sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Cuckoo Stealer has copied and renamed itself to DumpMediaSpotifyMusicConverter.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Cuckoo Stealer can use sockets for communications to its C2 server.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Cuckoo Stealer can create and populate property list files to enable execution.
MITRE ATT&CK technique: T1647: Plist File Modification
Cuckoo Stealer can use `ps aux` to enumerate running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Cuckoo Stealer can run `screencapture` to collect screenshots from compromised hosts.
MITRE ATT&CK technique: T1113: Screen Capture
Cuckoo Stealer has the ability to search systems for installed applications.
MITRE ATT&CK technique: T1518: Software Discovery
Cuckoo Stealer is a stripped binary payload.
MITRE ATT&CK technique: T1027.008: Obfuscated Files or Information- Stripped Payloads
Cuckoo Stealer can gather information about the OS version and hardware on compromised hosts.
MITRE ATT&CK technique: T1082: System Information Discovery
Cuckoo Stealer can check the systems `LANG` environmental variable to prevent infecting devices from Armenia , Belarus , Kazakhstan , Russia , and Ukraine .
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Cuckoo Stealer can determine the geographical location of a victim host by checking the language.
MITRE ATT&CK technique: T1614: System Location Discovery
Cuckoo Stealer can discover and send the username from a compromised host to C2.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Cuckoo Stealer can spawn a bash shell to enable execution on compromised hosts.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Cuckoo Stealer can use the curl API for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
Cyclops Blink has maintained persistence by patching legitimate device firmware when it is downloaded, including that of WatchGuard devices.
MITRE ATT&CK technique: T1542.002: Pre-OS Boot- Component Firmware
Cyclops Blink can upload files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
Cyclops Blink can decrypt and parse instructions sent from C2.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Cyclops Blink can modify the Linux iptables firewall to enable C2 communication on network devices via a stored list of port numbers.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Cyclops Blink has the ability to upload exfiltrated files to a C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Cyclops Blink has the ability to download files to target systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Cyclops Blink has the ability to create a pipe to enable inter-process communication.
MITRE ATT&CK technique: T1559: Inter-Process Communication
Cyclops Blink can rename its running process to kworker:0/1 to masquerade as a Linux kernel thread. Cyclops Blink has also named RC scripts used for persistence after WatchGuard artifacts.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Cyclops Blink has used Tor nodes for C2 traffic.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Cyclops Blink can use various Linux API functions including those for execution and discovery.
MITRE ATT&CK technique: T1106: Native API
Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.
MITRE ATT&CK technique: T1132.002: Data Encoding- Non-Standard Encoding
Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.
MITRE ATT&CK technique: T1571: Non-Standard Port
Cyclops Blink can enumerate the process it is currently running under.
MITRE ATT&CK technique: T1057: Process Discovery
Cyclops Blink can use DNS over HTTPS to resolve C2 nodes.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.
MITRE ATT&CK technique: T1037.004: Boot or Logon Initialization Scripts- RC Scripts
Cyclops Blink has the ability to query device information.
MITRE ATT&CK technique: T1082: System Information Discovery
Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Cyclops Blink has the ability to use the Linux API function `utime` to change the timestamps of modified firmware update images.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Cyclops Blink can download files via HTTP and HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DCSrv has encrypted drives using the core encryption mechanism from DiskCryptor.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
DCSrv's configuration is encrypted.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
DCSrv has masqueraded its service as a legitimate svchost.exe process.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
DCSrv has created Registry keys for persistence.
MITRE ATT&CK technique: T1112: Modify Registry
DCSrv has used various Windows API functions, including `DeviceIoControl`, as part of its encryption process.
MITRE ATT&CK technique: T1106: Native API
DCSrv has a function to sleep for two hours before rebooting the system.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process.
MITRE ATT&CK technique: T1124: System Time Discovery
DCSrv has created new services for persistence by modifying the Registry.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
DDKONG decodes an embedded configuration using XOR.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
DDKONG lists files on the victim’s machine.
MITRE ATT&CK technique: T1083: File and Directory Discovery
DDKONG downloads and uploads files on the victim’s machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
DEADEYE has the ability to combine multiple sections of a binary which were broken up to evade detection into a single .dll prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
The DEADEYE.EMBED variant of DEADEYE has the ability to embed payloads inside of a compiled binary.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
DEADEYE has encrypted its payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
DEADEYE can ensure it executes only on intended systems by identifying the victim's volume serial number, hostname, and/or DNS domain.
MITRE ATT&CK technique: T1480: Execution Guardrails
DEADEYE has used `schtasks /change` to modify scheduled tasks including `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
DEADEYE can use `msiexec.exe` for execution of malicious DLL.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
The DEADEYE.EMBED variant of DEADEYE can embed its payload in an alternate data stream of a local file.
MITRE ATT&CK technique: T1564.004: Hide Artifacts- NTFS File Attributes
DEADEYE can execute the `GetComputerNameA` and `GetComputerNameExA` WinAPI functions.
MITRE ATT&CK technique: T1106: Native API
DEADEYE can use `rundll32.exe` for execution of living off the land binaries such as `SHELL32.DLL`.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
DEADEYE has used the scheduled tasks `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared` to establish persistence.
MITRE ATT&CK technique: T1053: Scheduled Task/Job
DEADEYE can enumerate a victim computer's volume serial number and host name.
MITRE ATT&CK technique: T1082: System Information Discovery
DEADEYE can discover the DNS domain name of a targeted system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
DEADEYE can run `cmd /c copy /y /b C:\Users\public\syslog_6-*.dat C:\Users\public\syslog.dll` to combine separated sections of code into a single DLL prior to execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
DEADWOOD changes the password for local and domain users via net.exe to a random 32 character string to prevent these accounts from logging on. Additionally, DEADWOOD will terminate the winlogon.exe process to prevent attempts to log on to the infected system.
MITRE ATT&CK technique: T1531: Account Access Removal
DEADWOOD overwrites files on victim systems with random data to effectively destroy them.
MITRE ATT&CK technique: T1485: Data Destruction
DEADWOOD XORs some strings within the binary using the value 0xD5, and deobfuscates these items at runtime.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
DEADWOOD deletes files following overwriting them with random data.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
DEADWOOD opens and writes zeroes to the first 512 bytes of each drive, deleting the MBR. DEADWOOD then sends the control code IOCTL_DISK_DELETE_DRIVE_LAYOUT to ensure the MBR is removed from the drive.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
DEADWOOD contains an embedded, AES-encrypted payload labeled METADATA that provides configuration information for follow-on execution.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
DEADWOOD contains an embedded, AES-encrypted resource named METADATA that contains configuration information for follow-on execution.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
DEADWOOD will attempt to masquerade its service execution using benign-looking names such as ScDeviceEnums.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
DEADWOOD can be executed as a service using various names, such as ScDeviceEnums.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
DEADWOOD will set a timestamp value to determine when wiping functionality starts. When the timestamp is met on the system, a trigger file is created on the operating system allowing for execution to proceed. If the timestamp is in the past, the wiper will execute immediately.
MITRE ATT&CK technique: T1124: System Time Discovery
DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
DEATHRANSOM can use loop operations to enumerate directories on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
DEATHRANSOM can download files to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DEATHRANSOM can delete volume shadow copies on compromised hosts.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
DEATHRANSOM has the ability to use loop operations to enumerate network resources.
MITRE ATT&CK technique: T1135: Network Share Discovery
DEATHRANSOM can enumerate logical drives on a target system.
MITRE ATT&CK technique: T1082: System Information Discovery
Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
DEATHRANSOM can use HTTPS to download files.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DEATHRANSOM has the ability to use WMI to delete volume shadow copies.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
DOGCALL can capture microphone data from the victim's machine.
MITRE ATT&CK technique: T1123: Audio Capture
DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
DOGCALL is encrypted using single-byte XOR.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
DOGCALL can download and execute additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DOGCALL is capable of logging keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
DOGCALL is capable of capturing screenshots of the victim's machine.
MITRE ATT&CK technique: T1113: Screen Capture
DRATzarus can collect information from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.
MITRE ATT&CK technique: T1622: Debugger Evasion
DRATzarus can deploy additional tools onto an infected machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
DRATzarus can use various API calls to see if it is running in a sandbox.
MITRE ATT&CK technique: T1106: Native API
DRATzarus can be partly encrypted with XOR.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
DRATzarus can enumerate and examine running processes to determine if a debugger is present.
MITRE ATT&CK technique: T1057: Process Discovery
DRATzarus can search for other machines connected to compromised host and attempt to map the network.
MITRE ATT&CK technique: T1018: Remote System Discovery
DRATzarus's dropper can be packed with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
DRATzarus can obtain a list of users from an infected machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time.
MITRE ATT&CK technique: T1124: System Time Discovery
DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to measure function timing. DRATzarus can also remotely shut down into sleep mode under specific conditions to evade detection.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
DRATzarus can use HTTP or HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DUSTPAN decodes and decrypts embedded payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
DUSTPAN decrypts and executes an embedded payload.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
DUSTPAN decrypts an embedded payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
DUSTPAN is often disguised as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
DUSTPAN can inject its decrypted payload into another process.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
DUSTPAN can persist as a Windows Service in operations.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
DUSTTRAP can enumerate running application windows.
MITRE ATT&CK technique: T1010: Application Window Discovery
DUSTTRAP can delete infected system log information.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
DUSTTRAP can gather data from infected systems.
MITRE ATT&CK technique: T1005: Data from Local System
DUSTTRAP deobfuscates embedded payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
DUSTTRAP can enumerate domain accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
DUSTTRAP can identify Active Directory information and related items.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
DUSTTRAP contains additional embedded DLLs and configuration files that are loaded into memory during execution.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
DUSTTRAP begins with an initial launcher that decrypts an AES-128-CFB encrypted file on disk and executes it in memory.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
DUSTTRAP can exfiltrate collected data over C2 channels.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
DUSTTRAP can enumerate files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
DUSTTRAP can identify victim environment Group Policy information.
MITRE ATT&CK technique: T1615: Group Policy Discovery
DUSTTRAP restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed.
MITRE ATT&CK technique: T1070: Indicator Removal
DUSTTRAP can retrieve and load additional payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DUSTTRAP can perform keylogging operations.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
DUSTTRAP can enumerate local user accounts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
DUSTTRAP can identify infected system log information.
MITRE ATT&CK technique: T1654: Log Enumeration
DUSTTRAP can remove network shares from infected systems.
MITRE ATT&CK technique: T1070.005: Indicator Removal- Network Share Connection Removal
DUSTTRAP can identify and enumerate victim system network shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
DUSTTRAP can enumerate running processes.
MITRE ATT&CK technique: T1057: Process Discovery
DUSTTRAP compromises the `.text` section of a legitimate system DLL in `%windir%` to hold the contents of retrieved plug-ins.
MITRE ATT&CK technique: T1055: Process Injection
DUSTTRAP can enumerate Registry items.
MITRE ATT&CK technique: T1012: Query Registry
DUSTTRAP can use `ping` to identify remote hosts within the victim network.
MITRE ATT&CK technique: T1018: Remote System Discovery
DUSTTRAP can capture screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
DUSTTRAP can identify security software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
DUSTTRAP decryption relies on the infected machine's `HKLM\SOFTWARE\Microsoft\Cryptography\MachineGUID` value.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
DUSTTRAP reads the value of the infected system's `HKLM\SYSTEM\Microsoft\Cryptography\MachineGUID` value.
MITRE ATT&CK technique: T1082: System Information Discovery
DUSTTRAP can enumerate infected system network information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
DUSTTRAP reads the infected system's current time and writes it to a log file during execution.
MITRE ATT&CK technique: T1124: System Time Discovery
DUSTTRAP can execute commands via `cmd.exe`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Dacls can encrypt its configuration file with AES CBC.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Dacls can scan directories on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Dacls can download its payload from a C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Dacls can establish persistence via a LaunchAgent.
MITRE ATT&CK technique: T1543.001: Create or Modify System Process- Launch Agent
Dacls can establish persistence via a Launch Daemon.
MITRE ATT&CK technique: T1543.004: Create or Modify System Process- Launch Daemon
The Dacls Mach-O binary has been disguised as a .nib file.
MITRE ATT&CK technique: T1036: Masquerading
Dacls can collect data on running and parent processes.
MITRE ATT&CK technique: T1057: Process Discovery
Dacls can use HTTPS in C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DanBot can use use IPv4 A records and IPv6 AAAA DNS records in C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
DanBot can upload files from compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
DanBot can use a VBA macro to decode its payload prior to installation and execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
DanBot can Base64 encode its payload.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
DanBot can delete its configuration file after installation.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
DanBot can download additional files to a targeted system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DanBot has relied on victims' opening a malicious file for initial execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
DanBot can use a scheduled task for installation.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
DanBot has been distributed within a malicious Excel attachment via spearphishing emails.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
DanBot can use VNC for remote access to targeted systems.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
DanBot can use a VBA macro embedded in an Excel file to drop the payload.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
DanBot can use HTTP in C2 communication.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DanBot has the ability to execute arbitrary commands via `cmd.exe`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
DarkComet can listen in to victims' conversations through the system’s microphone.
MITRE ATT&CK technique: T1123: Audio Capture
DarkComet can steal data from the clipboard.
MITRE ATT&CK technique: T1115: Clipboard Data
DarkComet can execute various types of scripts on the victim’s machine.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
DarkComet can disable Security Center functions like the Windows Firewall.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
DarkComet can disable Security Center functions like anti-virus.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
DarkComet can load any files onto the infected machine to execute.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DarkComet has a keylogging capability.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
DarkComet adds a Registry value for its installation routine to the Registry Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA=”0” and HKEY_CURRENT_USER\Software\DC3_FEXEC.
MITRE ATT&CK technique: T1112: Modify Registry
DarkComet can list active processes running on the victim’s machine.
MITRE ATT&CK technique: T1057: Process Discovery
DarkComet adds several Registry entries to enable automatic execution at every system startup.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
DarkComet has the option to compress its payload using UPX or MPRESS.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.
MITRE ATT&CK technique: T1082: System Information Discovery
DarkComet gathers the username from the victim’s machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
DarkComet can access the victim’s webcam to take pictures.
MITRE ATT&CK technique: T1125: Video Capture
DarkComet can use HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DarkComet can launch a remote shell to execute commands on the victim’s machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
DarkGate elevates accounts created through the malware to the local administration group during execution.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
DarkGate will search for cryptocurrency wallets by examining application window names for specific strings. DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.
MITRE ATT&CK technique: T1010: Application Window Discovery
DarkGate uses AutoIt scripts dropped to a hidden directory during initial installation phases, such as `test.au3`.
MITRE ATT&CK technique: T1059.010: Command and Scripting Interpreter- AutoHotKey & AutoIT
DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.
MITRE ATT&CK technique: T1119: Automated Collection
DarkGate uses two distinct User Account Control bypass techniques to escalate privileges.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.
MITRE ATT&CK technique: T1115: Clipboard Data
DarkGate can deploy follow-on cryptocurrency mining payloads.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
DarkGate includes one infection vector that leverages a malicious "KeyScramblerE.DLL" library that will load during the execution of the legitimate KeyScrambler application.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
DarkGate can cloak command and control traffic in DNS records from legitimate services to avoid reputation-based detection techniques.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
DarkGate can deploy follow-on ransomware payloads.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.
MITRE ATT&CK technique: T1001: Data Obfuscation
DarkGate checks the BeingDebugged flag in the PEB structure during execution to identify if the malware is being debugged.
MITRE ATT&CK technique: T1622: Debugger Evasion
DarkGate installation includes binary code stored in a file located in a hidden directory, such as shell.txt, that is decrypted then executed. DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API CallWindowProc to decode and then execute.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
DarkGate will terminate processes associated with several security software products if identified during execution.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
DarkGate command and control includes hard-coded domains in the malware chosen to masquerade as legitimate services such as Akamai CDN or Amazon Web Services.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
DarkGate masquerades malicious LNK files as PDF objects using the double extension .pdf.lnk.
MITRE ATT&CK technique: T1036.007: Masquerading- Double File Extension
DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation. DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
DarkGate uses per-victim links for hosting malicious archives, such as ZIP files, in services such as SharePoint to prevent other entities from retrieving them.
MITRE ATT&CK technique: T1480: Execution Guardrails
DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Some versions of DarkGate search for the hard-coded folder C:\Program Files\e Carte Bleue.
MITRE ATT&CK technique: T1083: File and Directory Discovery
DarkGate can deploy payloads capable of capturing credentials related to cryptocurrency wallets.
MITRE ATT&CK technique: T1657: Financial Theft
DarkGate initial installation involves dropping several files to a hidden directory named after the victim machine name.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
DarkGate command and control includes hard-coded domains in the malware masquerading as legitimate services such as Akamai CDN or Amazon Web Services.
MITRE ATT&CK technique: T1665: Hide Infrastructure
DarkGate edits the Registry key HKCU\Software\Classes\mscfile\shell\open\command to execute a malicious AutoIt script. When eventvwr.exe is executed, this will call the Microsoft Management Console , which in turn references the modified Registry key.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
DarkGate retrieves cryptocurrency mining payloads and commands in encrypted traffic from its command and control server. DarkGate uses Windows Batch scripts executing the curl command to retrieve follow-on payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DarkGate can delete system restore points through the command cmd.exe /c vssadmin delete shadows /for=c: /all /quiet”.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
DarkGate will spawn a thread on execution to capture all keyboard events and write them to a predefined log file.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
DarkGate creates a local user account, SafeMode, via net user commands.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
DarkGate initial infection payloads can masquerade as pirated media content requiring user interaction for code execution. DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
DarkGate can masquerade as pirated media content for initial delivery to victims.
MITRE ATT&CK technique: T1036: Masquerading
DarkGate uses the native Windows API CallWindowProc to decode and launch encoded shellcode payloads during execution. DarkGate can call kernel mode functions directly to hide the use of process hollowing methods during execution.
MITRE ATT&CK technique: T1106: Native API
DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
DarkGate relies on parent PID spoofing as part of its "rootkit-like" functionality to evade detection via Task Manager or Process Explorer.
MITRE ATT&CK technique: T1134.004: Access Token Manipulation- Parent PID Spoofing
DarkGate overrides the %windir% environment variable by setting a Registry key, HKEY_CURRENT_User\Environment\windir, to an alternate command to execute a malicious AutoIt script. This allows DarkGate to run every time the scheduled task DiskCleanup is executed as this uses the path value %windir%\system32\cleanmgr.exe for execution.
MITRE ATT&CK technique: T1574.007: Hijack Execution Flow- Path Interception by PATH Environment Variable
DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.
MITRE ATT&CK technique: T1057: Process Discovery
DarkGate leverages process hollowing techniques to evade detection, such as decrypting the content of an encrypted PE file and injecting it into the process vbc.exe.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
DarkGate installation includes AutoIt script execution creating a shortcut to itself as an LNK object, such as bill.lnk, in the victim startup folder. DarkGate installation finishes with the creation of a registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in the C:\\ root directory that copies and renames the legitimate Windows curl command to this new location.
MITRE ATT&CK technique: T1036.003: Masquerading- Rename System Utilities
DarkGate looks for various security products by process name using hard-coded values in the malware. DarkGate will not execute its keylogging thread if a process name associated with Trend Micro anti-virus is identified, or if runtime checks identify the presence of Kaspersky anti-virus. DarkGate will initiate a new thread if certain security products are identified on the victim, and recreate any malicious files associated with it if it determines they were removed by security software in a new system location.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
DarkGate tries to elevate privileges to SYSTEM using PsExec to locally execute as a service, such as cmd /c c:\temp\PsExec.exe -accepteula -j -d -s Target Binary.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
DarkGate can be distributed through emails with malicious attachments from a spoofed email address.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
DarkGate is distributed in phishing emails containing links to distribute malicious VBS or MSI files. DarkGate uses applications such as Microsoft Teams for distributing links to payloads.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
DarkGate queries system resources on an infected machine to identify if it is executing in a sandbox or virtualized environment.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
DarkGate uses the Delphi methods Sysutils::DiskSize and GlobalMemoryStatusEx to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment. DarkGate will gather various system information such as display adapter description, operating system type and version, processor type, and RAM amount.
MITRE ATT&CK technique: T1082: System Information Discovery
DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.
MITRE ATT&CK technique: T1614: System Location Discovery
DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename. DarkGate queries victim system epoch time during execution. DarkGate captures system time information as part of automated profiling on initial installation.
MITRE ATT&CK technique: T1124: System Time Discovery
DarkGate uses NirSoft tools to steal user credentials from the infected machine. NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.
MITRE ATT&CK technique: T1552: Unsecured Credentials
DarkGate initial infection mechanisms include masquerading as pirated media that launches malicious VBScript on the victim.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
DarkGate uses a malicious Windows Batch script to run the Windows code utility to retrieve follow-on script payloads.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
DarkTortilla can detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.
MITRE ATT&CK technique: T1574.012: Hijack Execution Flow- COR_PROFILER
DarkTortilla can download a clipboard information stealer module.
MITRE ATT&CK technique: T1115: Clipboard Data
DarkTortilla has used the `WshShortcut` COM object to create a .lnk shortcut file in the Windows startup folder.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
DarkTortilla can detect debuggers by using functions such as `DebuggerIsAttached` and `DebuggerIsLogging`. DarkTortilla can also detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.
MITRE ATT&CK technique: T1622: Debugger Evasion
DarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
DarkTortilla can use a .NET-based DLL named `RunPe6` for process injection.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
DarkTortilla has used `%HiddenReg%` and `%HiddenKey%` as part of its persistence via the Windows registry.
MITRE ATT&CK technique: T1564: Hide Artifacts
DarkTortilla can download additional packages for keylogging, cryptocurrency mining, and other capabilities; it can also retrieve malicious payloads such as Agent Tesla, AsyncRat, NanoCore, RedLine, Cobalt Strike, and Metasploit.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
DarkTortilla can check for internet connectivity by issuing HTTP GET requests.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
DarkTortilla can download a keylogging module.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
DarkTortilla has relied on a user to open a malicious document or archived file delivered via email for initial execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
DarkTortilla's payload has been renamed `PowerShellInfo.exe`.
MITRE ATT&CK technique: T1036: Masquerading
DarkTortilla has modified registry keys for persistence.
MITRE ATT&CK technique: T1112: Modify Registry
DarkTortilla can use a variety of API calls for persistence and defense evasion.
MITRE ATT&CK technique: T1106: Native API
DarkTortilla has been obfuscated with the DeepSea .NET and ConfuserEx code obfuscators.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
DarkTortilla can enumerate a list of running processes on a compromised system.
MITRE ATT&CK technique: T1057: Process Discovery
DarkTortilla has established persistence via the `Software\Microsoft\Windows NT\CurrentVersion\Run` registry key and by creating a .lnk shortcut file in the Windows startup folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
DarkTortilla can check for the Kaspersky Anti-Virus suite.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
DarkTortilla has been distributed via spearphishing emails containing archive attachments, with file types such as .iso, .zip, .img, .dmg, and .tar, as well as through malicious documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
DarkTortilla can search a compromised system's running processes and services to detect Hyper-V, QEMU, Virtual PC, Virtual Box, and VMware, as well as Sandboxie.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
DarkTortilla can obtain system information by querying the `Win32_ComputerSystem`, `Win32_BIOS`, `Win32_MotherboardDevice`, `Win32_PnPEntity`, and `Win32_DiskDrive` WMI objects.
MITRE ATT&CK technique: T1082: System Information Discovery
DarkTortilla can retrieve information about a compromised system's running services.
MITRE ATT&CK technique: T1007: System Service Discovery
DarkTortilla can implement the `kernel32.dll` Sleep function to delay execution for up to 300 seconds before implementing persistence or processing an addon package.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
DarkTortilla has used HTTP and HTTPS for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DarkTortilla can retrieve its primary payload from public sites such as Pastebin and Textbin.
MITRE ATT&CK technique: T1102: Web Service
DarkTortilla can use `cmd.exe` to add registry keys for persistence.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
DarkTortilla can use WMI queries to obtain system information.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
DarkTortilla has established persistence via the `Software\Microsoft\Windows NT\CurrentVersion\Winlogon` registry key.
MITRE ATT&CK technique: T1547.004: Boot or Logon Autostart Execution- Winlogon Helper DLL
DarkWatchman reports window names along with keylogger information to provide application context.
MITRE ATT&CK technique: T1010: Application Window Discovery
DarkWatchman can use TLS to encrypt its C2 channel.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
DarkWatchman can retrieve browser history.
MITRE ATT&CK technique: T1217: Browser Information Discovery
DarkWatchman has used Base64 to encode PowerShell commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
DarkWatchman has used the csc.exe tool to compile a C# executable.
MITRE ATT&CK technique: T1027.004: Obfuscated Files or Information- Compile After Delivery
DarkWatchman can collect files from a compromised host.
MITRE ATT&CK technique: T1005: Data from Local System
DarkWatchman has the ability to self-extract as a RAR archive.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
DarkWatchman has used a DGA to generate a domain name for C2.
MITRE ATT&CK technique: T1568.002: Dynamic Resolution- Domain Generation Algorithms
DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
DarkWatchman has been observed deleting its original launcher after installation.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
DarkWatchman has the ability to enumerate file and folder names.
MITRE ATT&CK technique: T1083: File and Directory Discovery
DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.
MITRE ATT&CK technique: T1070: Indicator Removal
DarkWatchman can delete shadow volumes using vssadmin.exe.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
DarkWatchman uses JavaScript to perform its core functionalities.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
DarkWatchman can track key presses with a keylogger module.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
DarkWatchman can stage local data in the Windows Registry.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
DarkWatchman has used an icon mimicking a text file to mask a malicious executable.
MITRE ATT&CK technique: T1036: Masquerading
DarkWatchman can modify Registry values to store configuration strings, keylogger, and output of components.
MITRE ATT&CK technique: T1112: Modify Registry
DarkWatchman can list signed PnP drivers for smartcard readers.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
DarkWatchman can query the Registry to determine if it has already been installed on the system.
MITRE ATT&CK technique: T1012: Query Registry
DarkWatchman has created a scheduled task for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
DarkWatchman can search for anti-virus products on the system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
DarkWatchman can load DLLs.
MITRE ATT&CK technique: T1129: Shared Modules
DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
DarkWatchman can collect the OS version, system architecture, and computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
DarkWatchman can identity the OS locale of a compromised host.
MITRE ATT&CK technique: T1614: System Location Discovery
DarkWatchman has collected the username from a victim machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
DarkWatchman can collect time zone information and system `UPTIME`.
MITRE ATT&CK technique: T1124: System Time Discovery
DarkWatchman uses HTTPS for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
DarkWatchman can use `cmd.exe` to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
DarkWatchman can use WMI to execute commands.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Daserf hides collected data in password-protected .rar archives.
MITRE ATT&CK technique: T1560: Archive Collected Data
Daserf hides collected data in password-protected .rar archives.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Some Daserf samples were signed with a stolen digital certificate.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
Daserf can download remote files.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Daserf can log keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Daserf uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Daserf can take screenshots.
MITRE ATT&CK technique: T1113: Screen Capture
A version of Daserf uses the MPRESS packer.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Daserf uses custom base64 encoding to obfuscate HTTP traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding