT&CK technique: T1057: Process Discovery
Lucifer can check for existing stratum cryptomining information in HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%.
MITRE ATT&CK technique: T1012: Query Registry
Lucifer can persist by setting Registry key values HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Lucifer can infect victims by brute forcing SMB.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Lucifer has established persistence by creating the following scheduled task schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Lucifer has used UPX packed binaries.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Lucifer can collect the IP address of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Lucifer can identify the IP and port numbers for all remote connections from the compromised host.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Lucifer has the ability to identify the username on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Lucifer can issue shell commands to download and execute additional payloads.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Lucifer can use WMI to log into remote machines for propagation.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
LunarLoader has the ability to use Microsoft Outlook add-ins to establish persistence.
MITRE ATT&CK technique: T1137.006: Office Application Startup- Add-ins
LunarLoader can deobfuscate files containing the next stages in the infection chain.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
LunarLoader can use the DNS domain name of a compromised host to create a decryption key to ensure a malicious payload can only execute against the intended targets.
MITRE ATT&CK technique: T1480: Execution Guardrails
LunarLoader can use reflective loading to decrypt and run malicious executables in a new thread.
MITRE ATT&CK technique: T1620: Reflective Code Loading
LunarLoader can verify the targeted host's DNS name which is then used in the creation of a decyrption key.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
LunarMail has the ability to use Outlook add-ins for persistence.
MITRE ATT&CK technique: T1137.006: Office Application Startup- Add-ins
LunarMail can set the `PR_DELETE_AFTER_SUBMIT` flag to delete messages sent for data exfiltration.
MITRE ATT&CK technique: T1070.008: Indicator Removal- Clear Mailbox Data
LunarMail can create an arbitrary process with a specified command line and redirect its output to a staging directory.
MITRE ATT&CK technique: T1543: Create or Modify System Process
LunarMail can decrypt strings to retrieve configuration settings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
LunarMail has used RC4 and AES to encrypt strings and its exfiltration configuration respectively.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
LunarMail can use email image attachments with embedded data for receiving C2 commands and data exfiltration.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
LunarMail can delete the previously used staging directory and files on subsequent rounds of exfiltration and replace it with a new one.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
LunarMail can search its staging directory for output files it has produced.
MITRE ATT&CK technique: T1083: File and Directory Discovery
LunarMail can create a directory in `%TEMP%\` to stage data prior to exfilration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
LunarMail can capture the recipients of sent email messages from compromised accounts.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
LunarMail can communicates with C2 using email messages via the Outlook Messaging API .
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
LunarMail has been installed through a malicious macro in a Microsoft Word document.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
LunarMail can ping a specific C2 URL with the ID of a victim machine in the subdomain.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
LunarMail can capture screenshots from compromised hosts.
MITRE ATT&CK technique: T1113: Screen Capture
LunarMail can parse IDAT chunks from .png files to look for zlib-compressed and AES encrypted C2 commands.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
LunarMail can capture environmental variables on compromised hosts.
MITRE ATT&CK technique: T1082: System Information Discovery
LunarMail has been installed using a VBA macro.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
LunarWeb can zlib-compress data prior to exfiltration.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
LunarWeb can create a ZIP archive with specified files and directories.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
LunarWeb can send short C2 commands, up to 512 bytes, encrypted with RSA-4096.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
LunarWeb can split exfiltrated data that exceeds 1.33 MB in size into multiple random sized parts between 384 and 512 KB.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
LunarWeb can decrypt strings related to communication configuration using RC4 with a static key.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
The LunarWeb install files have been encrypted with AES-256.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
LunarWeb can self-delete from a compromised host if safety checks of C2 connectivity fail.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
LunarWeb has the ability to retrieve directory listings.
MITRE ATT&CK technique: T1083: File and Directory Discovery
LunarWeb can capture information on group policy settings
MITRE ATT&CK technique: T1615: Group Policy Discovery
LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.
MITRE ATT&CK technique: T1559: Inter-Process Communication
LunarWeb can discover local group memberships.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
LunarWeb can use one C2 URL for first contact and to upload information about the host computer and two additional C2 URLs for getting commands.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
LunarWeb can identify shared resources in compromised environments.
MITRE ATT&CK technique: T1135: Network Share Discovery
LunarWeb has the ability to run shell commands via PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
LunarWeb has used shell commands to list running processes.
MITRE ATT&CK technique: T1057: Process Discovery
LunarWeb can run a custom binary protocol under HTTPS for C2.
MITRE ATT&CK technique: T1572: Protocol Tunneling
LunarWeb has the ability to use a HTTP proxy server for C&C communications.
MITRE ATT&CK technique: T1090: Proxy
LunarWeb has run shell commands to obtain a list of installed security products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
LunarWeb can list installed software on compromised systems.
MITRE ATT&CK technique: T1518: Software Discovery
LunarWeb can use Base64 encoding to obfuscate C2 commands.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
LunarWeb can receive C2 commands hidden in the structure of .jpg and .gif images.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
LunarWeb can send AES encrypted C2 commands.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
LunarWeb can use WMI queries and shell commands such as systeminfo.exe to collect the operating system, BIOS version, and domain name of the targeted system.
MITRE ATT&CK technique: T1082: System Information Discovery
LunarWeb can use shell commands to discover network adapters and configuration.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
LunarWeb can enumerate system network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
LunarWeb can collect user information from the targeted host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
LunarWeb can pause for a number of hours before entering its C2 communication loop.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
LunarWeb can use `POST` to send victim identification to C2 and `GET` to retrieve commands.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
LunarWeb can run shell commands using a BAT file with a name matching `%TEMP%\<⁠random_9_alnum_chars>.batfile` or through cmd.exe with the `/c` and `/U` option for Unicode output.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
LunarWeb can use WMI queries for discovery on the victim host.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Lurid can compress data before sending it.
MITRE ATT&CK technique: T1560: Archive Collected Data
Lurid performs XOR encryption.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
MCMD has the ability to remove set Registry Keys, including those used for persistence.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
MCMD has the ability to upload files from an infected device.
MITRE ATT&CK technique: T1005: Data from Local System
MCMD can modify processes to prevent them from being visible on the desktop.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
MCMD can upload additional files to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
MCMD has been named Readme.txt to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
MCMD can Base64 encode output strings prior to sending to C2.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
MCMD can use Registry Run Keys for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
MCMD can use scheduled tasks for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
MCMD can use HTTPS in communication with C2 web servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
MCMD can launch a console process with redirected standard input and output.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.
MITRE ATT&CK technique: T1119: Automated Collection
After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
MESSAGETAP checks for the existence of two configuration files and attempts to read the files every 30 seconds.
MITRE ATT&CK technique: T1083: File and Directory Discovery
MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.
MITRE ATT&CK technique: T1040: Network Sniffing
After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
MURKYTOP has the capability to schedule remote AT jobs.
MITRE ATT&CK technique: T1053.002: Scheduled Task/Job- At
MURKYTOP has the capability to delete local files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
MURKYTOP has the capability to retrieve information about users on remote hosts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
MURKYTOP has the capability to scan for open ports on hosts in a connected network.
MITRE ATT&CK technique: T1046: Network Service Discovery
MURKYTOP has the capability to retrieve information about shares on remote hosts.
MITRE ATT&CK technique: T1135: Network Share Discovery
MURKYTOP has the capability to retrieve information about groups.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
MURKYTOP has the capability to identify remote hosts on connected networks.
MITRE ATT&CK technique: T1018: Remote System Discovery
MURKYTOP has the capability to retrieve information about the OS.
MITRE ATT&CK technique: T1082: System Information Discovery
MURKYTOP uses the command-line interface.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
MacMa has the ability to record audio.
MITRE ATT&CK technique: T1123: Audio Capture
MacMa can clear possible malware traces such as application logs.
MITRE ATT&CK technique: T1070.002: Indicator Removal- Clear Linux or Mac System Logs
MacMa has been delivered using ad hoc Apple Developer code signing certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
MacMa can collect then exfiltrate files from the compromised system.
MITRE ATT&CK technique: T1005: Data from Local System
MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
MacMa has used TLS encryption to initialize a custom protocol for C2 communications.
MITRE ATT&CK technique: T1573: Encrypted Channel
MacMa exfiltrates data from a supplied path over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
MacMa can delete itself from the compromised computer.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.
MITRE ATT&CK technique: T1083: File and Directory Discovery
MacMa has removed the `com.apple.quarantineattribute` from the dropped file, `$TMPDIR/airportpaird`.
MITRE ATT&CK technique: T1553.001: Subvert Trust Controls- Gatekeeper Bypass
MacMa has downloaded additional files, including an exploit for used privilege escalation.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
MacMa can dump credentials from the macOS keychain.
MITRE ATT&CK technique: T1555.001: Credentials from Password Stores- Keychain
MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
MacMa installs a `com.apple.softwareupdate.plist` file in the `/LaunchAgents` folder with the `RunAtLoad` value set to `true`. Upon user login, MacMa is executed from `/var/root/.local/softwareupdate` with root privileges. Some variations also include the `LimitLoadToSessionType` key with the value `Aqua`, ensuring the MacMa only runs when there is a logged in GUI user.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
MacMa has stored collected files locally before exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
MacMa has used macOS API functions to perform tasks.
MITRE ATT&CK technique: T1106: Native API
MacMa has used a custom JSON-based protocol for its C&C communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
MacMa has used TCP port 5633 for C2 Communication.
MITRE ATT&CK technique: T1571: Non-Standard Port
MacMa can enumerate running processes.
MITRE ATT&CK technique: T1057: Process Discovery
MacMa can manage remote screen sessions.
MITRE ATT&CK technique: T1021: Remote Services
MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.
MITRE ATT&CK technique: T1113: Screen Capture
MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, macOS version, and disk sizes.
MITRE ATT&CK technique: T1082: System Information Discovery
MacMa can collect IP addresses from a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
MacMa can collect the username from the compromised machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
MacMa has the capability to create and modify file timestamps.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
MacSpy can record the sounds from microphones on a computer.
MITRE ATT&CK technique: T1123: Audio Capture
MacSpy can steal clipboard contents.
MITRE ATT&CK technique: T1115: Clipboard Data
MacSpy deletes any temporary files it creates
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
MacSpy stores itself in ~/Library/.DS_Stores/
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
MacSpy captures keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
MacSpy persists via a Launch Agent.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
MacSpy uses Tor for command and control.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
MacSpy can capture screenshots of the desktop over multiple monitors.
MITRE ATT&CK technique: T1113: Screen Capture
MacSpy uses HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Machete saves the window names.
MITRE ATT&CK technique: T1010: Application Window Discovery
Machete stores zipped files with profile data from installed web browsers.
MITRE ATT&CK technique: T1560: Archive Collected Data
Machete's collected data is encrypted with AES before exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Machete has used TLS-encrypted FTP to exfiltrate data.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Machete captures audio from the computer’s microphone.
MITRE ATT&CK technique: T1123: Audio Capture
Machete’s collected files are exfiltrated automatically to remote servers.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Machete retrieves the user profile data from Chrome and Firefox browsers.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.
MITRE ATT&CK technique: T1115: Clipboard Data
Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Machete collects stored credentials from several web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Machete searches the File system for files of interest.
MITRE ATT&CK technique: T1005: Data from Local System
Machete can find, encrypt, and upload files from fixed and removable drives.
MITRE ATT&CK technique: T1025: Data from Removable Media
Machete’s downloaded data is decrypted using AES.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Machete's collected data is exfiltrated over the same channel used for C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Machete has a feature to copy files from every drive onto a removable drive in a hidden folder.
MITRE ATT&CK technique: T1052.001: Exfiltration Over Physical Medium- Exfiltration over USB
Machete has sent data over HTTP if FTP failed, and has also used a fallback server.
MITRE ATT&CK technique: T1008: Fallback Channels
Once a file is uploaded, Machete will delete it from the machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Machete uses FTP for Command & Control.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
Machete produces file listings in order to search for files to be exfiltrated.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Machete can download additional files for execution on the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Machete logs keystrokes from the victim’s machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Machete stores files and logs in a folder on the local drive.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Machete detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Machete has scanned and looked for cryptographic keys and certificate file extensions.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
Machete has a component to check for running processes to look for web browsers.
MITRE ATT&CK technique: T1057: Process Discovery
Machete is written in Python and is used in conjunction with additional Python scripts.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Machete used the startup folder for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
The different components of Machete are executed by Windows Task Scheduler.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Machete sends stolen data to the C2 server every 10 minutes.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Machete captures screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
Machete has been packed with NSIS.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Machete has used base64 encoding.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Machete has used AES to exfiltrate documents.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Machete collects the hostname of the target computer.
MITRE ATT&CK technique: T1082: System Information Discovery
Machete collects the MAC address of the target computer and other network configuration information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Machete uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Machete takes photos from the computer’s web camera.
MITRE ATT&CK technique: T1125: Video Capture
Machete uses HTTP for Command & Control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Mafalda can use `AdjustTokenPrivileges` to elevate privileges.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Mafalda can collect the contents of the `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState` file.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Mafalda can delete Windows Event logs by invoking the `OpenEventLogW` and `ClearEventLogW` functions.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Mafalda can collect files and information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Mafalda can search for debugging tools on a compromised host.
MITRE ATT&CK technique: T1622: Debugger Evasion
Mafalda can decrypt files and data.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information