sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Daserf can use steganography to hide malicious code downloaded to the victim.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
Daserf uses RC4 encryption to obfuscate HTTP traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Daserf uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Daserf can execute shell commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
DealersChoice leverages vulnerable versions of Flash to perform execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
DealersChoice uses HTTP for communication with the C2 server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Denis compressed collected data using zlib.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
Denis has encoded its PowerShell commands in Base64.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Denis exploits a security vulnerability to load a fake DLL and execute its code.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Denis has used DNS tunneling for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Denis will decrypt important strings used for C&C communication.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Denis has a command to delete files from the victim’s machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Denis has several commands to search directories for files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
Denis deploys additional backdoors and hacking tools to the system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs. Denis also used the Wow64SetThreadContext API as part of a process hollowing process.
MITRE ATT&CK technique: T1106: Native API
Denis obfuscates its code and encrypts the API names.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Denis has a version written in PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Denis queries the Registry for keys and values.
MITRE ATT&CK technique: T1012: Query Registry
Denis encodes the data sent to the server in Base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Denis collects OS information and the computer name from the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Denis uses ipconfig to gather the IP address from the system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Denis enumerates and collects the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Derusbi is capable of performing audio captures.
MITRE ATT&CK technique: T1123: Audio Capture
Derusbi injects itself into the secure shell process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Derusbi uses a backup communication method with an HTTP beacon.
MITRE ATT&CK technique: T1008: Fallback Channels
Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module and then deleting it from the hard disk as well as overwriting the data with null bytes.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Derusbi is capable of obtaining directory, file, and drive listings.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Derusbi is capable of logging keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Derusbi has used unencrypted HTTP on port 443 for C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
Derusbi collects current and parent process IDs.
MITRE ATT&CK technique: T1057: Process Discovery
Derusbi is capable of enumerating Registry keys and values.
MITRE ATT&CK technique: T1012: Query Registry
Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Derusbi is capable of performing screen captures.
MITRE ATT&CK technique: T1113: Screen Capture
Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Derusbi gathers the name of the local host, version of GNU Compiler Collection , and the system information about the CPU, machine, and operating system.
MITRE ATT&CK technique: T1082: System Information Discovery
A Linux version of Derusbi checks if the victim user ID is anything other than zero , and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
The Derusbi malware supports timestomping.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Derusbi is capable of creating a remote Bash shell and executing commands.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Derusbi is capable of capturing video.
MITRE ATT&CK technique: T1125: Video Capture
Diavol can delete specified files from a targeted system.
MITRE ATT&CK technique: T1485: Data Destruction
Diavol has encrypted files using an RSA key though the `CryptEncrypt` API and has appended filenames with ".lock64".
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Diavol can attempt to stop security software.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Diavol has a command to traverse the files and directories in a given path.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Diavol can delete shadow copies using the `IVssBackupComponents` COM object to call the `DeleteSnapshots` method.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text “All your files are encrypted! For more information see “README-FOR-DECRYPT.txt".
MITRE ATT&CK technique: T1491.001: Defacement- Internal Defacement
Diavol has used several API calls like `GetLogicalDriveStrings`, `SleepEx`, `SystemParametersInfoAPI`, `CryptEncrypt`, and others to execute parts of its attack.
MITRE ATT&CK technique: T1106: Native API
Diavol has a `ENMDSKS` command to enumerates available network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
Diavol has Base64 encoded the RSA public key used for encrypting files.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.
MITRE ATT&CK technique: T1057: Process Discovery
Diavol can use the ARP table to find remote hosts to scan.
MITRE ATT&CK technique: T1018: Remote System Discovery
Diavol can spread throughout a network via SMB prior to encryption.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Diavol will terminate services using the Service Control Manager API.
MITRE ATT&CK technique: T1489: Service Stop
Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Diavol can collect the computer name and OS version from the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Diavol can enumerate victims' local and external IPs when registering with C2.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Diavol can collect the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Diavol has used HTTP GET and POST requests for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Dipsind can download remote files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Dipsind encodes C2 traffic with base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Dipsind encrypts C2 data with AES256 in ECB mode.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Dipsind uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Dipsind can spawn remote shells.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
A Dipsind variant registers as a Winlogon Event Notify DLL to establish persistence.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
Disco has achieved initial access and execution through content injection into DNS, HTTP, and SMB replies to targeted hosts that redirect them to download malicious files.
MITRE ATT&CK technique: T1659: Content Injection
Disco can use SMB to transfer files.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
Disco can download files to targeted systems via SMB.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Disco has been executed through inducing user interaction with malicious .zip and .msi files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Disco can create a scheduled task to run every minute for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
DnsSystem can direct queries to custom DNS servers and return C2 commands using TXT records.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
DnsSystem can upload files from infected machines after receiving a command with `uploaddd` in the string.
MITRE ATT&CK technique: T1005: Data from Local System
DnsSystem can exfiltrate collected data to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
DnsSystem can download files to compromised systems after receiving a command with the string `downloaddd`.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DnsSystem has lured victims into opening macro-enabled Word documents for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
DnsSystem can write itself to the Startup folder to gain persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
DnsSystem can Base64 encode data sent to C2.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
DnsSystem can use the Windows user name to create a unique identification for infected users and systems.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
DnsSystem can use `cmd.exe` for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Dok proxies web traffic to potentially monitor and alter victim HTTP traffic.
MITRE ATT&CK technique: T1557: Adversary-in-the-Middle
Dok uses AppleScript to create a login item for persistence.
MITRE ATT&CK technique: T1059.002: Command and Scripting Interpreter- AppleScript
Dok exfiltrates logs of its execution stored in the /tmp folder over FTP using the curl command.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Dok prompts the user for credentials.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
Dok installs a root certificate to aid in Adversary-in-the-Middle actions using the command add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/filename.
MITRE ATT&CK technique: T1553.004: Subvert Trust Controls- Install Root Certificate
Dok installs two LaunchAgents to redirect all network traffic with a randomly generated name for each plist file maintaining the format com.random.name.plist.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
Dok gives all users execute permissions for the application using the command chmod +x /Users/Shared/AppStore.app.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
Dok uses AppleScript to install a login Item by sending Apple events to the System Events process.
MITRE ATT&CK technique: T1547.015: Boot or Logon Autostart Execution- Login Items
Dok downloads and installs Tor via homebrew.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Dok is packed with an UPX executable packer.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Dok adds admin ALL= NOPASSWD: ALL to the /etc/sudoers file.
MITRE ATT&CK technique: T1548.003: Abuse Elevation Control Mechanism- Sudo and Sudo Caching
Doki has used the embedTLS library for network communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Doki was run through a deployed container.
MITRE ATT&CK technique: T1610: Deploy Container
Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
Doki’s container was configured to bind the host root directory.
MITRE ATT&CK technique: T1611: Escape to Host
Doki has used Ngrok to establish C2 and exfiltrate data.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Doki was executed through an open Docker daemon API port.
MITRE ATT&CK technique: T1133: External Remote Services
Doki has resolved the path of a process PID to use as a script argument.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Doki has downloaded scripts from C2.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Doki has disguised a file as a Linux kernel module.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Doki has searched for the current process’s PID.
MITRE ATT&CK technique: T1057: Process Discovery
Doki has executed shell scripts with /bin/sh.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Doki has communicated with C2 over HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Doki has used the dogechain.info API to generate a C2 address.
MITRE ATT&CK technique: T1102: Web Service
Donut can generate shellcode outputs that execute via Ruby.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Donut can patch Antimalware Scan Interface , Windows Lockdown Policy , as well as exit-related Native API functions to avoid process termination.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Donut can erase file references to payloads in-memory after being reflectively loaded and executed.
MITRE ATT&CK technique: T1070: Indicator Removal
Donut can download and execute previously staged shellcode payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Donut can generate shellcode outputs that execute via JavaScript or JScript.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Donut code modules use various API functions to load and inject code.
MITRE ATT&CK technique: T1106: Native API
Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Donut can generate shellcode outputs that execute via PowerShell.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Donut includes subprojects that enumerate and identify information about Process Injection candidates.
MITRE ATT&CK technique: T1057: Process Discovery
Donut includes a subproject DonutTest to inject shellcode into a target process.
MITRE ATT&CK technique: T1055: Process Injection
Donut can generate shellcode outputs that execute via Python.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Donut can generate packed code modules.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Donut can generate shellcode outputs that execute via VBScript.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Donut can use HTTP to download previously staged shellcode payloads.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DownPaper uses PowerShell for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
DownPaper searches and reads the value of the Windows Update Registry Run key.
MITRE ATT&CK technique: T1012: Query Registry
DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.
MITRE ATT&CK technique: T1082: System Information Discovery
DownPaper collects the victim username and sends it to the C2 server.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
DownPaper communicates to its C2 server over HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DownPaper uses the command line.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Downdelph bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.
MITRE ATT&CK technique: T1001.001: Data Obfuscation- Junk Data
Downdelph uses RC4 to encrypt C2 responses.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Dridex has encrypted traffic with RSA.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.
MITRE ATT&CK technique: T1185: Browser Session Hijacking
Dridex can abuse legitimate Windows executables to side-load malicious DLL files.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.
MITRE ATT&CK technique: T1106: Native API
Dridex's strings are obfuscated using RC4.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.
MITRE ATT&CK technique: T1090: Proxy
Dridex can use `regsvr32.exe` to initiate malicious code.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Dridex contains a module for VNC.
MITRE ATT&CK technique: T1219: Remote Access Software
Dridex can maintain persistence via the creation of scheduled tasks within system directories such as `windows\system32\`, `windows\syswow64,` `winnt\system32`, and `winnt\syswow64`.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Dridex has collected a list of installed software on the system.
MITRE ATT&CK technique: T1518: Software Discovery
Dridex has encrypted traffic with RC4.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Dridex has collected the computer name and OS architecture information from the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Dridex has used POST requests and HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
DropBook has used legitimate web services to exfiltrate data.
MITRE ATT&CK technique: T1567: Exfiltration Over Web Service
DropBook can collect the names of all files and folders in the Program Files directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
DropBook can download and execute additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DropBook is a Python-based backdoor compiled with PyInstaller.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
DropBook has checked for the presence of Arabic language in the infected machine's settings.
MITRE ATT&CK technique: T1082: System Information Discovery
DropBook has checked for the presence of Arabic language in the infected machine's settings.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.
MITRE ATT&CK technique: T1102: Web Service
DropBook can execute arbitrary shell commands on the victims' machines.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Drovorub can transfer files from the victim machine.
MITRE ATT&CK technique: T1005: Data from Local System
Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Drovorub can exfiltrate files over C2 infrastructure.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Drovorub can delete specific files from a compromised host.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Drovorub can download files to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Drovorub can use kernel modules to establish persistence.
MITRE ATT&CK technique: T1547.006: Boot or Logon Autostart Execution- Kernel Modules and Extensions
Drovorub can use TCP to communicate between its agent and client modules.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Drovorub has used XOR encrypted payloads in WebSocket client to server messages.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.
MITRE ATT&CK technique: T1014: Rootkit
Drovorub can execute arbitrary commands as root on a compromised system.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Dtrack packs collected data into a password protected archive.
MITRE ATT&CK technique: T1560: Archive Collected Data
Dtrack’s RAT makes a persistent target file with auto execution on the host start.
MITRE ATT&CK technique: T1547: Boot or Logon Autostart Execution
Dtrack can retrieve browser history.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Dtrack can collect a variety of information from victim machines.
MITRE ATT&CK technique: T1005: Data from Local System
Dtrack has used a decryption routine that is part of an executable physical patch.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Dtrack has used a dropper that embeds an encrypted payload as extra data.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
Dtrack can remove its persistence and delete itself.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Dtrack can list files on available disk volumes.
MITRE ATT&CK technique: T1083: File and Directory Discovery
One of Dtrack can replace the normal flow of a program execution with malicious code.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
Dtrack’s can download and upload a file to the victim’s computer.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Dtrack’s dropper contains a keylogging executable.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Dtrack can save collected data to disk, different file formats, and network shares.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Dtrack’s dropper can list all running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Dtrack has used process hollowing shellcode to target a predefined list of processes from %SYSTEM32%.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.
MITRE ATT&CK technique: T1012: Query Registry
Dtrack contains a function that calls LoadLibrary and GetProcAddress.
MITRE ATT&CK technique: T1129: Shared Modules
Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.
MITRE ATT&CK technique: T1082: System Information Discovery
Dtrack can collect the host's IP addresses using the ipconfig command.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Dtrack can collect network and active connection information.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Dtrack used hard-coded credentials to gain access to a network share.
MITRE ATT&CK technique: T1078: Valid Accounts
Dtrack has used cmd.exe to add a persistent service.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Dtrack can add a service called WBService to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.
MITRE ATT&CK technique: T1134: Access Token Manipulation
Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.
MITRE ATT&CK technique: T1071: Application Layer Protocol
The discovery modules used with Duqu can collect information on open windows.
MITRE ATT&CK technique: T1010: Application Window Discovery
Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system .
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Duqu can track key presses with a keylogger module.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
The discovery modules used with Duqu can collect information on accounts and permissions.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Duqu has used msiexec to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
The discovery modules used with Duqu can collect information on process details.
MITRE ATT&CK technique: T1057: Process Discovery
Duqu is capable of loading executable code via process hollowing.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials . The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials . The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
The Duqu command and control protocol's data stream can be encrypted with AES-CBC.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
The reconnaissance modules used with Duqu can collect information on network configuration.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
The discovery modules used with Duqu can collect information on network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials . The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
MITRE ATT&CK technique: T1078: Valid Accounts
Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
DustySky can compress files via RAR while staging data to be exfiltrated.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
DustySky has exfiltrated data to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
DustySky has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.
MITRE ATT&CK technique: T1008: Fallback Channels
DustySky can delete files it creates from the infected system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
DustySky contains a keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
DustySky searches for network drives and removable media and duplicates itself onto them.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
DustySky created folders in temp directories to host collected files before exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
DustySky can detect connected USB devices.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
DustySky collects information about running processes from victims.
MITRE ATT&CK technique: T1057: Process Discovery
DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
DustySky searches for removable media and duplicates itself onto it.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
DustySky captures PNG screenshots of the main screen.
MITRE ATT&CK technique: T1113: Screen Capture
DustySky checks for the existence of anti-virus.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
DustySky lists all installed software for the infected machine.
MITRE ATT&CK technique: T1518: Software Discovery
DustySky extracts basic information about the operating system.
MITRE ATT&CK technique: T1082: System Information Discovery
DustySky has used both HTTP and HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Dyre decrypts resources needed for targeting the victim.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Dyre injects into other processes to load modules.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Dyre has the ability to send information staged on a compromised host externally to C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Dyre has a command to download and executes additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Dyre has the ability to create files in a TEMP folder to act as a database to store information.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Dyre has the ability to directly inject its code into the web browser process.
MITRE ATT&CK technique: T1055: Process Injection
Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Dyre has the ability to identify installed programs on a compromised host.
MITRE ATT&CK technique: T1518: Software Discovery
Dyre has been delivered with encrypted resources and must be unpacked for execution.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Dyre can detect sandbox analysis environments by inspecting the process list and Registry.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
Dyre has the ability to identify network settings on a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Dyre has the ability to identify the users on a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Dyre has the ability to identify running services on a compromised host.
MITRE ATT&CK technique: T1007: System Service Discovery
Dyre uses HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Dyre registers itself as a service by adding several Registry keys.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
ECCENTRICBANDWAGON can delete log files generated from the malware stored at C:\windows\temp\tmp0207.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ECCENTRICBANDWAGON can capture and store keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome, %temp%\Downloads, and %temp%\TrendMicroUpdate directories.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
ECCENTRICBANDWAGON has encrypted strings with RC4.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
ECCENTRICBANDWAGON can capture screenshots and store them locally.
MITRE ATT&CK technique: T1113: Screen Capture
ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
EKANS uses standard encryption library functions to encrypt files.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
EKANS stops processes related to security and management software.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
EKANS has been disguised as update.exe to appear as a valid executable.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
EKANS uses encoded strings in its process kill list.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
EKANS looks for processes from a hard-coded list.
MITRE ATT&CK technique: T1057: Process Discovery
EKANS stops database, data backup solution, antivirus, and ICS-related processes.
MITRE ATT&CK technique: T1489: Service Stop
EKANS can determine the domain of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
EKANS can use Windows Mangement Instrumentation calls to execute operations.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
ELMER is capable of performing directory listings.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ELMER is capable of performing process listings.
MITRE ATT&CK technique: T1057: Process Discovery
ELMER uses HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
EVILNUM can upload files over the C2 channel from the infected host.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.
MITRE ATT&CK technique: T1070: Indicator Removal
EVILNUM can download and upload files to the victim's computer.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
EVILNUM can make modifications to the Regsitry for persistence.
MITRE ATT&CK technique: T1112: Modify Registry
EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.
MITRE ATT&CK technique: T1102.003: Web Service- One-Way Communication
EVILNUM can achieve persistence through the Registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
EVILNUM can execute commands and scripts through rundll32.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
EVILNUM can search for anti-virus products on the system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
EVILNUM can harvest cookies and upload them to the C2 server.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
EVILNUM can obtain the computer name from the victim's system.
MITRE ATT&CK technique: T1082: System Information Discovery
EVILNUM can obtain the username from the victim's machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
EVILNUM has changed the creation date of files.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
EVILNUM has used the Windows Management Instrumentation tool to enumerate infected machines.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
If credentials are not collected for two weeks, Ebury encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Ebury modifies the `keyutils` library to add malicious behavior to the OpenSSH client and the curl library.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
Ebury has used DNS requests over UDP port 53 for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Ebury disables OpenSSH, system , and audit logs when the backdoor is active.
MITRE ATT&CK technique: T1562.012: Impair Defenses- Disable or Modify Linux Audit System
Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Ebury has used a DGA to generate a domain name for C2.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
When Ebury is running as an OpenSSH server, it uses LD_PRELOAD to inject its malicious shared module in to programs launched by SSH sessions. Ebury hooks the following functions from `libc` to inject into subprocesses; `system`, `popen`, `execve`, `execvpe`, `execv`, `execvp`, and `execl`.
MITRE ATT&CK technique: T1574.006: Hijack Execution Flow- Dynamic Linker Hijacking
Ebury exfiltrates a list of outbound and inbound SSH sessions using OpenSSH's `known_host` files and `wtmp` records. Ebury can exfiltrate SSH credentials through custom DNS queries or use the command `Xcat` to send the process's ssh session's credentials to the C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.
MITRE ATT&CK technique: T1008: Fallback Channels
Ebury hooks system functions to prevent the user from seeing malicious files , hide process activity , and socket activity .
MITRE ATT&CK technique: T1562.006: Impair Defenses- Indicator Blocking
Ebury can intercept private keys using a trojanized ssh-add function.
MITRE ATT&CK technique: T1556: Modify Authentication Process
Ebury has obfuscated its strings with a simple XOR encryption with a static key.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Ebury can deactivate PAM modules to tamper with the sshd configuration.
MITRE ATT&CK technique: T1556.003: Modify Authentication Process- Pluggable Authentication Modules
Ebury has intercepted unencrypted private keys as well as private key pass-phrases.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
Ebury has used Python to implement its DGA.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Ebury acts as a user land rootkit using the SSH service.
MITRE ATT&CK technique: T1014: Rootkit
Ebury is executed through hooking the keyutils.so file used by legitimate versions of `OpenSSH` and `libcurl`.
MITRE ATT&CK technique: T1129: Shared Modules
Ebury has encoded C2 traffic in hexadecimal format.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Ebury can use the commands `Xcsh` or `Xcls` to open a shell with Ebury level permissions and `Xxsh` to open a shell with root level.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Ecipekac has used a valid, legitimate digital signature to evade detection.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Ecipekac has the ability to decrypt fileless loader modules.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Ecipekac can download additional payloads to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Egregor has used BITSadmin to download and execute malicious DLLs.
MITRE ATT&CK technique: T1197: BITS Jobs
Egregor has used DLL side-loading to execute its payload.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
Egregor has been decrypted before execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Egregor has disabled Windows Defender to evade protections.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Egregor can modify the GPO to evade detection.
MITRE ATT&CK technique: T1484.001: Domain or Tenant Policy Modification- Group Policy Modification
Egregor has the ability to download files from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Egregor has masqueraded the svchost.exe process to exfiltrate data.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Egregor has used the Windows API to make detection more difficult.
MITRE ATT&CK technique: T1106: Native API
Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell