sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
FRP can use STCP with a preshared key to encrypt services exposed to public networks.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
FRP can use a dashboard and U/I to display the status of connections from the FRP client and server.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
FRP has the ability to use HTTP and HTTPS to enable the forwarding of requests for internal services via domain name.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
FYAnti has the ability to decrypt an embedded .NET module.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
FYAnti can search the C:\Windows\Microsoft.NET\ directory for files of a specified size.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FYAnti can download additional payloads to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
FYAnti has used ConfuserEx to pack its .NET module.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
FakeM contains a keylogger module.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Some variants of FakeM use SSL to communicate with C2 servers.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
FatDuke has been packed with junk code and strings.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
FatDuke can copy files and directories from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
FatDuke can decrypt AES encrypted C2 communications.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
FatDuke has used several C2 servers per targeted organization.
MITRE ATT&CK technique: T1008: Fallback Channels
FatDuke can secure delete its DLL.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FatDuke can enumerate directories on target machines.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.
MITRE ATT&CK technique: T1036: Masquerading
FatDuke can call ShellExecuteW to open the default browser on the URL localhost.
MITRE ATT&CK technique: T1106: Native API
FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
FatDuke has the ability to execute PowerShell scripts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
FatDuke can list running processes on the localhost.
MITRE ATT&CK technique: T1057: Process Discovery
FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.
MITRE ATT&CK technique: T1012: Query Registry
FatDuke has used HKLM\SOFTWARE\Microsoft\CurrentVersion\Run to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FatDuke can execute via rundll32.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
FatDuke has been regularly repacked by its operators to create large binaries and evade detection.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
FatDuke can AES encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
FatDuke can identify the MAC address on the target computer.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
FatDuke can turn itself on or off at random intervals.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
FatDuke can be controlled via a custom C2 protocol over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Felismus can download files from remote servers.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Felismus has masqueraded as legitimate Adobe Content Management System files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Felismus checks for processes associated with anti-virus vendors.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Some Felismus samples use a custom method for C2 traffic that utilizes Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Felismus collects the system information, including hostname and OS version, and sends it to the C2 server.
MITRE ATT&CK technique: T1082: System Information Discovery
Felismus collects the victim LAN IP address and sends it to the C2 server.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Felismus collects the current username and sends it to the C2 server.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Felismus uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Felismus uses command line for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Ferocious can use COM hijacking to establish persistence.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
Ferocious can delete files from a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.
MITRE ATT&CK technique: T1112: Modify Registry
Ferocious can run GET.WORKSPACE in Microsoft Excel to check if a mouse is present.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Ferocious can use PowerShell scripts for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Ferocious has checked for AV software as part of its persistence process.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Ferocious can run anti-sandbox checks using the Microsoft Excel 4.0 function GET.WORKSPACE to determine the OS version, if there is a mouse present, and if the host is capable of playing sounds.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Ferocious can use GET.WORKSPACE in Microsoft Excel to determine the OS version of the compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Ferocious has the ability to use Visual Basic scripts for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Fgdump can dump Windows password hashes.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
FinFisher contains junk code in its functions in an effort to confuse disassembly programs.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Some FinFisher variants incorporate an MBR rootkit.
MITRE ATT&CK technique: T1542.003: Pre-OS Boot- Bootkit
FinFisher performs UAC bypass.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
A FinFisher variant uses DLL search order hijacking.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
FinFisher uses DLL side-loading to load malicious programs.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
FinFisher enumerates directories and scans for certain files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FinFisher has used the KernelCallbackTable to hijack the execution flow of a process by replacing the __fnDWORD function with the address of a created Asynchronous Procedure Call stub routine.
MITRE ATT&CK technique: T1574.013: Hijack Execution Flow- KernelCallbackTable
FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
FinFisher checks its parent process for indications that it is running in a sandbox setup.
MITRE ATT&CK technique: T1057: Process Discovery
FinFisher queries Registry values as part of its anti-sandbox checks.
MITRE ATT&CK technique: T1012: Query Registry
FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.
MITRE ATT&CK technique: T1113: Screen Capture
FinFisher probes the system to check for antimalware processes.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
A FinFisher variant uses a custom packer.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
FinFisher checks if the victim OS is 32 or 64-bit.
MITRE ATT&CK technique: T1082: System Information Discovery
FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
FinFisher creates a new Windows service with the malicious executable for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Final1stspy uses Python code to deobfuscate base64-encoded strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Final1stspy obfuscates strings with base64 encoding.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Final1stspy obtains a list of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Final1stspy creates a Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Final1stspy obtains victim Microsoft Windows version information and CPU architecture.
MITRE ATT&CK technique: T1082: System Information Discovery
Final1stspy uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Flagpro can check the name of the window displayed on the system.
MITRE ATT&CK technique: T1010: Application Window Discovery
Flagpro can collect data from a compromised host, including Windows authentication information.
MITRE ATT&CK technique: T1005: Data from Local System
Flagpro has exfiltrated data to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.
MITRE ATT&CK technique: T1070: Indicator Removal
Flagpro can download additional malware from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Flagpro has been used to execute the net localgroup administrators command on a targeted system.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.
MITRE ATT&CK technique: T1036: Masquerading
Flagpro can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`.
MITRE ATT&CK technique: T1106: Native API
Flagpro has been used to execute `net view` to discover mapped network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
Flagpro has been delivered within ZIP or RAR password-protected archived files.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Flagpro has been used to run the tasklist command on a compromised system.
MITRE ATT&CK technique: T1057: Process Discovery
Flagpro has dropped an executable file to the startup directory.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Flagpro has been used to execute net view on a targeted system.
MITRE ATT&CK technique: T1018: Remote System Discovery
Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Flagpro has been distributed via spearphishing as an email attachment.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Flagpro has been used to execute the ipconfig /all command on a victim system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Flagpro has been used to execute netstat -ano on a compromised host.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Flagpro has been used to run the whoami command on the system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Flagpro can execute malicious VBA macros embedded in .xlsm files.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Flagpro can communicate with its C2 using HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Flagpro can use `cmd.exe` to execute commands received from C2.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Flame can record audio using any existing hardware recording devices.
MITRE ATT&CK technique: T1123: Audio Capture
Flame can use Windows Authentication Packages for persistence.
MITRE ATT&CK technique: T1547.002: Boot or Logon Autostart Execution- Authentication Package
Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.
MITRE ATT&CK technique: T1011.001: Exfiltration Over Other Network Medium- Exfiltration Over Bluetooth
Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Flame can create backdoor accounts with login `HelpAssistant` on domain connected systems if appropriate rights are available.
MITRE ATT&CK technique: T1036.010: Masquerading- Masquerade Account Name
Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Rundll32.exe is used as a way of executing Flame at the command-line.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Flame can take regular screenshots when certain applications are open that are sent to the command and control server.
MITRE ATT&CK technique: T1113: Screen Capture
Flame identifies security software such as antivirus through the Security module.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
FlawedAmmyy can collect clipboard data.
MITRE ATT&CK technique: T1115: Clipboard Data
FlawedAmmyy may obfuscate portions of the initial C2 handshake.
MITRE ATT&CK technique: T1001: Data Obfuscation
FlawedAmmyy has collected information and files from a compromised machine.
MITRE ATT&CK technique: T1005: Data from Local System
FlawedAmmyy has sent data collected from a compromised host to its C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
FlawedAmmyy can execute batch scripts to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FlawedAmmyy can transfer files from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
FlawedAmmyy can collect mouse events.
MITRE ATT&CK technique: T1056: Input Capture
FlawedAmmyy can collect keyboard events.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
FlawedAmmyy enumerates the privilege level of the victim during the initial infection.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
FlawedAmmyy has been installed via `msiexec.exe`.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
FlawedAmmyy has used PowerShell to execute commands.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
FlawedAmmyy has established persistence via the `HKCU\SOFTWARE\microsoft\windows\currentversion\run` registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FlawedAmmyy has used `rundll32` for execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
FlawedAmmyy can capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
FlawedAmmyy will attempt to detect anti-virus products during the initial infection.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
FlawedAmmyy has used SEAL encryption during the initial C2 handshake.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.
MITRE ATT&CK technique: T1082: System Information Discovery
FlawedAmmyy enumerates the current user during the initial infection.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
FlawedAmmyy has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
FlawedAmmyy has used `cmd` to execute commands on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
FlawedGrace encrypts its C2 configuration files with AES in CBC mode.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
FoggyWeb can invoke the `Common.Compress` method to compress data with the C# GZipStream compression class.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.
MITRE ATT&CK technique: T1027.004: Obfuscated Files or Information- Compile After Delivery
FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate `version.dll` during the `Microsoft.IdentityServer.ServiceHost.exe` execution process.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
FoggyWeb can retrieve configuration data from a compromised AD FS server.
MITRE ATT&CK technique: T1005: Data from Local System
FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm -128 key and decoded using a XOR key.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
FoggyWeb has been XOR-encoded.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.
MITRE ATT&CK technique: T1036: Masquerading
FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.
MITRE ATT&CK technique: T1106: Native API
FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.
MITRE ATT&CK technique: T1040: Network Sniffing
FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
FoggyWeb's loader can enumerate all Common Language Runtimes and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.
MITRE ATT&CK technique: T1057: Process Discovery
FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.
MITRE ATT&CK technique: T1620: Reflective Code Loading
FoggyWeb's loader can call the load function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.
MITRE ATT&CK technique: T1129: Shared Modules
FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
FoggyWeb can allow abuse of a compromised AD FS server's SAML token.
MITRE ATT&CK technique: T1550: Use Alternate Authentication Material
FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Forfiles can be used to act on files/directories in a system during .
MITRE ATT&CK technique: T1005: Data from Local System
Forfiles can be used to locate certain types of files/directories in a system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd.
MITRE ATT&CK technique: T1202: Indirect Command Execution
FrameworkPOS can XOR credit card information before exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
FrameworkPOS can collect elements related to credit card data from process memory.
MITRE ATT&CK technique: T1005: Data from Local System
FrameworkPOS can use DNS tunneling for exfiltration of credit card data.
MITRE ATT&CK technique: T1048: Exfiltration Over Alternative Protocol
FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows\.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.
MITRE ATT&CK technique: T1057: Process Discovery
FruitFly executes and stores obfuscated Perl scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
FruitFly will delete files on the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FruitFly looks for specific files and file types.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FruitFly saves itself with a leading "." to make it a hidden file.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
FruitFly persists via a Launch Agent.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
FruitFly has the ability to list processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
FruitFly takes screenshots of the user's desktop.
MITRE ATT&CK technique: T1113: Screen Capture
FunnyDream has the ability to discover application windows via execution of `EnumWindows`.
MITRE ATT&CK technique: T1010: Application Window Discovery
FunnyDream has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or `qwerasdf` if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
FunnyDream has compressed collected files with zLib.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
FunnyDream can monitor files for changes and automatically collect them.
MITRE ATT&CK technique: T1119: Automated Collection
FunnyDream can use com objects identified with `CLSID_ShellLink` and `WScript.Shell` to enable persistence mechanisms.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
FunnyDream can send compressed and obfuscated packets to C2.
MITRE ATT&CK technique: T1001: Data Obfuscation
FunnyDream can upload files from victims' machines.
MITRE ATT&CK technique: T1005: Data from Local System
The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.
MITRE ATT&CK technique: T1025: Data from Removable Media
The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
FunnyDream can execute commands, including gathering user information, and send the results to C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
FunnyDream can delete files including its dropper component.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.
MITRE ATT&CK technique: T1083: File and Directory Discovery
FunnyDream has the ability to clean traces of malware deployment.
MITRE ATT&CK technique: T1070: Indicator Removal
FunnyDream can download additional files onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
The FunnyDream Keyrecord component can capture keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
FunnyDream can stage collected information including screen captures and logged keystrokes locally.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
FunnyDream has used a service named `WSearch` for execution.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
FunnyDream can use Native API for defense evasion, discovery, and collection.
MITRE ATT&CK technique: T1106: Native API
FunnyDream can communicate with C2 over TCP and UDP.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
The FunnyDream FilepakMonitor component can detect removable drive insertion.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.
MITRE ATT&CK technique: T1057: Process Discovery
FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.
MITRE ATT&CK technique: T1572: Protocol Tunneling
FunnyDream can identify and use configured proxies in a compromised network for C2 communication.
MITRE ATT&CK technique: T1090: Proxy
FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.
MITRE ATT&CK technique: T1012: Query Registry
FunnyDream can use a Registry Run Key and the Startup folder to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
FunnyDream can collect information about hosts on the victim network.
MITRE ATT&CK technique: T1018: Remote System Discovery
FunnyDream can use `rundll32` for execution of its components.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
The FunnyDream ScreenCap component can take screenshots on a compromised host.
MITRE ATT&CK technique: T1113: Screen Capture
FunnyDream can identify the processes for Bkav antivirus.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
FunnyDream can enumerate all logical drives on a targeted machine.
MITRE ATT&CK technique: T1082: System Information Discovery
FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
FunnyDream can check system time to help determine when changes were made to specified files.
MITRE ATT&CK technique: T1124: System Time Discovery
FunnyDream can use `cmd.exe` for execution on remote hosts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
FunnyDream can use WMI to open a Windows command shell on a remote machine.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
FunnyDream has established persistence by running `sc.exe` and by setting the `WSearch` service to run automatically.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Fysbis has been encrypted using XOR and RC4.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Fysbis has the ability to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Fysbis has the ability to search for files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Fysbis can perform keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Fysbis has masqueraded as the rsyncd and dbus-inotifier services.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Fysbis can collect information about running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Fysbis can use Base64 to encode its C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Fysbis has used the command ls /etc | egrep -e"fedora\*|debian\*|gentoo\*|mandriva\*|mandrake\*|meego\*|redhat\*|lsb-\*|sun-\*|SUSE\*|release" to determine which Linux OS version is running.
MITRE ATT&CK technique: T1082: System Information Discovery
Fysbis has established persistence using a systemd service.
MITRE ATT&CK technique: T1543.002: Create or Modify System Process- Systemd Service
Fysbis has the ability to create and execute commands in a remote shell for CLI.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
If executing without root privileges, Fysbis adds a `.desktop` configuration file to the user's `~/.config/autostart` directory.
MITRE ATT&CK technique: T1547.013: Boot or Logon Autostart Execution- XDG Autostart Entries
GLASSTOKEN has the ability to decode hexadecimal and Base64 C2 requests.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
GLASSTOKEN can use PowerShell for command execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
GLASSTOKEN has hexadecimal and Base64 encoded C2 content.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
GLASSTOKEN is a web shell capable of tunneling C2 connections and code execution on compromised Ivanti Secure Connect VPNs.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol for C2.
MITRE ATT&CK technique: T1071.005: Application Layer Protocol- Publish/Subscribe Protocols
GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
GRIFFON is written in and executed as JavaScript.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
GRIFFON has used sctasks for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.
MITRE ATT&CK technique: T1113: Screen Capture
GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .
MITRE ATT&CK technique: T1082: System Information Discovery
GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.
MITRE ATT&CK technique: T1124: System Time Discovery
Gazer uses custom encryption for C2 that uses RSA.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Gazer has commands to delete files and persistence mechanisms from the victim.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Gazer can execute a task to download a file.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Gazer creates a mutex using the hard-coded value `{531511FA-190D-5D85-8A4A-279F2F592CC7}` to ensure that only one instance of itself is running.
MITRE ATT&CK technique: T1480.002: Execution Guardrails- Mutual Exclusion
Gazer stores configuration items in alternate data streams if the Registry is not accessible.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
Gazer injects its communication module into an Internet accessible process through which it performs C2.
MITRE ATT&CK technique: T1055: Process Injection
Gazer can establish persistence by creating a .lnk file in the Start menu.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Gazer can establish persistence by creating a scheduled task.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Gazer can establish persistence through the system screensaver by configuring it to execute the malware.
MITRE ATT&CK technique: T1546.002: Event Triggered Execution- Screensaver
Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Gazer uses custom encryption for C2 that uses 3DES.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Gazer obtains the current user's security identifier.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.
MITRE ATT&CK technique: T1055.003: Process Injection- Thread Execution Hijacking
For early Gazer versions, the compilation timestamp was faked.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Gazer communicates with its C2 servers over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Gazer can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
Gelsemium can use token manipulation to bypass UAC on Windows7 systems.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Gelsemium can use junk code to hide functions and evade detection.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Gelsemium can bypass UAC to elevate process privileges on a compromised host.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Gelsemium can use the `IARPUinstallerStringLauncher` COM interface are part of its UAC bypass process.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
Gelsemium has the ability to use DNS in communication with C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Gelsemium can collect data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Gelsemium can decompress and decrypt DLLs and shellcode.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Gelsemium can use dynamic DNS domain names in C2.
MITRE ATT&CK technique: T1568: Dynamic Resolution
Gelsemium has the ability to inject DLLs into specific processes.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Gelsemium has the ability to compress its components.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Gelsemium can use multiple domains and protocols in C2.
MITRE ATT&CK technique: T1008: Fallback Channels
Gelsemium can delete its dropper component from the targeted system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Gelsemium can store its components in the Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
Gelsemium can download additional plug-ins to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Gelsemium has used unverified signatures on malicious DLLs.
MITRE ATT&CK technique: T1036.001: Masquerading- Invalid Code Signature
Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value Chrome Update to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Gelsemium can modify the Registry to store its components.
MITRE ATT&CK technique: T1112: Modify Registry
Gelsemium has the ability to use various Windows API functions to perform tasks.
MITRE ATT&CK technique: T1106: Native API
Gelsemium has the ability to use TCP and UDP in C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Gelsemium can drop itself in C:\Windows\System32\spool\prtprocs\x64\winprint.dll to be loaded automatically by the spoolsv Windows service.
MITRE ATT&CK technique: T1547.012: Boot or Logon Autostart Execution- Print Processors
Gelsemium can enumerate running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.
MITRE ATT&CK technique: T1012: Query Registry
Gelsemium can use custom shellcode to map embedded DLLs into memory.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Gelsemium can set persistence with a Registry run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Gelsemium can check for the presence of specific security products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.
MITRE ATT&CK technique: T1082: System Information Discovery
Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Gelsemium has the ability to perform timestomping of files on targeted systems.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Gelsemium can use junk code to generate random activity to obscure malware behavior.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Gelsemium can use HTTP/S in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Gelsemium can use a batch script to delete itself.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Gelsemium can drop itself in `C:\Windows\System32\spool\prtprocs\x64\winprint.dll` as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.
MITRE ATT&CK technique: T1083: File and Directory Discovery
GeminiDuke collects information on local user accounts from the victim.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
GeminiDuke collects information on running processes and environment variables from the victim.
MITRE ATT&CK technique: T1057: Process Discovery
GeminiDuke collects information on network settings and Internet proxy settings from the victim.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.
MITRE ATT&CK technique: T1007: System Service Discovery
GeminiDuke uses HTTP and HTTPS for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Get2 has the ability to run executables with command-line arguments.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Get2 has the ability to inject DLLs into processes.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Get2 has the ability to identify running processes on an infected host.
MITRE ATT&CK technique: T1057: Process Discovery
Get2 has the ability to identify the computer name and Windows version of an infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
Get2 has the ability to identify the current username of an infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Get2 has the ability to use HTTP to send information collected from an infected host to C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Gold Dragon encrypts data using Base64 before being sent to the command and control server.
MITRE ATT&CK technique: T1560: Archive Collected Data
Gold Dragon terminates anti-malware processes if they’re found running on the system.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Gold Dragon can download additional components from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Gold Dragon checks the running processes on the victim’s machine.
MITRE ATT&CK technique: T1057: Process Discovery
Gold Dragon enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
MITRE ATT&CK technique: T1012: Query Registry
Gold Dragon establishes persistence in the Startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Gold Dragon checks for anti-malware products and processes.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Gold Dragon collects endpoint information using the systeminfo command.
MITRE ATT&CK technique: T1082: System Information Discovery
Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Gold Dragon uses HTTP for communication to the control servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols