sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Calisto has the capability to use rm -rf to remove folders and files from the victim's machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Calisto presents an input prompt asking for the user's login and password.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Calisto has the capability to upload and download files to the victim's machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Calisto collects Keychain storage data and copies those passwords/tokens to a file.
MITRE ATT&CK technique: T1555.001: Credentials from Password Stores- Keychain
Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
Calisto uses launchctl to enable screen sharing on the victim’s machine.
MITRE ATT&CK technique: T1569.001: System Services- Launchctl
Calisto has the capability to add its own account to the victim's machine.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Calisto's installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Calisto runs the ifconfig command to obtain the IP address from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
CallMe has the capability to download a file to the victim from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CallMe uses AES to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
CallMe has the capability to create a reverse shell on victims.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Cannon can download a payload for execution.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
Cannon can obtain a list of processes running on the system.
MITRE ATT&CK technique: T1057: Process Discovery
Cannon can take a screenshot of the desktop.
MITRE ATT&CK technique: T1113: Screen Capture
Cannon can gather system information from the victim’s machine such as the OS version, machine name, and drive information.
MITRE ATT&CK technique: T1082: System Information Discovery
Cannon can gather the username from the system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Cannon can collect the current time zone information from the victim’s machine.
MITRE ATT&CK technique: T1124: System Time Discovery
Cannon adds the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon to establish persistence.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
Carbanak has a command to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Carbanak logs key strokes for configured processes and sends them back to the C2 server.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Carbanak can create a Windows account.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Carbanak searches recursively for Outlook personal storage tables files within user directories and sends them back to the C2 server.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Carbanak obtains Windows logon password details.
MITRE ATT&CK technique: T1003: OS Credential Dumping
Carbanak encrypts strings to make analysis more difficult.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Carbanak downloads an executable and injects it directly into a new process.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
Carbanak lists running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Carbanak checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.
MITRE ATT&CK technique: T1012: Query Registry
Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Carbanak has a plugin for VNC and Ammyy Admin Tool.
MITRE ATT&CK technique: T1219: Remote Access Software
Carbanak enables concurrent Remote Desktop Protocol sessions.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.
MITRE ATT&CK technique: T1113: Screen Capture
Carbanak encodes the message body of HTTP traffic with Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Carbanak encrypts the message body of HTTP traffic with RC2 . Carbanak also uses XOR with random keys for its communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
The Carbanak malware communicates to its command server using HTTP with an encrypted payload.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Carbanak has a command to create a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
Carberp has installed a bootkit on the system to maintain persistence.
MITRE ATT&CK technique: T1542.003: Pre-OS Boot- Bootkit
Carberp has captured credentials when a user performs login through a SSL session.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
Carberp has hooked several Windows API functions to steal credentials.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Carberp's bootkit can inject a malicious DLL into the address space of running processes.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Carberp has used XOR-based encryption to mask C2 server locations within the trojan.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Carberp has exfiltrated data via HTTP to already established C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Carberp has exploited multiple Windows vulnerabilities and a .NET Runtime Optimization vulnerability for privilege escalation.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Carberp has created a hidden file in the Startup folder of the current user.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Carberp can download and execute new plugins from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.
MITRE ATT&CK technique: T1106: Native API
Carberp has collected a list of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.
MITRE ATT&CK technique: T1012: Query Registry
Carberp has maintained persistence by placing itself inside the current user's startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Carberp has used user mode rootkit techniques to remain hidden on the system.
MITRE ATT&CK technique: T1014: Rootkit
Carberp can capture display screenshots with the screens_dll.dll plugin.
MITRE ATT&CK technique: T1113: Screen Capture
Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Carberp has collected the operating system version from the infected system.
MITRE ATT&CK technique: T1082: System Information Discovery
Carberp can start a remote VNC session by downloading a new plugin.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Carberp has connected to C2 servers via HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Carbon has used RSA encryption for C2 communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Carbon decrypts task and configuration files for execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Carbon has a command to inject code into a process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Carbon uses HTTP to send data to the C2 server.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Carbon creates a base directory that contains the files and folders that are collected.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Carbon uses TCP and UDP for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Carbon uses the net group command.
MITRE ATT&CK technique: T1069: Permission Groups Discovery
Carbon can list the processes on the victim’s machine.
MITRE ATT&CK technique: T1057: Process Discovery
Carbon enumerates values in the Registry.
MITRE ATT&CK technique: T1012: Query Registry
Carbon uses the net view command.
MITRE ATT&CK technique: T1018: Remote System Discovery
Carbon creates several tasks for later execution to continue persistence on the victim’s machine.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Carbon can collect the IP address of the victims and other computers on the network using the commands: ipconfig -all nbtstat -n, and nbtstat -s.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Carbon uses the netstat -r and netstat -an commands.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Carbon uses the command net time \\127.0.0.1 to get information the system’s time.
MITRE ATT&CK technique: T1124: System Time Discovery
Carbon can use HTTP in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Carbon can use Pastebin to receive C2 commands.
MITRE ATT&CK technique: T1102: Web Service
Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Cardinal RAT applies compression to C2 traffic using the ZLIB library.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.
MITRE ATT&CK technique: T1027.004: Obfuscated Files or Information- Compile After Delivery
Cardinal RAT decodes many of its artifacts and is decrypted after being downloaded.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Cardinal RAT encodes many of its artifacts and is encrypted when downloaded.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Cardinal RAT can communicate over multiple C2 host and port combinations.
MITRE ATT&CK technique: T1008: Fallback Channels
Cardinal RAT can uninstall itself, including deleting its executable.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path .
MITRE ATT&CK technique: T1083: File and Directory Discovery
Cardinal RAT can download and execute additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Cardinal RAT can log keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Cardinal RAT sets HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load to point to its executable.
MITRE ATT&CK technique: T1112: Modify Registry
Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.
MITRE ATT&CK technique: T1057: Process Discovery
Cardinal RAT injects into a newly spawned process created from a native Windows executable.
MITRE ATT&CK technique: T1055: Process Injection
Cardinal RAT can act as a reverse proxy.
MITRE ATT&CK technique: T1090: Proxy
Cardinal RAT contains watchdog functionality that periodically ensures HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load is set to point to its executable.
MITRE ATT&CK technique: T1012: Query Registry
Cardinal RAT establishes Persistence by setting the HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Cardinal RAT can capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Cardinal RAT can collect the username from a victim machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Cardinal RAT is downloaded using HTTP over port 443.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Cardinal RAT can execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.
MITRE ATT&CK technique: T1010: Application Window Discovery
Catchamas steals data stored in the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
Catchamas collects keystrokes from the victim’s machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Catchamas creates three Registry keys to establish persistence by adding a Windows Service.
MITRE ATT&CK technique: T1112: Modify Registry
Catchamas captures screenshots based on specific keywords in the window’s title.
MITRE ATT&CK technique: T1113: Screen Capture
Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Catchamas adds a new service named NetAdapter to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Caterpillar WebShell has a module to perform brute force attacks on a system.
MITRE ATT&CK technique: T1110: Brute Force
Caterpillar WebShell has a module to collect information from the local database.
MITRE ATT&CK technique: T1005: Data from Local System
Caterpillar WebShell can upload files over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Caterpillar WebShell can search for files in directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Caterpillar WebShell has a module to download and upload files to the system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Caterpillar WebShell can obtain a list of local groups of users from a system.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Caterpillar WebShell has a command to modify a Registry key.
MITRE ATT&CK technique: T1112: Modify Registry
Caterpillar WebShell has a module to use a port scanner on a system.
MITRE ATT&CK technique: T1046: Network Service Discovery
Caterpillar WebShell can gather a list of processes running on the machine.
MITRE ATT&CK technique: T1057: Process Discovery
Caterpillar WebShell has a module to use a rootkit on a system.
MITRE ATT&CK technique: T1014: Rootkit
Caterpillar WebShell has a module to gather information from the compromrised asset, including the computer version, computer name, IIS version, and more.
MITRE ATT&CK technique: T1082: System Information Discovery
Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Caterpillar WebShell can obtain a list of user accounts from a victim's machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Caterpillar WebShell can obtain a list of the services from a system.
MITRE ATT&CK technique: T1007: System Service Discovery
Caterpillar WebShell can run commands on the compromised asset with CMD functions.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
ChChes steals credentials stored inside Internet Explorer.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
ChChes can alter the victim's proxy configuration.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ChChes is capable of downloading files, including additional modules.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed .
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
ChChes collects its process identifier on the victim.
MITRE ATT&CK technique: T1057: Process Discovery
ChChes establishes persistence by adding a Registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
ChChes can encode C2 data with a custom technique that utilizes Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
ChChes can encrypt C2 traffic with AES or RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
ChChes collects the victim hostname, window resolution, and Microsoft Windows version.
MITRE ATT&CK technique: T1082: System Information Discovery
ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
Chaes can steal login credentials and stored financial information from the browser.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Chaes has used search order hijacking to load a malicious DLL.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Chaes has decrypted an AES encrypted binary file to trigger the download of other files.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Chaes has used encryption for its C2 channel.
MITRE ATT&CK technique: T1573: Encrypted Channel
Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.
MITRE ATT&CK technique: T1048: Exfiltration Over Alternative Protocol
Some versions of Chaes stored its instructions in the Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Chaes can download additional files onto an infected machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Chaes has a module to perform any API hooking it desires.
MITRE ATT&CK technique: T1056: Input Capture
Chaes has used Installutill to download content.
MITRE ATT&CK technique: T1218.004: System Binary Proxy Execution- InstallUtil
Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Chaes requires the user to click on the malicious Word document to execute the next part of the attack.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Chaes has used an unsigned, crafted DLL module named hha.dll that was designed to look like a legitimate 32-bit Windows DLL.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Chaes can modify Registry values to stored information and establish persistence.
MITRE ATT&CK technique: T1112: Modify Registry
Chaes has used .MSI files as an initial way to start the infection chain.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Chaes used the CreateFileW API function with read permissions to access downloaded payloads.
MITRE ATT&CK technique: T1106: Native API
Chaes has used Python scripts for execution and the installation of additional files.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Chaes has added persistence via the Registry key software\microsoft\windows\currentversion\run\microsoft windows html help.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Chaes can capture screenshots of the infected machine.
MITRE ATT&CK technique: T1113: Screen Capture
Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Chaes has used Base64 to encode C2 communications.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Chaes has used a script that extracts the web session cookie and sends it to the C2 server.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
Chaes has collected system information, including the machine name and OS version.
MITRE ATT&CK technique: T1082: System Information Discovery
Chaes has collected the username and UID from the infected machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.
MITRE ATT&CK technique: T1221: Template Injection
Chaes has used VBscript to execute malicious code.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Chaes has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Chaes has used cmd to execute tasks on the system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Chaos conducts brute force attacks against SSH services to gain initial access.
MITRE ATT&CK technique: T1110: Brute Force
After initial compromise, Chaos will download a second stage to establish a more permanent presence on the affected system.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Chaos provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.
MITRE ATT&CK technique: T1205: Traffic Signaling
Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
CharmPower can collect data and files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
CharmPower can decrypt downloaded modules prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
CharmPower can send victim data via FTP with credentials hardcoded in the script.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.
MITRE ATT&CK technique: T1008: Fallback Channels
CharmPower can delete created files from a compromised system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.
MITRE ATT&CK technique: T1083: File and Directory Discovery
CharmPower has the ability to download additional modules to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
CharmPower can remove persistence-related artifacts from the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
CharmPower can use PowerShell for payload execution and C2 communication.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
CharmPower has the ability to list running processes through the use of `tasklist`.
MITRE ATT&CK technique: T1057: Process Discovery
CharmPower has the ability to enumerate `Uninstall` registry values.
MITRE ATT&CK technique: T1012: Query Registry
CharmPower has the ability to capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
CharmPower can list the installed applications on a compromised host.
MITRE ATT&CK technique: T1518: Software Discovery
CharmPower can send additional modules over C2 encoded with base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
CharmPower can enumerate the OS version and computer name on a targeted system.
MITRE ATT&CK technique: T1082: System Information Discovery
CharmPower has the ability to use ipconfig to enumerate system network settings.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
CharmPower can use `netsh wlan show profiles` to list specific Wi-Fi profile details.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
CharmPower can use HTTP to communicate with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
CharmPower can download additional modules from actor-controlled Amazon S3 buckets.
MITRE ATT&CK technique: T1102: Web Service
The C# implementation of the CharmPower command execution module can use cmd.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
CharmPower can use `wmic` to gather information from a system.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Cheerscrypt can encrypt data on victim machines using a Sosemanuk stream cipher with an Elliptic-curve Diffie–Hellman generated key.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Cheerscrypt can search for log and VMware-related files with .log, .vmdk, .vmem, .vswp, and .vmsn extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Cheerscrypt has the ability to terminate VM processes on compromised hosts through execution of `esxcli vm process kill`.
MITRE ATT&CK technique: T1489: Service Stop
Some variants of Cherry Picker use AppInit_DLLs to achieve persistence by creating the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "AppInit_DLLs"="pserver32.dll"
MITRE ATT&CK technique: T1546.010: Event Triggered Execution- AppInit DLLs
Cherry Picker exfiltrates files over FTP.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Recent versions of Cherry Picker delete files and registry keys created by the malware.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
China Chopper's server component can upload local files.
MITRE ATT&CK technique: T1005: Data from Local System
China Chopper's server component can list directory contents.
MITRE ATT&CK technique: T1083: File and Directory Discovery
China Chopper's server component can download remote files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
China Chopper's server component can spider authentication portals.
MITRE ATT&CK technique: T1046: Network Service Discovery
China Chopper's server component can perform brute force password guessing against authentication portals.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
China Chopper's client component is packed with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
China Chopper's server component can change the timestamp of files.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
China Chopper's server component executes code sent via HTTP POST commands.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
China Chopper's server component is a Web Shell payload.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
China Chopper's server component is capable of opening a command terminal.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Chinoxy can use a digitally signed binary to load its dll into memory.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
The Chinoxy dropping function can initiate decryption of its config file.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Chinoxy has encrypted its configuration file.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Chinoxy has used the name `eoffice.exe` in attempt to appear as a legitimate file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Chinoxy has established persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key and by loading a dropper to ``.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Chrommme can encrypt and store on disk collected data before exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Chrommme can collect data from a local system.
MITRE ATT&CK technique: T1005: Data from Local System
Chrommme can decrypt its encrypted internal code.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Chrommme can encrypt sections of its code to evade detection.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Chrommme can exfiltrate collected data via C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Chrommme can download its code from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Chrommme can store captured system information locally prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Chrommme can use Windows API including `WinExec` for execution.
MITRE ATT&CK technique: T1106: Native API
Chrommme can set itself to sleep before requesting a new command from C2.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Chrommme has the ability to capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
Chrommme has the ability to list drives and obtain the computer name of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Chrommme can enumerate the IP address of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Chrommme can retrieve the username from a targeted system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Clambling has the ability to use Telnet for communication.
MITRE ATT&CK technique: T1071: Application Layer Protocol
Clambling can use Dropbox to download malicious payloads, send commands, and receive information.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Clambling has the ability to bypass UAC using a `passuac.dll` file.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Clambling has the ability to capture and store clipboard data.
MITRE ATT&CK technique: T1115: Clipboard Data
Clambling can store a file named `mpsvc.dll`, which opens a malicious `mpsvc.mui` file, in the same folder as the legitimate Microsoft executable `MsMpEng.exe` to gain execution.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Clambling can collect information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Clambling can deobfuscate its payload prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Clambling can send files from a victim's machine to Dropbox.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Clambling can browse directories on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Clambling has the ability to set its file attributes to hidden.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Clambling can capture keystrokes on a compromised host.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Clambling has gained execution through luring victims into opening malicious files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Clambling can set and delete Registry keys.
MITRE ATT&CK technique: T1112: Modify Registry
Clambling has the ability to enumerate network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
Clambling has the ability to use TCP and UDP for communication.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
The Clambling executable has been obfuscated when dropped on a compromised host.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
The Clambling dropper can use PowerShell to download the malware.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Clambling can enumerate processes on a targeted system.
MITRE ATT&CK technique: T1057: Process Discovery
Clambling can execute binaries through process hollowing.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Clambling can inject into the `svchost.exe` process for execution.
MITRE ATT&CK technique: T1055: Process Injection
Clambling has the ability to enumerate Registry keys, including KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir to search for a bitcoin wallet.
MITRE ATT&CK technique: T1012: Query Registry
Clambling can establish persistence by adding a Registry run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Clambling has the ability to capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
Clambling can create and start services on a compromised host.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Clambling has been delivered to victim's machines through malicious e-mail attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Clambling can discover the hostname, computer name, and Windows version of a targeted machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Clambling can enumerate the IP address of a compromised machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Clambling can identify the username on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Clambling can determine the current time.
MITRE ATT&CK technique: T1124: System Time Discovery
Clambling can wait 30 minutes before initiating contact with C2.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Clambling can record screen content in AVI format.
MITRE ATT&CK technique: T1125: Video Capture
Clambling has the ability to communicate over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Clambling can use cmd.exe for command execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Clambling can register itself as a system service to gain persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Clop can use code signing to evade detection.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Clop has used a simple XOR operation to decrypt strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Clop can uninstall or disable security products.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Clop has searched folders and subfolders for files to encrypt.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Clop can delete the shadow volumes with vssadmin Delete Shadows /all /quiet and can use bcdedit to disable recovery options.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Clop can make modifications to Registry keys.
MITRE ATT&CK technique: T1112: Modify Registry
Clop can use msiexec.exe to disable security tools on the system.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Clop has used built-in API functions such as WNetOpenEnumW, WNetEnumResourceW, WNetCloseEnum, GetProcAddress, and VirtualAlloc.
MITRE ATT&CK technique: T1106: Native API
Clop can enumerate network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
Clop can enumerate all processes on the victim's machine.
MITRE ATT&CK technique: T1057: Process Discovery
Clop can search for processes with antivirus and antimalware product names.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Clop can kill several processes and services related to backups and security solutions.
MITRE ATT&CK technique: T1489: Service Stop
Clop has been packed to help avoid detection.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Clop has checked the keyboard language using the GetKeyboardLayout function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the GetTextCharset function.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Clop has used the sleep command to avoid sandbox detection.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
Clop can use cmd.exe to help execute commands on the system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
One variant of CloudDuke uses HTTP and HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.
MITRE ATT&CK technique: T1197: BITS Jobs
Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
Cobalt Strike can use a number of known techniques to bypass Windows UAC.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Cobalt Strike can use self signed Java applets to execute signed applet attacks.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS. All protocols use their standard assigned ports.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Cobalt Strike will break large data sets into smaller chunks for exfiltration.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
Cobalt Strike can collect data from a local system.
MITRE ATT&CK technique: T1005: Data from Local System
Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.
MITRE ATT&CK technique: T1021.003: Remote Services- Distributed Component Object Model
Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.
MITRE ATT&CK technique: T1090.004: Proxy- Domain Fronting
Cobalt Strike can identify targets by querying account groups on a domain contoller.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Cobalt Strike has the ability to load DLLs via reflective injection.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Cobalt Strike can exploit vulnerabilities such as MS14-058.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
Cobalt Strike can explore files on a compromised system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
Cobalt Strike can deliver additional payloads to victim machines.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Cobalt Strike can track key presses with a keylogger module.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
Cobalt Strike can use net localgroup to list local groups on a system.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Cobalt Strike can make tokens from known credentials.
MITRE ATT&CK technique: T1134.003: Access Token Manipulation- Make and Impersonate Token
Cobalt Strike can modify Registry values within HKEY_CURRENT_USER\Software\Microsoft\Office\\Excel\Security\AccessVBOM\ to enable the execution of additional code.
MITRE ATT&CK technique: T1112: Modify Registry
Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe
MITRE ATT&CK technique: T1106: Native API
Cobalt Strike can perform port scans from an infected host.
MITRE ATT&CK technique: T1046: Network Service Discovery
Cobalt Strike can query shared drives on the local system.
MITRE ATT&CK technique: T1135: Network Share Discovery
Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.
MITRE ATT&CK technique: T1137.001: Office Application Startup- Office Template Macros
Cobalt Strike can spawn processes with alternate PPIDs.
MITRE ATT&CK technique: T1134.004: Access Token Manipulation- Parent PID Spoofing
Cobalt Strike can perform pass the hash.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk. Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell