sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.
MITRE ATT&CK technique: T1018: Remote System Discovery
menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.
MITRE ATT&CK technique: T1036.003: Masquerading- Rename System Utilities
menuPass has used Putty Secure Copy Client to transfer data.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
menuPass has used a script to execute a command on a target machine via Task Scheduler.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
menuPass has used net use to conduct connectivity checks to machines.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.
MITRE ATT&CK technique: T1199: Trusted Relationship
menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.
MITRE ATT&CK technique: T1078: Valid Accounts
menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.
MITRE ATT&CK technique: T1083: File and Directory Discovery
3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
3PARA RAT uses HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
4H RAT has the capability to obtain file and directory listings.
MITRE ATT&CK technique: T1083: File and Directory Discovery
4H RAT has the capability to obtain a listing of running processes .
MITRE ATT&CK technique: T1057: Process Discovery
4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
4H RAT sends an OS version identifier in its beacons.
MITRE ATT&CK technique: T1082: System Information Discovery
4H RAT uses HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
4H RAT has the capability to create a remote shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
AADInternals can enumerate Azure AD users.
MITRE ATT&CK technique: T1087.004: Account Discovery- Cloud Account
AADInternals can create new Azure AD users.
MITRE ATT&CK technique: T1136.003: Create Account- Cloud Account
AADInternals can execute commands on Azure virtual machines using the VM agent.
MITRE ATT&CK technique: T1651: Cloud Administration Command
AADInternals can enumerate Azure AD groups.
MITRE ATT&CK technique: T1069.003: Permission Groups Discovery- Cloud Groups
AADInternals can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations.
MITRE ATT&CK technique: T1526: Cloud Service Discovery
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
AADInternals can collect files from a user’s OneDrive.
MITRE ATT&CK technique: T1530: Data from Cloud Storage
AADInternals can register a device to Azure AD.
MITRE ATT&CK technique: T1098.005: Account Manipulation- Device Registration
AADInternals can gather information about a tenant’s domains using public Microsoft APIs.
MITRE ATT&CK technique: T1590.001: Gather Victim Network Information- Domain Properties
AADInternals can check for the existence of user email addresses using public Microsoft APIs.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
AADInternals can directly download cloud user data such as OneDrive files.
MITRE ATT&CK technique: T1048: Exfiltration Over Alternative Protocol
AADInternals can inject a malicious DLL into the `AzureADConnectAuthenticationAgentService` to backdoor Azure AD Pass-Through Authentication.
MITRE ATT&CK technique: T1556.007: Modify Authentication Process- Hybrid Identity
AADInternals can dump secrets from the Local Security Authority.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
AADInternals can modify registry keys as part of setting a new pass-through authentication agent.
MITRE ATT&CK technique: T1112: Modify Registry
The AADInternals `Set-AADIntUserMFA` command can be used to disable MFA for a specified user.
MITRE ATT&CK technique: T1556.006: Modify Authentication Process- Multi-Factor Authentication
AADInternals is written and executed via PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
AADInternals can gather encryption keys from Azure AD services such as ADSync and Active Directory Federated Services servers.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
AADInternals can be used to create SAML tokens using the AD Federated Services token signing certificate.
MITRE ATT&CK technique: T1606.002: Forge Web Credentials- SAML Tokens
AADInternals can be used to forge Kerberos tickets using the password hash of the AZUREADSSOACC account.
MITRE ATT&CK technique: T1558.002: Steal or Forge Kerberos Tickets- Silver Ticket
AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
AADInternals can send phishing emails containing malicious links designed to collect users’ credentials.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
AADInternals can steal users’ access tokens via phishing emails containing malicious links.
MITRE ATT&CK technique: T1528: Steal Application Access Token
AADInternals can create and export various authentication certificates, including those associated with Azure AD joined/registered devices.
MITRE ATT&CK technique: T1649: Steal or Forge Authentication Certificates
AADInternals can create a backdoor by converting a domain to a federated domain which will be able to authenticate any user across the tenant. AADInternals can also modify DesktopSSO information.
MITRE ATT&CK technique: T1484.002: Domain or Tenant Policy Modification- Trust Modification
ABK has the ability to decrypt AES encrypted payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ABK has the ability to download files from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ABK has the ability to inject shellcode into svchost.exe.
MITRE ATT&CK technique: T1055: Process Injection
ABK has the ability to identify the installed anti-virus product on the compromised host.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
ABK can extract a malicious Portable Executable from a photo.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
ABK has the ability to use HTTP in communications with C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ABK has the ability to use cmd to run a Portable Executable on the compromised host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch algorithm.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
A variant of ADVSTORESHELL encrypts some C2 with RSA.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Some variants of ADVSTORESHELL achieve persistence by registering the payload as a Shell Icon Overlay handler COM object.
MITRE ATT&CK technique: T1546.015: Event Triggered Execution- Component Object Model Hijacking
ADVSTORESHELL exfiltrates data over the same channel used for C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
ADVSTORESHELL can delete files and directories.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ADVSTORESHELL can list files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ADVSTORESHELL can perform keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
ADVSTORESHELL is capable of setting and deleting Registry values.
MITRE ATT&CK technique: T1112: Modify Registry
ADVSTORESHELL is capable of starting a process using CreateProcess.
MITRE ATT&CK technique: T1106: Native API
Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
ADVSTORESHELL can list connected devices.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
ADVSTORESHELL can list running processes.
MITRE ATT&CK technique: T1057: Process Discovery
ADVSTORESHELL can enumerate registry keys.
MITRE ATT&CK technique: T1012: Query Registry
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.
MITRE ATT&CK technique: T1029: Scheduled Transfer
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
A variant of ADVSTORESHELL encrypts some C2 with 3DES.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
ADVSTORESHELL can run Systeminfo to gather information about the victim.
MITRE ATT&CK technique: T1082: System Information Discovery
ADVSTORESHELL connects to port 80 of a C2 server using Wininet API. Data is exchanged via HTTP POSTs.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ADVSTORESHELL can create a remote shell and run a given command.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ANDROMEDA can download additional payloads from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ANDROMEDA has been delivered through a LNK file disguised as a folder.
MITRE ATT&CK technique: T1036.008: Masquerading- Masquerade File Type
ANDROMEDA has been installed to `C:\Temp\TrustedInstaller.exe` to mimic a legitimate Windows installer service.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
ANDROMEDA can inject into the `wuauclt.exe` process to perform C2 actions.
MITRE ATT&CK technique: T1055: Process Injection
ANDROMEDA can establish persistence by dropping a sample of itself to `C:\ProgramData\Local Settings\Temp\mskmde.com` and adding a Registry run key to execute every time a user logs on.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
ANDROMEDA has been spread via infected USB keys.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
ANDROMEDA has the ability to make GET requests to download files from C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services .
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
AcidRain performs an in-depth wipe of the target filesystem and various attached storage devices through either a data overwrite or calling various IOCTLS to erase it.
MITRE ATT&CK technique: T1485: Data Destruction
AcidRain iterates over device file identifiers on the target, opens the device file, and either overwrites the file or calls various IOCTLS commands to erase it.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
AcidRain identifies specific files and directories in the Linux operating system associated with storage devices.
MITRE ATT&CK technique: T1083: File and Directory Discovery
AcidRain reboots the target system once the various wiping processes are complete.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
Action RAT can collect local data from an infected machine.
MITRE ATT&CK technique: T1005: Data from Local System
Action RAT can use Base64 to decode actor-controlled C2 server communications.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Action RAT has the ability to collect drive and file information on an infected machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Action RAT has the ability to download additional payloads onto an infected machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Action RAT's commands, strings, and domains can be Base64 encoded within the payload.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Action RAT can identify AV products on an infected host using the following command: `cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List`.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
Action RAT has the ability to collect the MAC address of an infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Action RAT has the ability to collect the username from an infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Action RAT can use HTTP to communicate with C2 servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Action RAT can use `cmd.exe` to execute commands on an infected host.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Action RAT can use WMI to gather AV products installed on an infected host.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
AdFind can enumerate domain users.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
AdFind can enumerate domain groups.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
AdFind can gather information about organizational units and domain trusts from Active Directory.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
AdFind has the ability to query Active Directory for computers.
MITRE ATT&CK technique: T1018: Remote System Discovery
AdFind can extract subnet information from Active Directory.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.
MITRE ATT&CK technique: T1560: Archive Collected Data
Agent Tesla has the ability to use form-grabbing to extract data from web data forms.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
Agent Tesla can steal data from the victim’s clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
Agent Tesla has the ability to extract credentials from configuration or support files.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Agent Tesla can gather credentials from a number of browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Agent Tesla has the ability to extract credentials from the Registry.
MITRE ATT&CK technique: T1552.002: Unsecured Credentials- Credentials in Registry
Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Agent Tesla has the capability to kill any running analysis processes and AV software.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Agent Tesla has created hidden folders.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Agent Tesla can download additional files for execution on the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Agent Tesla can log keystrokes on the victim’s machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Agent Tesla can collect account information from the victim’s machine.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Agent Tesla has used SMTP for C2 communications.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
Agent Tesla has been executed through malicious e-mail attachments
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Agent Tesla can achieve persistence by modifying Registry key entries.
MITRE ATT&CK technique: T1112: Modify Registry
Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Agent Tesla can list the current running processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Agent Tesla can inject into known, vulnerable binaries on targeted hosts.
MITRE ATT&CK technique: T1055: Process Injection
Agent Tesla can add itself to the Registry as a startup program to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.
MITRE ATT&CK technique: T1218.009: System Binary Proxy Execution- Regsvcs/Regasm
Agent Tesla has achieved persistence via scheduled tasks.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Agent Tesla can capture screenshots of the victim’s desktop.
MITRE ATT&CK technique: T1113: Screen Capture
The primary delivered mechanism for Agent Tesla is through email phishing messages.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Agent Tesla can collect the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Agent Tesla can collect the timestamp from the victim’s machine.
MITRE ATT&CK technique: T1124: System Time Discovery
Agent Tesla can access the victim’s webcam and record video.
MITRE ATT&CK technique: T1125: Video Capture
Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Agent Tesla has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Agent Tesla can collect names and passwords of all Wi-Fi networks to which a device has previously connected.
MITRE ATT&CK technique: T1016.002: System Network Configuration Discovery- Wi-Fi Discovery
Agent Tesla has used wmi queries to gather information from the system.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Agent.btz saves system information into an XML file that is then XOR-encoded.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.
MITRE ATT&CK technique: T1052.001: Exfiltration Over Physical Medium- Exfiltration over USB
Agent.btz attempts to download an encrypted binary from a specified domain.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Agent.btz obtains the victim username and saves it to a file.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Akira encrypts victim filesystems for financial extortion purposes.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware. These checks are performed through native Windows functions such as GetFileAttributesW.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Akira will delete system volume shadow copies via PowerShell commands.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Akira executes native Windows functions such as GetFileAttributesW and `GetSystemInfo`.
MITRE ATT&CK technique: T1106: Native API
Akira can identify remote file shares for encryption.
MITRE ATT&CK technique: T1135: Network Share Discovery
Akira will execute PowerShell commands to delete system volume shadow copies.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.
MITRE ATT&CK technique: T1057: Process Discovery
Akira uses the GetSystemInfo Windows function to determine the number of processors on a victim machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Akira executes from the Windows command line and can take various arguments for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Akira will leverage COM objects accessed through WMI during execution to evade detection.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Amadey can collect information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Amadey has decoded antivirus name strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Amadey has sent victim data to its C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Amadey has used fast flux DNS for its C2.
MITRE ATT&CK technique: T1568.001: Dynamic Resolution- Fast Flux DNS
Amadey has searched for folders associated with antivirus software.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Amadey can download and execute files to further infect a host machine with additional malware.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Amadey has modified the `:Zone.Identifier` in the ADS area to zero.
MITRE ATT&CK technique: T1553.005: Subvert Trust Controls- Mark-of-the-Web Bypass
Amadey has overwritten registry keys for persistence.
MITRE ATT&CK technique: T1112: Modify Registry
Amadey has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.
MITRE ATT&CK technique: T1106: Native API
Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Amadey has checked for a variety of antivirus products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Amadey has collected the computer name and OS version from a compromised machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.
MITRE ATT&CK technique: T1614: System Location Discovery
Amadey can identify the IP address of a victim machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Amadey has collected the user name from a compromised host using `GetUserNameA`.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Amadey has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Anchor has been signed with valid certificates to evade detection by security tools.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Anchor can install itself as a cron job.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
Variants of Anchor can use DNS tunneling to communicate with C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Anchor can terminate itself if specific execution flags are not present.
MITRE ATT&CK technique: T1480: Execution Guardrails
Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.
MITRE ATT&CK technique: T1008: Fallback Channels
Anchor can self delete its dropper after the malware is successfully deployed.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Anchor can download additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Anchor has used NTFS to hide files.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
Anchor has used ICMP in C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Anchor has obfuscated code with stack strings and string encryption.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Anchor can support windows execution via SMB shares.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Anchor can create a scheduled task for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Anchor can create and execute services to load its payload.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Anchor has come with a packed payload.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Anchor can determine the hostname and linux version on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Anchor can determine the public IP and location of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Anchor can execute payloads via shell scripting.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Anchor has used HTTP and HTTPS in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Anchor has used cmd.exe to run its self deletion routine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Anchor can establish persistence by creating a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Apostle will attempt to delete all event logs on a victim machine following file wipe activity.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Apostle initially masqueraded as ransomware but actual functionality is a data destruction tool, supported by an internal name linked to an early version, wiper-action. Apostle writes random data to original files after an encrypted copy is created, along with resizing the original file to zero and changing time property metadata before finally deleting the original file.
MITRE ATT&CK technique: T1485: Data Destruction
Apostle creates new, encrypted versions of files then deletes the originals, with the new filenames consisting of a random GUID and ".lock" for an extension.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Apostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Apostle searches for files on available drives based on a list of extensions hard-coded into the sample for follow-on wipe activity.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
Apostle's ransomware variant requires that a base64-encoded argument is passed when executed, that is used as the Public Key for subsequent encryption operations. If Apostle is executed without this argument, it automatically runs a self-delete function.
MITRE ATT&CK technique: T1480: Execution Guardrails
Apostle writes batch scripts to disk, such as system.bat and remover.bat, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files.
MITRE ATT&CK technique: T1057: Process Discovery
Apostle achieves persistence by creating a scheduled task, such as MicrosoftCrashHandlerUAC.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Apostle reboots the victim machine following wiping and related activity.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
AppleJeus has used a valid digital signature from Sectigo to appear legitimate.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
AppleJeus has decoded files received from a C2.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
AppleJeus has exfiltrated collected host information to a C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
AppleJeus has deleted the MSI file after installation.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
During AppleJeus's installation process, it uses `postinstall` scripts to extract a hidden plist from the application's `/Resources` folder and execute the `plist` file as a Launch Daemon with elevated permissions.
MITRE ATT&CK technique: T1546.016: Event Triggered Execution- Installer Packages
AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.
MITRE ATT&CK technique: T1543.004: Create or Modify System Process- Launch Daemon
AppleJeus has loaded a plist file using the launchctl command.
MITRE ATT&CK technique: T1569.001: System Services- Launchctl
AppleJeus has required user execution of a malicious MSI installer.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
AppleJeus's spearphishing links required user interaction to navigate to the malicious website.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
AppleJeus has been installed via MSI installer.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
AppleJeus has been distributed via spearphishing link.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
AppleJeus has collected the victim host information after infection.
MITRE ATT&CK technique: T1082: System Information Discovery
AppleJeus has waited a specified time before downloading a second stage payload.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
AppleJeus has sent data to its C2 server via POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
AppleJeus can install itself as a service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
AppleSeed can gain system level privilege by passing SeDebugPrivilege to the AdjustTokenPrivilege API.
MITRE ATT&CK technique: T1134: Access Token Manipulation
AppleSeed has compressed collected data before exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
AppleSeed can zip and encrypt data collected on a target system.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.
MITRE ATT&CK technique: T1119: Automated Collection
AppleSeed has divided files if the size is 0x1000000 bytes or more.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
AppleSeed can collect data on a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
AppleSeed can find and collect data from removable media devices.
MITRE ATT&CK technique: T1025: Data from Removable Media
AppleSeed can decode its payload prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
AppleSeed can exfiltrate files via the C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
AppleSeed has exfiltrated files using web services.
MITRE ATT&CK technique: T1567: Exfiltration Over Web Service
AppleSeed can use a second channel for C2 when the primary channel is in upload mode.
MITRE ATT&CK technique: T1008: Fallback Channels
AppleSeed can delete files from a compromised host after they are exfiltrated.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
AppleSeed has the ability to use JavaScript to execute PowerShell.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
AppleSeed can use GetKeyState and GetKeyboardState to capture keystrokes on the victim’s machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
AppleSeed can stage files in a central location prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
AppleSeed can achieve execution through users running malicious file attachments distributed via email.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
AppleSeed can disguise JavaScript files as PDFs.
MITRE ATT&CK technique: T1036: Masquerading
AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
AppleSeed has the ability to use multiple dynamically resolved API calls.
MITRE ATT&CK technique: T1106: Native API
AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
AppleSeed has the ability to execute its payload via PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
AppleSeed can enumerate the current process on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
AppleSeed can call regsvr32.exe for execution.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
AppleSeed can take screenshots on a compromised host by calling a series of APIs.
MITRE ATT&CK technique: T1113: Screen Capture
AppleSeed has used UPX packers for its payload DLL.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
AppleSeed has been distributed to victims through malicious e-mail attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
AppleSeed can identify the OS version of a targeted system.
MITRE ATT&CK technique: T1082: System Information Discovery
AppleSeed can identify the IP of a targeted system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
AppleSeed can pull a timestamp from the victim's machine.
MITRE ATT&CK technique: T1124: System Time Discovery
AppleSeed has the ability to communicate with C2 over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Aria-body has the ability to identify the titles of running windows on a compromised host.
MITRE ATT&CK technique: T1010: Application Window Discovery
Aria-body has used ZIP to compress data gathered on a compromised host.
MITRE ATT&CK technique: T1560: Archive Collected Data
Aria-body has the ability to execute a process using runas.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
Aria-body has the ability to collect data from USB devices.
MITRE ATT&CK technique: T1025: Data from Removable Media
Aria-body has the ability to decrypt the loader configuration and payload DLL.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Aria-body has the ability to use a DGA for C2 communications.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Aria-body has used an encrypted configuration file for its loader.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Aria-body has the ability to delete files and directories on compromised hosts.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Aria-body has the ability to gather metadata from a file and to search for file and directory names.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Aria-body has the ability to download additional payloads from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Aria-body has the ability to launch files using ShellExecute.
MITRE ATT&CK technique: T1106: Native API
Aria-body has used TCP in C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Aria-body has the ability to enumerate loaded modules for a process..
MITRE ATT&CK technique: T1057: Process Discovery
Aria-body has the ability to use a reverse SOCKS proxy module.
MITRE ATT&CK technique: T1090: Proxy
Aria-body has established persistence via the Startup folder or Run Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Aria-body has the ability to capture screenshots on compromised hosts.
MITRE ATT&CK technique: T1113: Screen Capture
Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Aria-body has the ability to gather TCP and UDP table status listings.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Aria-body has the ability to identify the username on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Aria-body has the ability to duplicate a token from ntprint.exe.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
Aria-body has used HTTP in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
Arp can be used to display ARP configuration information on the host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Astaroth collects information from the clipboard by using the OpenClipboard and GetClipboardData libraries.
MITRE ATT&CK technique: T1115: Clipboard Data
Astaroth has obfuscated and randomized parts of the JScript code it is initiating.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Astaroth uses ActiveX objects for file execution and manipulation.
MITRE ATT&CK technique: T1218.001: System Binary Proxy Execution- Compiled HTML File
Astaroth uses an external software known as NetPass to recover passwords.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Astaroth can launch itself via DLL Search Order Hijacking.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
Astaroth uses a fromCharCode deobfuscation method to avoid explicitly writing execution commands and to hide its code.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Astaroth has used a DGA in C2 communications.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
Astaroth has used an XOR-based algorithm to encrypt payloads twice with different keys.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Astaroth exfiltrates collected information from its r1.log file to the external C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Astaroth loads its module with the XSL script parameter vShow set to zero, which opens the application with a hidden window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Astaroth uses certutil and BITSAdmin to download additional malware.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Astaroth uses JavaScript to perform its core functionalities.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Astaroth logs keystrokes from the victim's machine.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Astaroth collects data in a plaintext file named r1.log before exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Astaroth has used malicious files including VBS, LNK, and HTML for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Astaroth can abuse alternate data streams to store content for malicious payloads.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
Astaroth searches for different processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Astaroth creates a startup item for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Astaroth can be loaded through regsvr32.exe.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Astaroth checks for the presence of Avast antivirus in the C:\Program\Files\ folder.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Astaroth uses the LoadLibraryExW function to load additional modules.
MITRE ATT&CK technique: T1129: Shared Modules
Astaroth's initial payload is a malicious .LNK file.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Astaroth uses a software packer called Pe123\RPolyCryptor.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Astaroth has been delivered via malicious e-mail attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Astaroth encodes data using Base64 before sending it to the C2 server.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Astaroth collects the machine name and keyboard language from the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Astaroth collects the external IP address from the system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Astaroth collects the timestamp from the infected machine.
MITRE ATT&CK technique: T1124: System Time Discovery
Astaroth uses an external software known as NetPass to recover passwords.
MITRE ATT&CK technique: T1552: Unsecured Credentials
Astaroth has used malicious VBS e-mail attachments for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic