sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
XTunnel uses SSL/TLS and RC4 to encrypt traffic.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
XTunnel is capable of accessing locally stored passwords on victims.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
The C2 server used by XTunnel provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.
MITRE ATT&CK technique: T1008: Fallback Channels
XTunnel is capable of probing the network for open ports.
MITRE ATT&CK technique: T1046: Network Service Discovery
A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
XTunnel relays traffic between a C2 server and a victim.
MITRE ATT&CK technique: T1090: Proxy
XTunnel has been used to execute remote commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Xbash can create a cronjob for persistence if it determines it is on a Linux system.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
Xbash has destroyed Linux-based databases as part of its ransomware capabilities.
MITRE ATT&CK technique: T1485: Data Destruction
Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Xbash can download additional malicious files from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Xbash can execute malicious JavaScript payloads on the victim’s machine.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Xbash can use mshta for executing scripts.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Xbash can perform port scanning of TCP and UDP ports.
MITRE ATT&CK technique: T1046: Network Service Discovery
Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.
MITRE ATT&CK technique: T1110.001: Brute Force- Password Guessing
Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Xbash can create a Startup item for persistence if it determines it is on a Windows system.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Xbash can use regsvr32 for executing scripts.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Xbash can collect IP addresses and local intranet information from a victim’s machine.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Xbash can execute malicious VBScript payloads on the victim’s machine.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Xbash uses HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
YAHOYAH decrypts downloaded files before execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
YAHOYAH encrypts its configuration file using a simple algorithm.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
YAHOYAH uses HTTP GET requests to download other files that are executed in memory.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
YAHOYAH checks for antimalware solution processes on the system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
YAHOYAH checks for the system’s Windows OS version and hostname.
MITRE ATT&CK technique: T1082: System Information Discovery
YAHOYAH uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ZIPLINE can add itself to the exclusion list for the Ivanti Connect Secure Integrity Checker Tool if the `--exclude` parameter is passed by the `tar` process.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
ZIPLINE can find and append specific files on Ivanti Connect Secure VPNs based upon received commands.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ZIPLINE can download files to be saved on the compromised system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ZIPLINE can communicate with C2 using a custom binary protocol.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
ZIPLINE can identify running processes and their names.
MITRE ATT&CK technique: T1057: Process Discovery
ZIPLINE can create a proxy server on compromised hosts.
MITRE ATT&CK technique: T1090: Proxy
ZIPLINE can use AES-128-CBC to encrypt data for both upload and download.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
ZIPLINE can identify a specific string in intercepted network traffic, `SSH-2.0-OpenSSH_0.3xx.`, to trigger its command functionality.
MITRE ATT&CK technique: T1205: Traffic Signaling
ZIPLINE can use `/bin/sh` to create a reverse shell and execute commands.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
The ZLib backdoor compresses communications using the standard Zlib compression library.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
ZLib has sent data and files from a compromised host to its C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
ZLib has the ability to enumerate files and drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ZLib has the ability to download files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
ZLib has the ability to obtain screenshots of the compromised system.
MITRE ATT&CK technique: T1113: Screen Capture
ZLib has the ability to enumerate system information.
MITRE ATT&CK technique: T1082: System Information Discovery
ZLib has the ability to discover and manipulate Windows services.
MITRE ATT&CK technique: T1007: System Service Discovery
ZLib communicates over HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ZLib has the ability to execute shell commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ZLib creates Registry keys to allow itself to run as various services.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Zebrocy has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Zebrocy uses SSL and AES ECB for encrypting C2 communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.
MITRE ATT&CK technique: T1119: Automated Collection
Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Zebrocy has a command to delete files and directories.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the echo %APPDATA% command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Zebrocy stores all collected information in a single file before exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.
MITRE ATT&CK technique: T1037.001: Boot or Logon Initialization Scripts- Logon Script (Windows)
Zebrocy uses SMTP and POP3 for C2.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
Zebrocy identifies network drives when they are added to victim systems.
MITRE ATT&CK technique: T1135: Network Share Discovery
Zebrocy enumerates information about connected storage devices.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.
MITRE ATT&CK technique: T1057: Process Discovery
Zebrocy executes the reg query command to obtain information in the Registry.
MITRE ATT&CK technique: T1012: Query Registry
Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Zebrocy has a command to create a scheduled task for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.
MITRE ATT&CK technique: T1113: Screen Capture
Zebrocy's Delphi variant was packed with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Zebrocy collects the OS version, computer name and serial number for the storage volume C:\. Zebrocy also runs the systeminfo command to gather system information.
MITRE ATT&CK technique: T1082: System Information Discovery
Zebrocy runs the ipconfig /all command.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Zebrocy uses netstat -aon to gather network connection information.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Zebrocy gets the username from the system.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Zebrocy gathers the current time zone and date information from the system.
MITRE ATT&CK technique: T1124: System Time Discovery
Zebrocy uses HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Zebrocy uses cmd.exe to execute commands on the system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
One variant of Zebrocy uses WMI queries to gather information.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
ZeroCleare can deploy a vulnerable, signed driver on a compromised host to bypass operating system safeguards.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
ZeroCleare can receive command line arguments from an operator to corrupt the file system using the RawDisk driver.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
ZeroCleare can corrupt the file system and wipe the system drive on targeted hosts.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
ZeroCleare has used a vulnerable signed VBoxDrv driver to bypass Microsoft Driver Signature Enforcement protections and subsequently load the unsigned RawDisk driver.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
ZeroCleare has the ability to uninstall the RawDisk driver and delete the `rwdsk` file on disk.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ZeroCleare can call the `GetSystemDirectoryW` API to locate the system directory.
MITRE ATT&CK technique: T1106: Native API
ZeroCleare can use a malicious PowerShell script to bypass Windows controls.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
ZeroCleare can use the `IOCTL_DISK_GET_DRIVE_GEOMETRY_EX`, `IOCTL_DISK_GET_DRIVE_GEOMETRY`, and `IOCTL_DISK_GET_LENGTH_INFO` system calls to compute disk size.
MITRE ATT&CK technique: T1082: System Information Discovery
ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
ZeroT has used DLL side-loading to load malicious payloads.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ZeroT has encrypted its payload with RC4.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
ZeroT can download additional payloads onto the victim.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Some ZeroT DLL files have been packed with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit steganography.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
ZeroT has used RC4 to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.
MITRE ATT&CK technique: T1082: System Information Discovery
ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
ZeroT has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
Zeroaccess is a kernel-mode rootkit.
MITRE ATT&CK technique: T1014: Rootkit
Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.
MITRE ATT&CK technique: T1115: Clipboard Data
Zeus Panda obfuscates the macro commands in its initial payload.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Zeus Panda can launch remote scripts on the victim’s machine.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Zeus Panda hooks processes by leveraging its own IAT hooked functions.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
Zeus Panda decrypts strings in the code during the execution process.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Zeus Panda encrypts strings with XOR. Zeus Panda also encrypts all configuration and settings in AES and RC4.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Zeus Panda searches for specific directories on the victim’s machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.
MITRE ATT&CK technique: T1112: Modify Registry
Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
Zeus Panda uses PowerShell to download and execute the payload.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Zeus Panda checks for running processes on the victim’s machine.
MITRE ATT&CK technique: T1057: Process Discovery
Zeus Panda checks for the existence of a Registry key and if it contains certain values.
MITRE ATT&CK technique: T1012: Query Registry
Zeus Panda adds persistence by creating Registry Run keys.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Zeus Panda can take screenshots of the victim’s machine.
MITRE ATT&CK technique: T1113: Screen Capture
Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.
MITRE ATT&CK technique: T1082: System Information Discovery
Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Zeus Panda collects the current system time and sends it back to the C2 server.
MITRE ATT&CK technique: T1124: System Time Discovery
Zeus Panda uses HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Zox has the ability to upload files from a targeted system.
MITRE ATT&CK technique: T1005: Data from Local System
Zox has been encoded with Base64.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Zox has the ability to leverage local and remote exploits to escalate privileges.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
Zox can enumerate files on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Zox can download files to a compromised machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Zox has the ability to list processes.
MITRE ATT&CK technique: T1057: Process Discovery
Zox has the ability to use SMB for communication.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Zox has used the .PNG file format for C2 communications.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
Zox can enumerate attached drives.
MITRE ATT&CK technique: T1082: System Information Discovery
ZxShell has a command to clear system event logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
ZxShell has a command called RunAs, which creates a new process as another user or process context.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
ZxShell hooks several API functions to spawn system threads.
MITRE ATT&CK technique: T1056.004: Input Capture- Credential API Hooking
ZxShell can transfer files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
ZxShell can kill AV products' processes.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
ZxShell is injected into a shared SVCHOST process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
ZxShell has a feature to perform SYN flood attack on a host.
MITRE ATT&CK technique: T1499: Endpoint Denial of Service
ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
ZxShell can delete files from the system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ZxShell has used FTP for C2 connections.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
ZxShell has a command to open a file manager and explorer on the system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ZxShell has a command to transfer files from a remote host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
ZxShell has a feature to create local user accounts.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
ZxShell can create Registry entries to enable services to run.
MITRE ATT&CK technique: T1112: Modify Registry
ZxShell can leverage native API including RegisterServiceCtrlHandler to register a service.RegisterServiceCtrlHandler
MITRE ATT&CK technique: T1106: Native API
ZxShell can launch port scans.
MITRE ATT&CK technique: T1046: Network Service Discovery
ZxShell can use ports 1985 and 1986 in HTTP/S communication.
MITRE ATT&CK technique: T1571: Non-Standard Port
ZxShell has a command, ps, to obtain a listing of processes on the system.
MITRE ATT&CK technique: T1057: Process Discovery
ZxShell can set up an HTTP or SOCKS proxy.
MITRE ATT&CK technique: T1090: Proxy
ZxShell can query the netsvc group value data located in the svchost group Registry key.
MITRE ATT&CK technique: T1012: Query Registry
ZxShell has remote desktop functionality.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
ZxShell has used rundll32.exe to execute other DLLs and named pipes.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
ZxShell can capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
ZxShell can create a new service for execution.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.
MITRE ATT&CK technique: T1082: System Information Discovery
ZxShell can collect the owner and organization information from the target workstation.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
ZxShell can check the services on the system.
MITRE ATT&CK technique: T1007: System Service Discovery
ZxShell supports functionality for VNC sessions.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
ZxShell has a command to perform video device spying.
MITRE ATT&CK technique: T1125: Video Capture
ZxShell has used HTTP for C2 connections.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
ZxShell can launch a reverse command shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
ZxShell can create a new service using the service parser function ProcessScCommand.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
ZxxZ can collect data from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
ZxxZ has used a XOR key to decrypt strings.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
ZxxZ has been encoded to avoid detection from static analysis tools.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
ZxxZ can download and execute additional files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ZxxZ has relied on victims to open a malicious attachment delivered via email.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
ZxxZ has been disguised as a Windows security update service.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
ZxxZ has used API functions such as `Process32First`, `Process32Next`, and `ShellExecuteA`.
MITRE ATT&CK technique: T1106: Native API
ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.
MITRE ATT&CK technique: T1057: Process Discovery
ZxxZ can search the registry of a compromised host.
MITRE ATT&CK technique: T1012: Query Registry
ZxxZ has used scheduled tasks for persistence and execution.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
ZxxZ can search a compromised host to determine if it is running Windows Defender or Kasperky antivirus.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
ZxxZ has collected the host name and operating system product name from a compromised machine.
MITRE ATT&CK technique: T1082: System Information Discovery
ZxxZ can collect the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
adbupd can run a copy of cmd.exe.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
adbupd can use a WMI script to achieve persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
at can be used to schedule a task on a system to be executed at a specific date or time.
MITRE ATT&CK technique: T1053.002: Scheduled Task/Job- At
build_downer has the ability to download files from C2 to the infected host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
build_downer has the ability to use the WinExec API to execute malware on a compromised host.
MITRE ATT&CK technique: T1106: Native API
build_downer has the ability to add itself to the Registry Run key for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
build_downer has the ability to detect if the infected host is running an anti-virus process.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
build_downer can extract malware from a downloaded JPEG.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
build_downer has the ability to send system volume information to C2.
MITRE ATT&CK technique: T1082: System Information Discovery
build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.
MITRE ATT&CK technique: T1124: System Time Discovery
ccf32 has used `xcopy \\\c$\users\public\path.7z c:\users\public\bin\.7z /H /Y` to archive collected files.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
ccf32 can be used to automatically collect files from a compromised host.
MITRE ATT&CK technique: T1119: Automated Collection
ccf32 can collect files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
ccf32 can upload collected data and files to an FTP server.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
ccf32 can delete files and folders from compromised machines.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
ccf32 can parse collected files to identify specific file extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
ccf32 has created a hidden directory on targeted systems, naming it after the current local time .
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
ccf32 can temporarily store files in a hidden directory on the local host.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
ccf32 has copied files to a remote machine infected with Chinoxy or another backdoor.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
ccf32 can run on a daily basis using a scheduled task.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
ccf32 can determine the local time on targeted machines.
MITRE ATT&CK technique: T1124: System Time Discovery
ccf32 has used `cmd.exe` for archiving data and deleting files.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
certutil may be used to Base64 encode collected data.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
certutil has been used to decode binaries hidden inside certificate files as Base64 information.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
certutil can be used to download files from a given URL.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: certutil -addstore -f -user ROOT ProgramData\cert512121.der.
MITRE ATT&CK technique: T1553.004: Subvert Trust Controls- Install Root Certificate
cmd can be used to delete files from the file system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
cmd can be used to find files and directories with native functionality such as dir commands.
MITRE ATT&CK technique: T1083: File and Directory Discovery
cmd can be used to copy files to/from a remotely connected external system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
cmd can be used to copy files to/from a remotely connected internal system.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
cmd can be used to find information about the operating system.
MITRE ATT&CK technique: T1082: System Information Discovery
cmd is used to execute programs and other actions at the command-line interface.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
down_new has the ability to list the directories on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
down_new has the ability to download files to the compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
down_new has the ability to list running processes on a compromised host.
MITRE ATT&CK technique: T1057: Process Discovery
down_new has the ability to detect anti-virus products and processes on a compromised host.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
down_new has the ability to gather information on installed applications.
MITRE ATT&CK technique: T1518: Software Discovery
down_new has the ability to base64 encode C2 communications.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
down_new has the ability to AES encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
down_new has the ability to identify the system volume information of a compromised host.
MITRE ATT&CK technique: T1082: System Information Discovery
down_new has the ability to identify the MAC address of a compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
down_new has the ability to use HTTP in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
dsquery can be used to gather information on user accounts within a domain.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
dsquery can be used to gather information on permission groups within a domain.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
dsquery can be used to gather information on domain trusts with dsquery * -filter "" -attr *.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
dsquery has the ability to enumerate various information, such as the operating system and host name, for systems within a domain.
MITRE ATT&CK technique: T1082: System Information Discovery
esentutl can be used to collect data from local file systems.
MITRE ATT&CK technique: T1005: Data from Local System
esentutl can use the Volume Shadow Copy service to copy locked files such as `ntds.dit`.
MITRE ATT&CK technique: T1006: Direct Volume Access
esentutl can be used to copy files from a given URL.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
esentutl can be used to copy files to/from a remote share.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
esentutl can copy `ntds.dit` using the Volume Shadow Copy service.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
esentutl can be used to read and write alternate data streams.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
ftp may be used to exfiltrate data separate from the main command and control protocol.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
gh0st RAT is able to wipe event logs.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
gh0st RAT is able to open a remote shell to execute commands.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
A gh0st RAT variant has used DLL side-loading.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
gh0st RAT has encrypted TCP communications to evade detection.
MITRE ATT&CK technique: T1573: Encrypted Channel
gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.
MITRE ATT&CK technique: T1568.001: Dynamic Resolution- Fast Flux DNS
gh0st RAT has the capability to to delete files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
gh0st RAT can download files to the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
gh0st RAT has a keylogger.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
gh0st RAT has altered the InstallTime subkey.
MITRE ATT&CK technique: T1112: Modify Registry
gh0st RAT has used the `InterlockedExchange`, `SeShutdownPrivilege`, and `ExitWindowsEx` Windows API functions.
MITRE ATT&CK technique: T1106: Native API
gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
gh0st RAT has the capability to list processes.
MITRE ATT&CK technique: T1057: Process Discovery
gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function.
MITRE ATT&CK technique: T1055: Process Injection
gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.
MITRE ATT&CK technique: T1012: Query Registry
gh0st RAT has added a Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
A gh0st RAT variant has used rundll32 for execution.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
gh0st RAT can capture the victim’s screen remotely.
MITRE ATT&CK technique: T1113: Screen Capture
gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
gh0st RAT can load DLLs into memory.
MITRE ATT&CK technique: T1129: Shared Modules
gh0st RAT has used Zlib to compress C2 communications data before encrypting it.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
gh0st RAT uses RC4 and XOR to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.
MITRE ATT&CK technique: T1082: System Information Discovery
gh0st RAT can create a new service to establish persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
gsecdump can dump LSA secrets.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
gsecdump can dump Windows password hashes from the SAM.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
hcdLoader provides command-line access to the compromised system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
hcdLoader installs itself as a service for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
httpclient encrypts C2 content with XOR using a single byte, 0x12.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
httpclient uses HTTP for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
httpclient opens cmd.exe on the victim.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
iKitten will zip up the /Library/Keychains directory before exfiltrating it.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
iKitten prompts the user for their credentials.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
iKitten saves itself with a leading "." so that it's hidden from users by default.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
iKitten collects the keychains on the system.
MITRE ATT&CK technique: T1555.001: Credentials from Password Stores- Keychain
iKitten lists the current processes running.
MITRE ATT&CK technique: T1057: Process Discovery
iKitten adds an entry to the rc.common file for persistence.
MITRE ATT&CK technique: T1037.004: Boot or Logon Initialization Scripts- RC Scripts
iKitten will look for the current IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
ipconfig can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
jRAT can capture microphone recordings.
MITRE ATT&CK technique: T1123: Audio Capture
jRAT can capture clipboard data.
MITRE ATT&CK technique: T1115: Clipboard Data
jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
jRAT has a function to delete files from the victim’s machine.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
jRAT can browse file systems.
MITRE ATT&CK technique: T1083: File and Directory Discovery
jRAT can download and execute files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
jRAT has been distributed as HTA files with JScript.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
jRAT’s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
jRAT can map UPnP ports.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
jRAT can steal keys for VPNs and cryptocurrency wallets.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
jRAT can query and kill system processes.
MITRE ATT&CK technique: T1057: Process Discovery
jRAT can serve as a SOCKS proxy server.
MITRE ATT&CK technique: T1090: Proxy
jRAT can support RDP control.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
jRAT can be configured to reconnect at certain intervals.
MITRE ATT&CK technique: T1029: Scheduled Transfer
jRAT has the capability to take screenshots of the victim’s machine.
MITRE ATT&CK technique: T1113: Screen Capture
jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
jRAT payloads have been packed.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
jRAT can list and manage startup entries.
MITRE ATT&CK technique: T1037.005: Boot or Logon Initialization Scripts- Startup Items
jRAT collects information about the OS as well as system up-time upon receiving a connection from a backdoor.
MITRE ATT&CK technique: T1082: System Information Discovery
jRAT can gather victim internal and external IPs.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
jRAT can list network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
jRAT can list local services.
MITRE ATT&CK technique: T1007: System Service Discovery
jRAT has the capability to capture video from a webcam.
MITRE ATT&CK technique: T1125: Video Capture
jRAT has been distributed as HTA files with VBScript.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
jRAT has command line access.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
macOS.OSAMiner has used `osascript` to call itself via the `do shell script` command in the Launch Agent `.plist` file.
MITRE ATT&CK technique: T1059.002: Command and Scripting Interpreter- AppleScript
macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's `install.log` for apps matching its hardcoded list, killing all matching process names.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
macOS.OSAMiner has used `curl` to download a Stripped Payloads from a public facing adversary-controlled webpage.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
macOS.OSAMiner has placed a Stripped Payloads with a `plist` extension in the Launch Agent's folder.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
macOS.OSAMiner has used `launchctl` to restart the Launch Agent.
MITRE ATT&CK technique: T1569.001: System Services- Launchctl
macOS.OSAMiner has used `ps ax | grep | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery.
MITRE ATT&CK technique: T1057: Process Discovery
macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.
MITRE ATT&CK technique: T1027.008: Obfuscated Files or Information- Stripped Payloads
macOS.OSAMiner can parse the output of the native `system_profiler` tool to determine if the machine is running with 4 cores.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
macOS.OSAMiner can gather the device serial number and has checked to ensure there is enough disk space using the Unix utility `df`.
MITRE ATT&CK technique: T1082: System Information Discovery
meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network as the intended destination.
MITRE ATT&CK technique: T1090.004: Proxy- Domain Fronting
metaMain has used XOR-based encryption for collected files before exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
metaMain can support an HKCMD sideloading start method.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
metaMain can collect files and system information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
metaMain can decrypt and load other modules.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
metaMain's module file has been encrypted via XOR.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
metaMain can upload collected files and data to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
metaMain has deleted collected items after uploading the content to its C2 server.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
metaMain can recursively enumerate files in an operator-provided directory.
MITRE ATT&CK technique: T1083: File and Directory Discovery
metaMain can download files onto compromised systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
metaMain can log mouse events.
MITRE ATT&CK technique: T1056: Input Capture
metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
metaMain has the ability to log keyboard events.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
metaMain has stored the collected system files in a working directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
metaMain can write the process ID of a target process into the `HKEY_LOCAL_MACHINE\SOFTWARE\DDE\tpid` Registry value as part of its reflective loading activity.
MITRE ATT&CK technique: T1112: Modify Registry