sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
KOPILUWAK has piped the results from executed C2 commands to `%TEMP%\result2.dat` on the local machine.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
KOPILUWAK has gained execution through malicious attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
KOPILUWAK can use netstat and Net to discover network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
KOPILUWAK can enumerate current running processes on the targeted machine.
MITRE ATT&CK technique: T1057: Process Discovery
KOPILUWAK has been delivered to victims as a malicious email attachment.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
KOPILUWAK can discover logical drive information on compromised hosts.
MITRE ATT&CK technique: T1082: System Information Discovery
KOPILUWAK can use Arp to discover a target's network configuration setttings.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
KOPILUWAK can use netstat, Arp, and Net to discover current TCP connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
KOPILUWAK can conduct basic network reconnaissance on the victim machine with `whoami`, to get user details.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
KOPILUWAK has used HTTP POST requests to send data to C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Kasidet has the ability to search for a given filename on a victim.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Kasidet has the ability to download and execute additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Kasidet has the ability to initiate keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Kasidet has the ability to search for a given process name in processes currently running in the system.
MITRE ATT&CK technique: T1057: Process Discovery
Kasidet creates a Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Kasidet has the ability to initiate keylogging and screen captures.
MITRE ATT&CK technique: T1113: Screen Capture
Kasidet has the ability to identify any anti-virus installed on the infected system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Kasidet has the ability to obtain a victim's system name and operating system version.
MITRE ATT&CK technique: T1082: System Information Discovery
Kasidet can execute commands using cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Kazuar gathers information about opened windows.
MITRE ATT&CK technique: T1010: Application Window Discovery
Kazuar has used compromised WordPress blogs as C2 servers.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Kazuar can overwrite files with random data before deleting them.
MITRE ATT&CK technique: T1485: Data Destruction
Kazuar uploads files from a specified directory to the C2 server.
MITRE ATT&CK technique: T1005: Data from Local System
If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Kazuar can accept multiple URLs for C2 servers.
MITRE ATT&CK technique: T1008: Fallback Channels
Kazuar can delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Kazuar uses FTP and FTPS to communicate with the C2 server.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
Kazuar finds a specified directory, lists the files and metadata about those files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Kazuar has used internal nodes on the compromised network for C2 communications.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Kazuar gathers information on local groups and members on the victim’s machine.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Kazuar stages command output and collected data in files before exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Kazuar gathers information about local groups and members.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Kazuar obtains a list of running processes through WMI querying and the ps command.
MITRE ATT&CK technique: T1057: Process Discovery
Kazuar adds a sub-key under several Registry run keys.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Kazuar can sleep for a specific time and be set to communicate at specific intervals.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Kazuar captures screenshots of the victim’s screen.
MITRE ATT&CK technique: T1113: Screen Capture
Kazuar adds a .lnk file to the Windows startup folder.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Kazuar encodes communications to the C2 server in Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Kazuar gathers information on the system and local drives.
MITRE ATT&CK technique: T1082: System Information Discovery
Kazuar gathers information about network adapters.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Kazuar gathers information on users.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Kazuar uses /bin/bash to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Kazuar captures images from the webcam.
MITRE ATT&CK technique: T1125: Video Capture
Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Kazuar uses cmd.exe to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Kazuar obtains a list of running processes through WMI querying.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Kazuar can install itself as a new service.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Kerrdown can use DLL side-loading to load malicious DLLs.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Kerrdown can download specific payloads to a compromised host based on OS architecture.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Kerrdown has gained execution through victims opening malicious files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Kerrdown has gained execution through victims opening malicious links.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Kerrdown can encrypt, encode, and compress multiple layers of shellcode.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Kerrdown has been distributed through malicious e-mail attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Kerrdown has been distributed via e-mails containing a malicious link.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.
MITRE ATT&CK technique: T1082: System Information Discovery
Kerrdown can use a VBS base64 decoder function published by Motobit.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Kessel can RC4-encrypt credentials before sending to the C2.
MITRE ATT&CK technique: T1560: Archive Collected Data
Kessel can create a reverse shell between the infected host and a specified system.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
Kessel has decrypted the binary's configuration once the main function was launched.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Kessel's configuration is hardcoded and RC4 encrypted within the binary.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Kessel has exfiltrated information gathered from the infected system to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Kessel can download additional modules from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Kessel has trojanized the ssh_login and user-auth_pubkey functions to steal plaintext credentials.
MITRE ATT&CK technique: T1556: Modify Authentication Process
Kessel can use a proxy during exfiltration if set in the configuration.
MITRE ATT&CK technique: T1090: Proxy
Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Kessel has collected the system architecture, OS version, and MAC address information.
MITRE ATT&CK technique: T1082: System Information Discovery
Kessel has collected the DNS address of the infected host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Variants of Kevin can communicate over DNS through queries to the server for constructed domain names with embedded information.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Kevin can create directories to store logs and other collected data.
MITRE ATT&CK technique: T1074: Data Staged
Kevin can exfiltrate data to the C2 server in 27-character chunks.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
Kevin can upload logs and other data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Kevin has Base64-encoded its configuration file.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Kevin can send data from the victim host through a DNS C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Kevin can assign hard-coded fallback domains for C2.
MITRE ATT&CK technique: T1008: Fallback Channels
Kevin can delete files created on the victim's machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Kevin can hide the current window from the targeted user via the `ShowWindow` API function.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Kevin can download files to the compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
Kevin can use the `ShowWindow` API to avoid detection.
MITRE ATT&CK technique: T1106: Native API
Kevin can use a custom protocol tunneled through DNS or HTTP.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension.
MITRE ATT&CK technique: T1036.003: Masquerading- Rename System Utilities
Kevin can Base32 encode chunks of output files during exfiltration.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Kevin can enumerate the OS version and hostname of a targeted machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Kevin can collect the MAC address and other information from a victim machine using `ipconfig/all`.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Kevin can sleep for a time interval between C2 communication attempts.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Variants of Kevin can communicate with C2 over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Kevin can use a renamed image of `cmd.exe` for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Kevin can compile randomly-generated MOF files into the WMI repository to persistently run malware.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
KeyBoy attempts to collect passwords from browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
KeyBoy uses the Dynamic Data Exchange protocol to download remote payloads.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
KeyBoy has a command to launch a file browser or explorer on the system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
KeyBoy has a download and upload functionality.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
KeyBoy installs a keylogger for intercepting credentials and keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
KeyBoy uses PowerShell commands to download and execute payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
KeyBoy uses Python scripts for installing files and performing execution.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
KeyBoy has a command to perform screen grabbing.
MITRE ATT&CK technique: T1113: Screen Capture
KeyBoy can gather extended system information, such as information about the operating system, disks, and memory.
MITRE ATT&CK technique: T1082: System Information Discovery
KeyBoy can determine the public or WAN IP address for the system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
KeyBoy time-stomped its DLL in order to evade detection.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
KeyBoy uses VBS scripts for installing files and performing execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
KeyBoy can launch interactive shells for communicating with the victim machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
KeyBoy installs a service pointing to a malicious DLL dropped to disk.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
KeyBoy issues the command reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon” to achieve persistence.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
Keydnap prompts the users for credentials.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
Keydnap uses a Launch Agent to persist.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
Keydnap uses a copy of tor2web proxy for HTTPS communications.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Keydnap uses Python for scripting to execute additional commands.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.
MITRE ATT&CK technique: T1564.009: Hide Artifacts- Resource Forking
Keydnap uses the keychaindump project to read securityd memory.
MITRE ATT&CK technique: T1555.002: Credentials from Password Stores- Securityd Memory
Keydnap adds the setuid flag to a binary so it can easily elevate in the future.
MITRE ATT&CK technique: T1548.001: Abuse Elevation Control Mechanism- Setuid and Setgid
Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.
MITRE ATT&CK technique: T1036.006: Masquerading- Space after Filename
Keydnap uses HTTPS for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
KillDisk has attempted to get the access token of a process by calling OpenProcessToken. If KillDisk gets the access token, then it attempt to modify the token privileges with AdjustTokenPrivileges.
MITRE ATT&CK technique: T1134: Access Token Manipulation
KillDisk deletes Application, Security, Setup, and System Windows Event Logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.
MITRE ATT&CK technique: T1485: Data Destruction
KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
KillDisk overwrites the first sector of the Master Boot Record with “0x00”.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
KillDisk has the ability to quit and delete itself.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
KillDisk has used the FindNextFile command as part of its file deletion process.
MITRE ATT&CK technique: T1083: File and Directory Discovery
KillDisk registers as a service under the Plug-And-Play Support name.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.
MITRE ATT&CK technique: T1106: Native API
KillDisk uses VMProtect to make reverse engineering the malware more difficult.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
KillDisk has called GetCurrentProcess.
MITRE ATT&CK technique: T1057: Process Discovery
KillDisk terminates various processes to get the user to reboot the victim machine.
MITRE ATT&CK technique: T1489: Service Stop
KillDisk loads and executes functions from a DLL.
MITRE ATT&CK technique: T1129: Shared Modules
KillDisk retrieves the hard disk name by calling the CreateFileA to \\.\PHYSICALDRIVE0 API.
MITRE ATT&CK technique: T1082: System Information Discovery
KillDisk attempts to reboot the machine by terminating specific processes.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
Kinsing has searched bash_history for credentials.
MITRE ATT&CK technique: T1552.003: Unsecured Credentials- Bash History
Kinsing has attempted to brute force hosts over SSH.
MITRE ATT&CK technique: T1110: Brute Force
Kinsing has created and run a Bitcoin cryptocurrency miner.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
Kinsing was executed with an Ubuntu container entry point that runs shell scripts.
MITRE ATT&CK technique: T1609: Container Administration Command
Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
Kinsing was run through a deployed Ubuntu container.
MITRE ATT&CK technique: T1610: Deploy Container
Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.
MITRE ATT&CK technique: T1133: External Remote Services
Kinsing has used the find command to search for specific files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Kinsing has downloaded additional lateral movement scripts from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Kinsing has used chmod to modify permissions on key files for use.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
Kinsing has searched for private keys.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
Kinsing has used ps to list processes.
MITRE ATT&CK technique: T1057: Process Discovery
Kinsing has used a script to parse files like /etc/hosts and SSH known_hosts to discover remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
Kinsing has used SSH for lateral movement.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
Kinsing has used Unix shell scripts to execute commands in the victim environment.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Kinsing has used valid SSH credentials to access remote hosts.
MITRE ATT&CK technique: T1078: Valid Accounts
Kinsing has communicated with C2 over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Kivars has the ability to uninstall malware from the infected host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Kivars has the ability to list drives on the infected host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Kivars has the ability to conceal its activity through hiding active windows.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Kivars has the ability to download and execute files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Kivars has the ability to initiate keylogging on the infected host.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Kivars has the ability to remotely trigger keyboard input and mouse clicks.
MITRE ATT&CK technique: T1021: Remote Services
Kivars has the ability to capture screenshots on the infected host.
MITRE ATT&CK technique: T1113: Screen Capture
Koadic can use SSL and TLS for communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Koadic has 2 methods for elevating integrity. It can bypass UAC through `eventvwr.exe` and `sdclt.exe`.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Koadic can retrieve the current content of the user clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
Koadic can download files off the target system to send back to the server.
MITRE ATT&CK technique: T1005: Data from Local System
Koadic can perform process injection by using a reflective DLL.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Koadic can obtain a list of directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Koadic has used the command Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden to hide its window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Koadic can download additional files and tools.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Koadic can scan for open TCP ports on the target network.
MITRE ATT&CK technique: T1046: Network Service Discovery
Koadic can scan local network for open SMB.
MITRE ATT&CK technique: T1135: Network Share Discovery
Koadic has used PowerShell to establish persistence.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Koadic has added persistence to the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Koadic can use Regsvr32 to execute additional payloads.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Koadic can enable remote desktop on the victim's machine.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Koadic can use Rundll32 to execute additional payloads.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Koadic has used scheduled tasks to add persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Koadic can gather hashed passwords by dumping SAM/SECURITY hive.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Koadic can run a command on another machine using PsExec.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Koadic can identify logged in users across the domain and views user sessions.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Koadic performs most of its operations using Windows Script Host and runs arbitrary shellcode .
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Koadic has used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host and to run arbitrary shellcode.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Koadic can use WMI to execute commands.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Kobalos's authentication and key exchange is performed using RSA-512.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Kobalos can remove all command history on compromised hosts.
MITRE ATT&CK technique: T1070.003: Indicator Removal- Clear Command History
Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
Kobalos can write captured SSH connection credentials to a file under the /var/run directory with a .pid extension for exfiltration.
MITRE ATT&CK technique: T1074: Data Staged
Kobalos decrypts strings right after the initial communication, but before the authentication process.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Kobalos can exfiltrate credentials over the network via UDP.
MITRE ATT&CK technique: T1048: Exfiltration Over Alternative Protocol
Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.
MITRE ATT&CK technique: T1056: Input Capture
Kobalos can chain together multiple compromised machines as proxies to reach their final targets.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Kobalos can record the hostname and kernel version of the target machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Kobalos can record the IP address of the target machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Kobalos can modify timestamps of replaced files, such as ssh with the added credential stealer or sshd used to deploy Kobalos.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.
MITRE ATT&CK technique: T1205: Traffic Signaling
Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
The Komplex trojan supports file deletion.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
The Komplex payload is stored in a hidden directory at /Users/Shared/.local/kextd.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
The OsInfo function in Komplex collects a running process list.
MITRE ATT&CK technique: T1057: Process Discovery
The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
The OsInfo function in Komplex collects the current running username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
The Komplex C2 channel uses HTTP POST requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Kwampirs decrypts and extracts a copy of its main DLL payload when executing.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Kwampirs collects a list of domain groups with the command net localgroup /domain.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Kwampirs uses a large list of C2 servers that it cycles through until a successful connection is established.
MITRE ATT&CK technique: T1008: Fallback Channels
Kwampirs collects a list of files and directories in C:\ with the command dir /s /a c:\ >> "C:\windows\TEMP\RANDOM.tmp".
MITRE ATT&CK technique: T1083: File and Directory Discovery
Kwampirs downloads additional files from C2 servers.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Kwampirs collects a list of accounts with the command net users.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Kwampirs collects a list of network shares with the command net share.
MITRE ATT&CK technique: T1135: Network Share Discovery
Kwampirs collects password policy information with the command net accounts.
MITRE ATT&CK technique: T1201: Password Policy Discovery
Kwampirs collects a list of running services with the command tasklist /v.
MITRE ATT&CK technique: T1057: Process Discovery
Kwampirs collects a list of available servers with the command net view.
MITRE ATT&CK technique: T1018: Remote System Discovery
Kwampirs uses rundll32.exe in a Registry value added to establish persistence.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Kwampirs copies itself over network shares to move laterally on a victim network.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands systeminfo, net config workstation, hostname, ver, set, and date /t.
MITRE ATT&CK technique: T1082: System Information Discovery
Kwampirs collects network adapter and interface information by using the commands ipconfig /all, arp -a and route print. It also collects the system's MAC address with getmac and domain configuration with net config workstation.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Kwampirs collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Kwampirs collects registered owner details by using the commands systeminfo and net config workstation.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Kwampirs collects a list of running services with the command tasklist /svc.
MITRE ATT&CK technique: T1007: System Service Discovery
Kwampirs creates a new service named WmiApSrvEx to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
LIGHTWIRE can imbed itself into the legitimate `compcheckresult.cgi` component of Ivanti Connect Secure VPNs to enable command execution.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
LIGHTWIRE can RC4 decrypt and Base64 decode C2 commands.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
LIGHTWIRE can RC4 encrypt C2 commands.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
LIGHTWIRE can use HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
LIGHTWIRE is a web shell capable of command execution and establishing persistence on compromised Ivanti Secure Connect VPNs.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
LITTLELAMB.WOOLTEA can communicate over SSL using the private key from the Ivanti Connect Secure web server.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
LITTLELAMB.WOOLTEA can append malicious components to the `tmp/tmpmnt/bin/samba_upgrade.tar` archive inside the factory reset partition in attempt to persist post reset.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
LITTLELAMB.WOOLTEA can initialize itself as a daemon to run persistently in the background.
MITRE ATT&CK technique: T1543: Create or Modify System Process
LITTLELAMB.WOOLTEA can monitor for system upgrade events by checking for the presence of `/tmp/data/root/dev`.
MITRE ATT&CK technique: T1083: File and Directory Discovery
LITTLELAMB.WOOLTEA can function as a stand-alone backdoor communicating over the `/tmp/clientsDownload.sock` socket.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
LITTLELAMB.WOOLTEA has the ability to function as a SOCKS proxy.
MITRE ATT&CK technique: T1090: Proxy
LITTLELAMB.WOOLTEA can check the type of Ivanti VPN device it is running on by executing `first_run` to identify the first four bytes of the motherboard serial number.
MITRE ATT&CK technique: T1082: System Information Discovery
LOWBALL uses the Dropbox cloud storage service for command and control.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
LOWBALL command and control occurs via HTTPS over port 443.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
LaZagne can obtain credential information from /etc/shadow using the shadow.py module.
MITRE ATT&CK technique: T1003.008: OS Credential Dumping- /etc/passwd and /etc/shadow
LaZagne can perform credential dumping from MSCache to obtain account and password information.
MITRE ATT&CK technique: T1003.005: OS Credential Dumping- Cached Domain Credentials
LaZagne can obtain credentials from chats, databases, mail, and WiFi.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
LaZagne can obtain credentials from web browsers such as Google Chrome, Internet Explorer, and Firefox.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
LaZagne can obtain credentials from macOS Keychains.
MITRE ATT&CK technique: T1555.001: Credentials from Password Stores- Keychain
LaZagne can perform credential dumping from LSA secrets to obtain account and password information.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
LaZagne can perform credential dumping from memory to obtain account and password information.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
LaZagne can use the `/maps` and `/mem` files to identify regex patterns to dump cleartext passwords from the browser's process memory.
MITRE ATT&CK technique: T1003.007: OS Credential Dumping- Proc Filesystem
LaZagne can obtain credentials from Vault files.
MITRE ATT&CK technique: T1555.004: Credentials from Password Stores- Windows Credential Manager
Latrodectus has been obfuscated with a 129 byte sequence of junk data prepended to the file.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Latrodectus can use the Windows Component Object Model to set scheduled tasks.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
Latrodectus can collect data from a compromised host using a stealer module.
MITRE ATT&CK technique: T1005: Data from Local System
Latrodectus has the ability to check for the presence of debuggers.
MITRE ATT&CK technique: T1622: Debugger Evasion
Latrodectus has the ability to deobfuscate encrypted strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Latrodectus can run `C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain` to identify domain administrator accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Latrodectus can identify domain groups through `cmd.exe /c net group "Domain Admins" /domain`.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Latrodectus can run `C:\Windows\System32\cmd.exe /c nltest /domain_trusts` to discover domain trusts.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Latrodectus can resolve Windows APIs dynamically by hash.
MITRE ATT&CK technique: T1027.007: Obfuscated Files or Information- Dynamic API Resolution
Latrodectus has used a pseudo random number generator algorithm and a rolling XOR key to obfuscate strings.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Latrodectus can exfiltrate encrypted system information to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Latrodectus has the ability to delete itself.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Latrodectus can collect desktop filenames.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Latrodectus can download and execute PEs, DLLs, and shellcode from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Latrodectus has used JavaScript files as part its infection chain during malicious spam email campaigns.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Latrodectus has lured users into opening malicious email attachments for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Latrodectus has been executed through malicious links distributed in email campaigns.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Latrodectus has been packed to appear as a component to Bitdefender’s kernel-mode driver, TRUFOS.SYS.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Latrodectus has called `msiexec` to install remotely-hosted MSI files.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Latrodectus has used a two-tiered C2 configuration with tier one nodes connecting to the victim and tier two nodes connecting to backend infrastructure.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
Latrodectus can delete itself while its process is still running through the use of an alternate data stream.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
Latrodectus has used multiple Windows API post exploitation including `GetAdaptersInfo`, `CreateToolhelp32Snapshot`, and `CreateProcessW`.
MITRE ATT&CK technique: T1106: Native API
Latrodectus can run `C:\Windows\System32\cmd.exe /c net view /all` to discover network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
Latrodectus can enumerate running processes including process grandchildren on targeted hosts.
MITRE ATT&CK technique: T1057: Process Discovery
Latrodectus can set an AutoRun key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Latrodectus can use rundll32.exe to execute downloaded DLLs.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Latrodectus can create scheduled tasks for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Latrodectus has the ability to identify installed antivirus products.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
The Latrodectus payload has been packed for obfuscation.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Latrodectus has been distributed through reply-chain phishing emails with malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Latrodectus has been distributed to victims through emails containing malicious links.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Latrodectus has Base64-encoded the message body of a HTTP request sent to C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Latrodectus can send RC4 encrypted data over C2 channels.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Latrodectus can determine if it is running in a virtualized environment by checking the OS version, checking the number of running processes, ensuring a 64-bit application is running on a 64-bit host, and checking if the host has a valid MAC address.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Latrodectus can gather operating system information.
MITRE ATT&CK technique: T1082: System Information Discovery
Latrodectus can discover the IP and MAC address of a targeted host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Latrodectus can discover the username of an infected host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Latrodectus has the ability to restart compromised hosts.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
Latrodectus has routed C2 traffic using Keyhole VNC.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
Latrodectus can send registration information to C2 via HTTP `POST`.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Latrodectus has used Google Firebase to download malicious installation scripts.
MITRE ATT&CK technique: T1102: Web Service
The Latrodectus command handler can use `cmdexe` to run multiple discovery commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Latrodectus has used WMI in malicious email infection chains to facilitate the installation of remotely-hosted files.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
LightNeuron contains a function to encrypt and store emails that it collects.
MITRE ATT&CK technique: T1560: Archive Collected Data
LightNeuron can be configured to automatically collect files under a specified directory.
MITRE ATT&CK technique: T1119: Automated Collection
LightNeuron can be configured to automatically exfiltrate files under a specified directory.
MITRE ATT&CK technique: T1020: Automated Exfiltration
LightNeuron can collect files from a local system.
MITRE ATT&CK technique: T1005: Data from Local System
LightNeuron has used AES and XOR to decrypt configuration files and commands.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
LightNeuron encrypts its configuration files with AES-256.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
LightNeuron exfiltrates data over its email C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
LightNeuron has a function to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
LightNeuron has the ability to download and execute additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
LightNeuron uses SMTP for C2.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as winmail.dat.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
LightNeuron is capable of starting a process using CreateProcess.
MITRE ATT&CK technique: T1106: Native API
LightNeuron collects Exchange emails matching rules specified in its configuration.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
LightNeuron can be configured to exfiltrate data during nighttime or working hours.
MITRE ATT&CK technique: T1029: Scheduled Transfer
LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
LightNeuron uses AES to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
LightNeuron gathers the victim computer name using the Win32 API call GetComputerName.
MITRE ATT&CK technique: T1082: System Information Discovery
LightNeuron gathers information about network adapters using the Win32 API call GetAdaptersInfo.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
LightNeuron is capable of modifying email content, headers, and attachments during transit.
MITRE ATT&CK technique: T1565.002: Data Manipulation- Transmitted Data Manipulation
LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.
MITRE ATT&CK technique: T1505.002: Server Software Component- Transport Agent
LightNeuron is capable of executing commands via cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Linfo creates a backdoor through which remote attackers can obtain data from local systems.
MITRE ATT&CK technique: T1005: Data from Local System
Linfo creates a backdoor through which remote attackers can change C2 servers.
MITRE ATT&CK technique: T1008: Fallback Channels
Linfo creates a backdoor through which remote attackers can delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.
MITRE ATT&CK technique: T1083: File and Directory Discovery