sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
RCSession can use an encrypted beacon to check in with C2.
MITRE ATT&CK technique: T1573: Encrypted Channel
RCSession can compress and obfuscate its strings to evade detection on a compromised host.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
RCSession can remove files from a targeted system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
RCSession can store its obfuscated configuration file in the Registry under `HKLM\SOFTWARE\Plus` or `HKCU\SOFTWARE\Plus`.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
RCSession has the ability to drop additional files to an infected machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RCSession has the ability to capture keystrokes on a compromised host.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
RCSession has used a file named English.rtf to appear benign on victim hosts.
MITRE ATT&CK technique: T1036: Masquerading
RCSession can write its configuration file to the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
RCSession has the ability to execute inside the msiexec.exe process.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
RCSession can use WinSock API for communication including WSASend and WSARecv.
MITRE ATT&CK technique: T1106: Native API
RCSession has the ability to use TCP and UDP in C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
RCSession can identify processes based on PID.
MITRE ATT&CK technique: T1057: Process Discovery
RCSession can launch itself from a hollowed svchost.exe process.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
RCSession has the ability to modify a Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
RCSession can capture screenshots from a compromised host.
MITRE ATT&CK technique: T1113: Screen Capture
RCSession can gather system information from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
RCSession can gather system owner information, including user and administrator privileges.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
RCSession can use HTTP in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
RCSession can use `cmd.exe` for execution on compromised hosts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
RDAT has used DNS to communicate with the C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.
MITRE ATT&CK technique: T1001: Data Obfuscation
RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
RDAT has used HTTP if DNS C2 communications were not functioning.
MITRE ATT&CK technique: T1008: Fallback Channels
RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
RDAT can download files via DNS.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RDAT can use email attachments for C2 communications.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
RDAT has used Windows Video Service as a name for malicious services.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
RDAT has masqueraded as VMware.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
RDAT can take a screenshot on the infected system.
MITRE ATT&CK technique: T1113: Screen Capture
RDAT can communicate with the C2 via base32-encoded subdomains.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
RDAT can also embed data within a BMP image prior to exfiltration.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
RDAT can process steganographic images attached to email messages to send and receive C2 commands. RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
RDAT has used AES ciphertext to encode C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
RDAT can use HTTP communications for C2, as well as using the WinHTTP library to make requests to the Exchange Web Services API.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
RDAT has executed commands using cmd.exe /c.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
RDAT has created a service when it is installed on the victim machine.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
RDFSNIFFER has the capability of deleting local files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
RDFSNIFFER has used several Win32 API functions to interact with the victim machine.
MITRE ATT&CK technique: T1106: Native API
REvil has encrypted C2 communications with the ECIES algorithm.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
REvil can launch an instance of itself with administrative rights using runas.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
REvil has the capability to destroy files and folders.
MITRE ATT&CK technique: T1485: Data Destruction
REvil can encrypt files on victim systems and demands a ransom to decrypt the files.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
REvil can decode encrypted strings to enable execution of commands and payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
REvil can connect to and disable the Symantec server on the victim's network.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
REvil can identify the domain membership of a compromised host.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
REvil has infected victim machines through compromised websites and exploit kits.
MITRE ATT&CK technique: T1189: Drive-by Compromise
REvil has used encrypted strings and configuration files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
REvil can exfiltrate host and malware information to C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
REvil can mark its binary code for deletion after reboot.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
REvil has the ability to identify specific files and directories that are not to be encrypted.
MITRE ATT&CK technique: T1083: File and Directory Discovery
REvil can save encryption parameters and system information in the Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
REvil can download a copy of itself from an attacker controlled IP address to the victim machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
REvil has been executed via malicious MS Word e-mail attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
REvil can mimic the names of known executables.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
REvil can modify the Registry to save encryption parameters and system information.
MITRE ATT&CK technique: T1112: Modify Registry
REvil attempts to create a mutex using a hard-coded value to ensure that no other instances of itself are running on the host.
MITRE ATT&CK technique: T1480.002: Execution Guardrails- Mutual Exclusion
REvil can use Native API for execution and to retrieve active services.
MITRE ATT&CK technique: T1106: Native API
REvil has used PowerShell to delete volume shadow copies and download files.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
REvil can inject itself into running processes on a compromised host.
MITRE ATT&CK technique: T1055: Process Injection
REvil can query the Registry to get random file extensions to append to encrypted files.
MITRE ATT&CK technique: T1012: Query Registry
REvil can force a reboot in safe mode with networking.
MITRE ATT&CK technique: T1562.009: Impair Defenses- Safe Mode Boot
REvil has the capability to stop services and kill processes.
MITRE ATT&CK technique: T1489: Service Stop
REvil has been distributed via malicious e-mail attachments including MS Word Documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
REvil can identify the username, machine name, system language, keyboard layout, OS version, and system drive information on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
REvil can check the system language using GetUserDefaultUILanguage and GetSystemDefaultUILanguage. If the language is found in the list, the process terminates.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
REvil can enumerate active services.
MITRE ATT&CK technique: T1007: System Service Discovery
REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
REvil has used obfuscated VBA macros for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
REvil has used HTTP and HTTPS in communication with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
REvil can use the Windows command line to delete volume shadow copies and disable recovery.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
REvil can use WMI to monitor for and kill specific processes listed in its configuration file.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
RGDoor encrypts files with XOR before sending them back to the C2 server.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
RGDoor establishes persistence on webservers as an IIS module.
MITRE ATT&CK technique: T1505.004: Server Software Component- IIS Components
RGDoor uploads and downloads files to and from the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RGDoor executes the whoami on the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
RGDoor uses HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
RGDoor uses cmd.exe to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ROADSWEEP has been digitally signed with a certificate issued to the Kuwait Telecommunications Company KSC.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
ROADSWEEP can RC4 encrypt content in blocks on targeted systems.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
ROADSWEEP can decrypt embedded scripts prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
The ROADSWEEP binary contains RC4 encrypted embedded scripts.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
ROADSWEEP requires four command line arguments to execute correctly, otherwise it will produce a message box and halt execution.
MITRE ATT&CK technique: T1480: Execution Guardrails
ROADSWEEP can use embedded scripts to remove itself from the infected host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ROADSWEEP can enumerate files on infected devices and avoid encrypting files with .exe, .dll, .sys, .lnk, or . lck extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ROADSWEEP has the ability to disable `SystemRestore` and Volume Shadow Copies.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
ROADSWEEP can pipe command output to a targeted process.
MITRE ATT&CK technique: T1559: Inter-Process Communication
ROADSWEEP has dropped ransom notes in targeted folders prior to encrypting the files.
MITRE ATT&CK technique: T1491.001: Defacement- Internal Defacement
ROADSWEEP can identify removable drives attached to the victim's machine.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
ROADSWEEP has been placed in the start up folder to trigger execution upon user login.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
ROADSWEEP can disable critical services and processes.
MITRE ATT&CK technique: T1489: Service Stop
ROADSWEEP can enumerate logical drives on targeted devices.
MITRE ATT&CK technique: T1082: System Information Discovery
ROADSWEEP can open cmd.exe to enable command execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.
MITRE ATT&CK technique: T1119: Automated Collection
ROADTools can enumerate Azure AD users.
MITRE ATT&CK technique: T1087.004: Account Discovery- Cloud Account
ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
ROADTools can enumerate Azure AD groups.
MITRE ATT&CK technique: T1069.003: Permission Groups Discovery- Cloud Groups
ROADTools can enumerate Azure AD applications and service principals.
MITRE ATT&CK technique: T1526: Cloud Service Discovery
ROADTools can enumerate Azure AD systems and devices.
MITRE ATT&CK technique: T1018: Remote System Discovery
ROCKBOOT is a Master Boot Record bootkit that uses the MBR to establish persistence.
MITRE ATT&CK technique: T1542.003: Pre-OS Boot- Bootkit
ROKRAT can use the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.
MITRE ATT&CK technique: T1010: Application Window Discovery
ROKRAT has an audio capture and eavesdropping module.
MITRE ATT&CK technique: T1123: Audio Capture
ROKRAT has used legitimate social networking sites and cloud platforms for C2 communications.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
ROKRAT can extract clipboard data from a compromised host.
MITRE ATT&CK technique: T1115: Clipboard Data
ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
ROKRAT can collect host data and specific file types.
MITRE ATT&CK technique: T1005: Data from Local System
ROKRAT can check for debugging tools.
MITRE ATT&CK technique: T1622: Debugger Evasion
ROKRAT can decrypt strings using the victim's hostname as the key.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ROKRAT relies on a specific victim hostname to execute and decrypt important strings.
MITRE ATT&CK technique: T1480.001: Execution Guardrails- Environmental Keying
ROKRAT can send collected files back over same C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
ROKRAT can send collected data to cloud storage services such as PCloud.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
ROKRAT can request to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ROKRAT has the ability to gather a list of files and directories on the infected system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ROKRAT can retrieve additional malicious payloads from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ROKRAT can use `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model on a compromised host.
MITRE ATT&CK technique: T1112: Modify Registry
ROKRAT can use a variety of API calls to execute shellcode.
MITRE ATT&CK technique: T1106: Native API
ROKRAT can encrypt data prior to exfiltration by using an RSA public key.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
ROKRAT can list the current running processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.
MITRE ATT&CK technique: T1055: Process Injection
ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.
MITRE ATT&CK technique: T1012: Query Registry
ROKRAT can capture screenshots of the infected system using the `gdi32` library.
MITRE ATT&CK technique: T1113: Screen Capture
ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
ROKRAT can check for VMware-related files and DLLs related to sandboxes.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.
MITRE ATT&CK technique: T1082: System Information Discovery
ROKRAT can collect the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
ROKRAT has used Visual Basic for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
ROKRAT can use HTTP and HTTPS for command and control communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ROKRAT can steal credentials by leveraging the Windows Vault mechanism.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.
MITRE ATT&CK technique: T1119: Automated Collection
RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
RTM has the ability to remove Registry entries that it created for persistence.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
RTM collects data from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
RTM samples have been signed with a code-signing certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.
MITRE ATT&CK technique: T1568: Dynamic Resolution
RTM can delete all files created during its execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
RTM can check for specific files and directories associated with virtualization and malware analysis.
MITRE ATT&CK technique: T1083: File and Directory Discovery
RTM can download additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RTM can add a certificate to the Windows store.
MITRE ATT&CK technique: T1553.004: Subvert Trust Controls- Install Root Certificate
RTM can record keystrokes from both the keyboard and virtual keyboard.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
RTM has named the scheduled task it creates "Windows Update".
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
RTM has been delivered as archived Windows executable files masquerading as PDF documents.
MITRE ATT&CK technique: T1036: Masquerading
RTM can delete all Registry entries created during its execution.
MITRE ATT&CK technique: T1112: Modify Registry
RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.
MITRE ATT&CK technique: T1106: Native API
RTM used Port 44443 for its VNC module.
MITRE ATT&CK technique: T1571: Non-Standard Port
RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm. RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
RTM can obtain a list of smart card readers attached to the victim.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
RTM can obtain information about process integrity levels.
MITRE ATT&CK technique: T1057: Process Discovery
RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
RTM has the capability to download a VNC module from command and control .
MITRE ATT&CK technique: T1219: Remote Access Software
RTM runs its core DLL file using rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
RTM tries to add a scheduled task to establish persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
RTM can capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
RTM can obtain information about security software on the victim.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
RTM can scan victim drives to look for specific banking software on the machine to determine next actions.
MITRE ATT&CK technique: T1518: Software Discovery
RTM has been delivered via spearphishing attachments disguised as PDF documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
RTM encrypts C2 traffic with a custom RC4 variant.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
RTM can obtain the computer name, OS version, and default language identifier.
MITRE ATT&CK technique: T1082: System Information Discovery
RTM can obtain the victim username and permissions.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
RTM can obtain the victim time zone.
MITRE ATT&CK technique: T1124: System Time Discovery
RTM can detect if it is running within a sandbox or other virtualized analysis environment.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
RTM has initiated connections to external domains using HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
RTM uses the command line and rundll32.exe to execute.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Raccoon Stealer archives collected system information in a text f ile, `System info.txt`, prior to exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Raccoon Stealer collects files and directories from victim systems based on configuration data downloaded from command and control servers.
MITRE ATT&CK technique: T1119: Automated Collection
Raccoon Stealer will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Raccoon Stealer collects passwords, cookies, and autocomplete information from various popular web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Raccoon Stealer gathers information from repositories associated with cryptocurrency wallets and the Telegram messaging service.
MITRE ATT&CK technique: T1213: Data from Information Repositories
Raccoon Stealer collects data from victim machines based on configuration information received from command and control nodes.
MITRE ATT&CK technique: T1005: Data from Local System
Raccoon Stealer uses RC4-encrypted, base64-encoded strings to obfuscate functionality and command and control servers.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Raccoon Stealer dynamically links key WinApi functions during execution.
MITRE ATT&CK technique: T1027.007: Obfuscated Files or Information- Dynamic API Resolution
Raccoon Stealer uses RC4 encryption for strings and command and control addresses to evade static detection.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Raccoon Stealer uses existing HTTP-based command and control channels for exfiltration.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Raccoon Stealer can remove files related to use and installation.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Raccoon Stealer identifies target files and directories for collection based on a configuration file.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Raccoon Stealer downloads various library files enabling interaction with various data stores and structures to facilitate follow-on information theft.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Raccoon Stealer checks the privileges of running processes to determine if the running user is equivalent to `NT Authority\System`.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Raccoon Stealer queries the Windows Registry to fingerprint the infected host via the `HKLM:\SOFTWARE\Microsoft\Cryptography\MachineGuid` key.
MITRE ATT&CK technique: T1012: Query Registry
Raccoon Stealer can capture screenshots from victim systems.
MITRE ATT&CK technique: T1113: Screen Capture
Raccoon Stealer is capable of identifying running software on victim machines.
MITRE ATT&CK technique: T1518: Software Discovery
Raccoon Stealer attempts to steal cookies and related information in browser history.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
Raccoon Stealer has been distributed through cracked software downloads.
MITRE ATT&CK technique: T1195: Supply Chain Compromise
Raccoon Stealer gathers information on infected systems such as operating system, processor information, RAM, and display information.
MITRE ATT&CK technique: T1082: System Information Discovery
Raccoon Stealer collects the `Locale Name` of the infected device via `GetUserDefaultLocaleName` to determine whether the string `ru` is included, but in analyzed samples no action is taken if present.
MITRE ATT&CK technique: T1614: System Location Discovery
Raccoon Stealer gathers information on the infected system owner and user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Raccoon Stealer gathers victim machine timezone information.
MITRE ATT&CK technique: T1124: System Time Discovery
Raccoon Stealer uses HTTP, and particularly HTTP POST requests, for command and control actions.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Ragnar Locker can delete volume shadow copies using vssadmin delete shadows /all /quiet.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Ragnar Locker has been delivered as an unsigned MSI package that was executed with msiexec.exe.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Ragnar Locker may attempt to connect to removable drives and mapped network drives.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.
MITRE ATT&CK technique: T1564.006: Hide Artifacts- Run Virtual Instance
Ragnar Locker has used rundll32.exe to execute components of VirtualBox.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Ragnar Locker has used sc.exe to execute a service that it creates.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.
MITRE ATT&CK technique: T1489: Service Stop
Before executing malicious code, Ragnar Locker checks the Windows API GetLocaleInfoW and doesn't encrypt files if it finds a former Soviet country.
MITRE ATT&CK technique: T1614: System Location Discovery
Ragnar Locker has used cmd.exe and batch scripts to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Raindrop was built to include a modified version of 7-Zip source code and Far Manager source code.
MITRE ATT&CK technique: T1036: Masquerading
Raindrop was installed under names that resembled legitimate Windows file and directory names.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
After initial installation, Raindrop runs a computation to delay execution.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
RainyDay can use tools to collect credentials from web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
RainyDay can use side-loading to run malicious executables.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
RainyDay can decrypt its payload via a XOR key.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
RainyDay has downloaded as a XOR-encrypted payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
RainyDay can use a file exfiltration tool to upload specific files to Dropbox.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working.
MITRE ATT&CK technique: T1008: Fallback Channels
RainyDay has the ability to uninstall itself by deleting its service and files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
RainyDay can download files to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.
MITRE ATT&CK technique: T1106: Native API
RainyDay can use TCP in C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
RainyDay can enumerate processes on a target system.
MITRE ATT&CK technique: T1057: Process Discovery
RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.
MITRE ATT&CK technique: T1090: Proxy
RainyDay can use scheduled tasks to achieve persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
RainyDay has the ability to capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
RainyDay can use RC4 to encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
RainyDay can create and register a service for execution.
MITRE ATT&CK technique: T1007: System Service Discovery
RainyDay can use HTTP in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
RainyDay can use the Windows Command Shell for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
RainyDay can use services to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.
MITRE ATT&CK technique: T1546.010: Event Triggered Execution- AppInit DLLs
Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Ramsay can compress and archive collected files using WinRAR.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.
MITRE ATT&CK technique: T1119: Automated Collection
Ramsay can use UACMe for privilege escalation.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Ramsay can use the Windows COM API to schedule tasks and maintain persistence.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.
MITRE ATT&CK technique: T1005: Data from Local System
Ramsay can collect data from network drives and stage it for exfiltration.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
Ramsay can collect data from removable media and stage it for exfiltration.
MITRE ATT&CK technique: T1025: Data from Removable Media
Ramsay can extract its agent from the body of a malicious document.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Ramsay has been delivered using OLE objects in malicious documents.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
Ramsay can use ImprovedReflectiveDLLInjection to deploy components.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Ramsay can collect directory and file lists.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Ramsay has been executed through malicious e-mail attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Ramsay has masqueraded as a JPG image file.
MITRE ATT&CK technique: T1036: Masquerading
Ramsay has masqueraded as a 7zip installer.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations. Ramsay can execute its embedded components via CreateProcessA and ShellExecute.
MITRE ATT&CK technique: T1106: Native API
Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.
MITRE ATT&CK technique: T1046: Network Service Discovery
Ramsay can scan for network drives which may contain documents for collection.
MITRE ATT&CK technique: T1135: Network Share Discovery
Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Ramsay can scan for removable media which may contain documents for collection.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Ramsay can gather a list of running processes by using Tasklist.
MITRE ATT&CK technique: T1057: Process Discovery
Ramsay has created Registry Run keys to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Ramsay can spread itself by infecting other portable executable files on removable drives.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Ramsay has included a rootkit to evade defenses.
MITRE ATT&CK technique: T1014: Rootkit
Ramsay can schedule tasks via the Windows COM API to maintain persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.
MITRE ATT&CK technique: T1113: Screen Capture
Ramsay has been distributed through spearphishing emails with malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Ramsay has used base64 to encode its C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Ramsay has PE data embedded within JPEG files contained within Word documents.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.
MITRE ATT&CK technique: T1082: System Information Discovery
Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Ramsay can use netstat to enumerate network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Ramsay can spread itself by infecting other portable executable files on networks shared drives.
MITRE ATT&CK technique: T1080: Taint Shared Content
Ramsay has included embedded Visual Basic scripts in malicious documents.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Ramsay has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Raspberry Robin implements a variation of the ucmDccwCOMMethod technique abusing the Windows AutoElevate backdoor to bypass UAC while elevating privileges.
MITRE ATT&CK technique: T1548: Abuse Elevation Control Mechanism
Raspberry Robin is capable of contacting the TOR network for delivering second-stage payloads.
MITRE ATT&CK technique: T1071: Application Layer Protocol
Raspberry Robin will use the legitimate Windows utility fodhelper.exe to run processes at elevated privileges without requiring a User Account Control prompt.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Raspberry Robin uses a RunOnce Registry key for persistence, where the key is removed after its use on reboot then re-added by the malware after it resumes execution.
MITRE ATT&CK technique: T1070.009: Indicator Removal- Clear Persistence
Raspberry Robin variants can be delivered via highly obfuscated Windows Script Files for initial execution.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Raspberry Robin creates an elevated COM object for CMLuaUtil and uses this to set a registry value that points to the malicious LNK file during execution.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
Raspberry Robin can use legitimate, signed EXE files paired with malicious DLL files to load and run malicious payloads while bypassing defenses.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Raspberry Robin leverages anti-debugging mechanisms through the use of ThreadHideFromDebugger.
MITRE ATT&CK technique: T1622: Debugger Evasion
Raspberry Robin contains several layers of obfuscation to hide malicious code from detection and analysis.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Raspberry Robin can add an exception to Microsoft Defender that excludes the entire main drive from anti-malware scanning to evade detection.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Raspberry Robin uses newly-registered domains containing only a few characters for command and controll purposes, such as "v0.cx".
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Raspberry Robin will check for the presence of several security products on victim machines and will avoid UAC bypass mechanisms if they are identified. Raspberry Robin can use specific cookie values in HTTP requests to command and control infrastructure to validate that requests for second stage payloads originate from the initial downloader script.
MITRE ATT&CK technique: T1480: Execution Guardrails
Raspberry Robin can delete its initial delivery script from disk during execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Raspberry Robin will check to see if the initial executing script is located on the user's Desktop as an anti-analysis check.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Raspberry Robin will drop a copy of itself to a subfolder in %Program Data% or %Program Data%\\Microsoft\\ to attempt privilege elevation and defense evasion if not running in Session 0.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
Raspberry Robin retrieves its second stage payload in a variety of ways such as through msiexec.exe abuse, or running the curl command to download the payload to the victim's %AppData% folder.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Raspberry Robin contains an embedded custom Tor network client that communicates with the primary payload via shared process memory.
MITRE ATT&CK technique: T1559: Inter-Process Communication
Raspberry Robin variants have been delivered via malicious advertising items that, when interacted with, download a malicious archive file containing the initial payload, hosted on services such as Discord.
MITRE ATT&CK technique: T1583.008: Acquire Infrastructure- Malvertising
Raspberry Robin has historically been delivered via infected USB drives containing a malicious LNK object masquerading as a legitimate folder.
MITRE ATT&CK technique: T1036.008: Masquerading- Masquerade File Type
Raspberry Robin will execute its payload prior to initializing command and control traffic by impersonating one of several legitimate program names such as dllhost.exe, regsvr32.exe, or rundll32.exe.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Raspberry Robin uses msiexec.exe for post-installation communication to command and control infrastructure. Msiexec.exe is executed referencing a remote resource for second-stage payload retrieval and execution.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Raspberry Robin will communicate via HTTP over port 8080 for command and control traffic.
MITRE ATT&CK technique: T1571: Non-Standard Port
Raspberry Robin uses mixed-case letters for filenames and commands to evade detection.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Raspberry Robin uses the Windows utility odbcconf.exe to execute malicious commands, using the regsvr flag to execute DLLs and bypass application control mechanisms that are not monitoring for odbcconf.exe abuse.
MITRE ATT&CK technique: T1218.008: System Binary Proxy Execution- Odbcconf
Raspberry Robin can identify processes running on the victim machine, such as security software, during execution.
MITRE ATT&CK technique: T1057: Process Discovery
Raspberry Robin will execute a legitimate process, then suspend it to inject code for a Tor client into the process, followed by resumption of the process to enable Tor client execution.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Raspberry Robin will use a Registry key to achieve persistence through reboot, setting a RunOnce key such as: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce {random value name} = “rundll32 shell32 ShellExec_RunDLLA REGSVR /u /s “{dropped copy path and file name}”” .
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder