sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Astaroth spawns a CMD process to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Astaroth uses WMIC to execute payloads.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.
MITRE ATT&CK technique: T1220: XSL Script Processing
AsyncRAT can use the `CheckRemoteDebuggerPresent` function to detect the presence of a debugger.
MITRE ATT&CK technique: T1622: Debugger Evasion
AsyncRAT can be configured to use dynamic DNS.
MITRE ATT&CK technique: T1568: Dynamic Resolution
AsyncRAT can hide the execution of scheduled tasks using `ProcessWindowStyle.Hidden`.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
AsyncRAT has the ability to download files over SFTP.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
AsyncRAT can capture keystrokes on the victim’s machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
AsyncRAT has the ability to use OS APIs including `CheckRemoteDebuggerPresent`.
MITRE ATT&CK technique: T1106: Native API
AsyncRAT can examine running processes to determine if a debugger is present.
MITRE ATT&CK technique: T1057: Process Discovery
AsyncRAT can create a scheduled task to maintain persistence on system start-up.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
AsyncRAT has the ability to view the screen on compromised hosts.
MITRE ATT&CK technique: T1113: Screen Capture
AsyncRAT can identify strings such as Virtual, vmware, or VirtualBox to detect virtualized environments.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
AsyncRAT can check the disk size through the values obtained with `DeviceInfo.`
MITRE ATT&CK technique: T1082: System Information Discovery
AsyncRAT can check if the current user of a compromised system is an administrator.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
AsyncRAT can record screen content on targeted systems.
MITRE ATT&CK technique: T1125: Video Capture
Attor can obtain application window titles and then determines which windows to perform Screen Capture on.
MITRE ATT&CK technique: T1010: Application Window Discovery
Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Attor's Blowfish key is encrypted with a public RSA key.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
Attor's has a plugin that is capable of recording audio using available input sound devices.
MITRE ATT&CK technique: T1123: Audio Capture
Attor has automatically collected data about the compromised system.
MITRE ATT&CK technique: T1119: Automated Collection
Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.
MITRE ATT&CK technique: T1115: Clipboard Data
Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Attor has exfiltrated data over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Attor’s plugin deletes the collected files and log files after exfiltration.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Attor has used FTP protocol for C2 communication.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Attor can download additional plugins, updates and other files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Attor has staged collected data in a central upload directory prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Attor's dispatcher can establish persistence via adding a Registry key with a logon script HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" .
MITRE ATT&CK technique: T1037.001: Boot or Logon Initialization Scripts- Logon Script (Windows)
Attor's dispatcher disguises itself as a legitimate task .
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Attor's dispatcher can modify the Run registry key.
MITRE ATT&CK technique: T1112: Modify Registry
Attor has used Tor for C2 communication.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Attor's dispatcher has used CreateProcessW API for execution.
MITRE ATT&CK technique: T1106: Native API
Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.
MITRE ATT&CK technique: T1055: Process Injection
Attor has opened the registry and performed query searches.
MITRE ATT&CK technique: T1012: Query Registry
Attor's installer plugin can schedule rundll32.exe to load the dispatcher.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Attor's has a plugin that captures screenshots of the target applications.
MITRE ATT&CK technique: T1113: Screen Capture
Attor's dispatcher can be executed as a service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Attor's dispatcher can execute additional plugins by loading the respective DLLs.
MITRE ATT&CK technique: T1129: Shared Modules
Attor has encrypted data symmetrically using a randomly generated Blowfish key which is encrypted with a public RSA key.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Attor monitors the free disk space on the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Attor has manipulated the time of last access to files and registry keys after they have been created or modified.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Attor's dispatcher can establish persistence by registering a new service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.
MITRE ATT&CK technique: T1005: Data from Local System
AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
AuTo Stealer can use TCP to communicate with command and control servers.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
AuTo Stealer can place malicious executables in a victim's AutoRun registry key or StartUp directory, depending on the AV product installed, to maintain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
AuTo Stealer has the ability to collect information about installed AV products from an infected host.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
AuTo Stealer has the ability to collect the hostname and OS information from an infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
AuTo Stealer has the ability to collect the username from an infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
AuTo Stealer can use HTTP to communicate with its C2 servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
AuTo Stealer can use `cmd.exe` to execute a created batch file.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
AuditCred uses XOR and RC4 to perform decryption on the code functions.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
AuditCred encrypts the configuration.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
AuditCred can delete files from the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
AuditCred can search through folders and files on the system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
AuditCred can download files and additional malware.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
AuditCred can inject code from files to other running processes.
MITRE ATT&CK technique: T1055: Process Injection
AuditCred can utilize proxy for communications.
MITRE ATT&CK technique: T1090: Proxy
AuditCred can open a reverse shell on the system to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
AuditCred is installed as a new service on the system.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
AutoIt backdoor attempts to escalate privileges by bypassing User Access Control.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.
MITRE ATT&CK technique: T1083: File and Directory Discovery
AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
AutoIt backdoor has sent a C2 response that was base64-encoded.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Avaddon bypasses UAC using the CMSTPLUA COM interface.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Avaddon has decrypted encrypted strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Avaddon looks for and attempts to stop anti-malware solutions.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Avaddon has searched for specific files prior to encryption.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Avaddon deletes backups and shadow copies using native system tools.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Avaddon has been executed through a malicious JScript downloader.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Avaddon modifies several registry keys for persistence and UAC bypass.
MITRE ATT&CK technique: T1112: Modify Registry
Avaddon has used the Windows Crypto API to generate an AES key.
MITRE ATT&CK technique: T1106: Native API
Avaddon has enumerated shared folders and mapped volumes.
MITRE ATT&CK technique: T1135: Network Share Discovery
Avaddon has used encrypted strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Avaddon has collected information about running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Avaddon uses registry run keys for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Avaddon looks for and attempts to stop database processes.
MITRE ATT&CK technique: T1489: Service Stop
Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States entities.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Avaddon can collect the external IP address of the victim.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Avaddon uses wmic.exe to delete shadow copies.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Avenger has the ability to decrypt files downloaded from C2.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Avenger has the ability to XOR encrypt files to be sent to C2.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Avenger has the ability to browse files in directories such as Program Files and the Desktop.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Avenger has the ability to download files from C2 to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Avenger has the ability to use Tasklist to identify running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Avenger has the ability to inject shellcode into svchost.exe.
MITRE ATT&CK technique: T1055: Process Injection
Avenger has the ability to identify installed anti-virus products on a compromised host.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Avenger can extract backdoor malware from downloaded images.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Avenger has the ability to identify the host volume ID and the OS architecture on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Avenger can identify the domain of the compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Avenger has the ability to use HTTP in communication with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
AvosLocker has encrypted files and network resources using AES-256 and added an `.avos`, `.avos2`, or `.AvosLinux` extension to filenames.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
AvosLocker has deobfuscated XOR-encoded strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
AvosLocker has used obfuscated API calls that are retrieved by their checksums.
MITRE ATT&CK technique: T1027.007: Obfuscated Files or Information- Dynamic API Resolution
AvosLocker has searched for files and directories on a compromised network.
MITRE ATT&CK technique: T1083: File and Directory Discovery
AvosLocker has hidden its console window by using the `ShowWindow` API function.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
AvosLocker has been disguised as a .jpg file.
MITRE ATT&CK technique: T1036.008: Masquerading- Masquerade File Type
AvosLocker has used a variety of Windows API calls, including `NtCurrentPeb` and `GetLogicalDrives`.
MITRE ATT&CK technique: T1106: Native API
AvosLocker has enumerated shared drives on a compromised network.
MITRE ATT&CK technique: T1135: Network Share Discovery
AvosLocker has used XOR-encoded strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
AvosLocker has discovered system processes by calling `RmGetList`.
MITRE ATT&CK technique: T1057: Process Discovery
AvosLocker has been executed via the `RunOnce` Registry key to run itself on safe mode.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
AvosLocker can restart a compromised machine in safe mode.
MITRE ATT&CK technique: T1562.009: Impair Defenses- Safe Mode Boot
AvosLocker has terminated specific processes before encryption.
MITRE ATT&CK technique: T1489: Service Stop
AvosLocker’s Linux variant has terminated ESXi virtual machines.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
AvosLocker has checked the system time before and after encryption.
MITRE ATT&CK technique: T1124: System Time Discovery
Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Azorult can steal credentials from the victim's browser.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Azorult can delete files from victim machines.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Azorult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.
MITRE ATT&CK technique: T1057: Process Discovery
Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Azorult can check for installed software on the system under the Registry key Software\Microsoft\Windows\CurrentVersion\Uninstall.
MITRE ATT&CK technique: T1012: Query Registry
Azorult can capture screenshots of the victim’s machines.
MITRE ATT&CK technique: T1113: Screen Capture
Azorult can encrypt C2 traffic using XOR.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.
MITRE ATT&CK technique: T1082: System Information Discovery
Azorult can collect host IP information from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Azorult can collect the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Azorult can collect the time zone information from the system.
MITRE ATT&CK technique: T1124: System Time Discovery
The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Adversaries can direct BACKSPACE to upload files to the C2 Server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
BACKSPACE allows adversaries to search for files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.
MITRE ATT&CK technique: T1112: Modify Registry
BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
Newer variants of BACKSPACE will encode C2 communications with a custom system.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
BACKSPACE may collect information about running processes.
MITRE ATT&CK technique: T1057: Process Discovery
BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.
MITRE ATT&CK technique: T1012: Query Registry
BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
During its initial execution, BACKSPACE extracts operating system information from the infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
BACKSPACE uses HTTP as a transport to communicate with its command server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BADCALL disables the Windows firewall before binding to a port.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
BADCALL modifies the firewall Registry key SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List.
MITRE ATT&CK technique: T1112: Modify Registry
BADCALL communicates on ports 443 and 8000 with a FakeTLS method.
MITRE ATT&CK technique: T1571: Non-Standard Port
BADCALL uses a FakeTLS method during C2.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
BADCALL functions as a proxy server between the victim and C2 server.
MITRE ATT&CK technique: T1090: Proxy
BADCALL encrypts C2 traffic using an XOR/ADD cipher.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
BADCALL collects the computer name and host name on the compromised system.
MITRE ATT&CK technique: T1082: System Information Discovery
BADCALL collects the network adapter information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
BADFLICK has compressed data using the aPLib compression library.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
BADFLICK has uploaded files from victims' machines.
MITRE ATT&CK technique: T1005: Data from Local System
BADFLICK can decode shellcode using a custom rotating XOR cipher.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BADFLICK has searched for files on the infected host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BADFLICK has download files from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
BADFLICK has captured victim computer name, memory space, and CPU details.
MITRE ATT&CK technique: T1082: System Information Discovery
BADFLICK has captured victim IP address details.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
BADHATCH can inject itself into a new `svchost.exe -k netsvcs` process using the asynchronous procedure call queue.
MITRE ATT&CK technique: T1055.004: Process Injection- Asynchronous Procedure Call
BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
BADHATCH malicious PowerShell commands can be encoded with base64.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
BADHATCH can use `net.exe group "domain admins" /domain` to identify Domain Administrators.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
BADHATCH can use `nltest.exe /domain_trusts` to discover domain trust relationships on a compromised machine.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
BADHATCH has the ability to execute a malicious DLL by injecting into `explorer.exe` on a compromised machine.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
BADHATCH has an embedded second stage DLL payload within the first stage of the malware.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
BADHATCH can be compressed with the ApLib algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
BADHATCH can exfiltrate data over the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
BADHATCH has the ability to delete PowerShell scripts from a compromised machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
BADHATCH can emulate an FTP server to connect to actor-controlled C2 servers.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
BADHATCH has the ability to load a second stage malicious DLL file onto a compromised machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BADHATCH can utilize Native API functions such as, `ToolHelp32` and `Rt1AdjustPrivilege` to enable `SeDebugPrivilege` on a compromised machine.
MITRE ATT&CK technique: T1106: Native API
BADHATCH can check for open ports on a computer by establishing a TCP connection.
MITRE ATT&CK technique: T1046: Network Service Discovery
BADHATCH can check a user's access to the C$ share on a compromised machine.
MITRE ATT&CK technique: T1135: Network Share Discovery
BADHATCH can perform pass the hash on compromised machines with x64 versions.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
BADHATCH can utilize `powershell.exe` to execute commands on a compromised host.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
BADHATCH can retrieve a list of running processes from a compromised machine.
MITRE ATT&CK technique: T1057: Process Discovery
BADHATCH can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.
MITRE ATT&CK technique: T1055: Process Injection
BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.
MITRE ATT&CK technique: T1090: Proxy
BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to `CreateThread`.
MITRE ATT&CK technique: T1620: Reflective Code Loading
BADHATCH can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer.
MITRE ATT&CK technique: T1018: Remote System Discovery
BADHATCH can use `schtasks.exe` to gain persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
BADHATCH can take screenshots and send them to an actor-controlled C2 server.
MITRE ATT&CK technique: T1113: Screen Capture
BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, drive information, OS type/version, bitness, and hostname.
MITRE ATT&CK technique: T1082: System Information Discovery
BADHATCH can execute `netstat.exe -f` on a compromised machine.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
BADHATCH can obtain logged user information from a compromised machine and can execute the command `whoami.exe`.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
BADHATCH can obtain the `DATETIME` and `UPTIME` from a compromised machine.
MITRE ATT&CK technique: T1124: System Time Discovery
BADHATCH can impersonate a `lsass.exe` or `vmtoolsd.exe` token.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
BADHATCH can use HTTP and HTTPS over port 443 to communicate with actor-controlled C2 servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BADHATCH can be utilized to abuse `sslip.io`, a free IP to domain mapping service, as part of actor-controlled C2 channels.
MITRE ATT&CK technique: T1102: Web Service
BADHATCH can use `cmd.exe` to execute commands on a compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
BADHATCH can use WMI event subscriptions for persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.
MITRE ATT&CK technique: T1119: Automated Collection
BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.
MITRE ATT&CK technique: T1132: Data Encoding
When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
MITRE ATT&CK technique: T1005: Data from Local System
When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
BADNEWS copies files with certain extensions from USB devices to a predefined directory.
MITRE ATT&CK technique: T1025: Data from Removable Media
BADNEWS collects C2 information via a dead drop resolver.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.
MITRE ATT&CK technique: T1036.001: Masquerading- Invalid Code Signature
When it first starts, BADNEWS spawns a new thread to log keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
BADNEWS attempts to hide its payloads using legitimate filenames.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.
MITRE ATT&CK technique: T1106: Native API
BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
BADNEWS installs a registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
BADNEWS has a command to take a screenshot and send it to the C2 server.
MITRE ATT&CK technique: T1113: Screen Capture
BADNEWS encodes C2 traffic with base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
BADNEWS establishes a backdoor over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BADNEWS is capable of executing commands via cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BBK has the ability to decrypt AES encrypted payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BBK has the ability to download files from C2 to the infected host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.
MITRE ATT&CK technique: T1106: Native API
BBK has the ability to inject shellcode into svchost.exe.
MITRE ATT&CK technique: T1055: Process Injection
BBK can extract a malicious Portable Executable from a photo.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
BBK has the ability to use HTTP in communications with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BBK has the ability to use cmd to run a Portable Executable on the compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BBSRAT can compress data with ZLIB prior to sending it back to the C2 server.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
BBSRAT has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList {42aedc87-2188-41fd-b9a3-0c966feabec1} or Microsoft WBEM New Event Subsystem {F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} depending on the system's CPU architecture.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
BBSRAT uses Expand to decompress a CAB file into executable content.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BBSRAT can delete files and directories.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
BBSRAT can list file and directory information.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BBSRAT can list running processes.
MITRE ATT&CK technique: T1057: Process Discovery
BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
BBSRAT can start, stop, or delete services.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
BBSRAT can query service configuration information.
MITRE ATT&CK technique: T1007: System Service Discovery
BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BBSRAT can modify service configurations.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
BFG Agonizer uses DLL unhooking to remove user mode inline hooks that security solutions often implement. BFG Agonizer also uses IAT unhooking to remove user-mode IAT hooks that security solutions also use.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
BFG Agonizer retrieves a device handle to \\\\.\\PhysicalDrive0 to wipe the boot sector of a given disk.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
BFG Agonizer wipes the boot sector of infected machines to inhibit system recovery.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
BFG Agonizer uses elevated privileges to call NtRaiseHardError to induce a "blue screen of death" on infected systems, causing a system crash. Once shut down, the system is no longer bootable.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
BISCUIT uses SSL for encrypting C2 communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.
MITRE ATT&CK technique: T1008: Fallback Channels
BISCUIT has a command to download a file from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BISCUIT can capture keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
BISCUIT has a command to enumerate running processes and identify their owners.
MITRE ATT&CK technique: T1057: Process Discovery
BISCUIT has a command to periodically take screenshots of the system.
MITRE ATT&CK technique: T1113: Screen Capture
BISCUIT has a command to collect the processor type, operation system, computer name, and whether the system is a laptop or PC.
MITRE ATT&CK technique: T1082: System Information Discovery
BISCUIT has a command to gather the username from the system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
BISCUIT has a command to collect the system `UPTIME`.
MITRE ATT&CK technique: T1124: System Time Discovery
BISCUIT has a command to launch a command shell on the system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BITSAdmin can be used to create BITS Jobs to launch a malicious process.
MITRE ATT&CK technique: T1197: BITS Jobs
BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
BITSAdmin can be used to create BITS Jobs to upload and/or download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
BLACKCOFFEE has the capability to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
BLACKCOFFEE has the capability to enumerate files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
BLACKCOFFEE has the capability to discover processes.
MITRE ATT&CK technique: T1057: Process Discovery
BLACKCOFFEE has the capability to create a reverse shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
BLINDINGCAN has uploaded files from victim machines.
MITRE ATT&CK technique: T1005: Data from Local System
BLINDINGCAN has used AES and XOR to decrypt its DLLs.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BLINDINGCAN has obfuscated code using Base64 encoding.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
BLINDINGCAN has deleted itself and associated artifacts from victim machines.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
BLINDINGCAN can search, read, write, move, and execute files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BLINDINGCAN has downloaded files to a victim machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
BLINDINGCAN has used Rundll32 to load a malicious DLL.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.
MITRE ATT&CK technique: T1129: Shared Modules
BLINDINGCAN has been packed with the UPX packer.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
BLINDINGCAN has encoded its C2 traffic with Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
BLINDINGCAN has encrypted its C2 traffic with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
BLINDINGCAN has collected from a victim machine the system name, processor information, OS version, and disk information, including type and free space available.
MITRE ATT&CK technique: T1082: System Information Discovery
BLINDINGCAN has collected the victim machine's local IP address information and MAC address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
BLINDINGCAN has modified file and directory timestamps.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
BLINDINGCAN has used HTTPS over port 443 for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BLINDINGCAN has executed commands via cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BLUELIGHT can zip files before exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
BLUELIGHT has encoded data into a binary blob using XOR.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
BLUELIGHT can use different cloud providers for its C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
BLUELIGHT has a XOR-encoded payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
BLUELIGHT has exfiltrated data over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
BLUELIGHT can uninstall itself.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
BLUELIGHT can enumerate files and collect associated metadata.
MITRE ATT&CK technique: T1083: File and Directory Discovery
BLUELIGHT can download additional files onto the host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BLUELIGHT can collect process filenames and SID authority level.
MITRE ATT&CK technique: T1057: Process Discovery
BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.
MITRE ATT&CK technique: T1113: Screen Capture
BLUELIGHT can collect a list of anti-virus products installed on a machine.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
BLUELIGHT can check to see if the infected machine has VM tools running.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
BLUELIGHT has collected the computer name and OS version from victim machines.
MITRE ATT&CK technique: T1082: System Information Discovery
BLUELIGHT can collect IP information from the victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
BLUELIGHT can collect the username on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
BLUELIGHT can collect the local time on a compromised host.
MITRE ATT&CK technique: T1124: System Time Discovery
BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
BONDUPDATER uses a DGA to communicate with command and control servers.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
BONDUPDATER uses -windowstyle hidden to conceal a PowerShell window that downloads a payload.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
BONDUPDATER can download or upload files from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
BONDUPDATER is written in PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
BONDUPDATER persists using a scheduled task that executes every minute.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
BOOSTWRITE has been signed by a valid CA.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
BOOSTWRITE has exploited the loading of the legitimate Dwrite.dll file by actually loading the gdi library, which then loads the gdiplus library and ultimately loads the local Dwrite dll.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector to evade detection.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File