mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
009ae77217
* E/f updates (#143) * E/F Update, Update Install Cert ID * Small fixes * Update common objects link (#142) * Update README.md * Update 09152023.md * Update README.md * Update 12182023.md * Adding descriptions to micro-behaviors * Fixing dead links * V3.1 updates (#144) * minor fixes for v3.1 * correct id --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
2.1 KiB
2.1 KiB
| ID | X0035 |
| Type | Backdoor |
| Aliases | Xagent |
| Platforms | Windows |
| Year | 2015 |
| Associated ATT&CK Software | CHOPSTICK |
CHOPSTICK
Malware family of modular backdoors.
ATT&CK Techniques
See ATT&CK: CHOPSTICK - Techniques Used.
Enhanced ATT&CK Techniques
| Name | Use |
|---|---|
| Defense Evasion::Modify Registry (E1112) | CHOPSTICK may encrypt and store configuration data inside a registry key. [1] |
| Discovery::System Information Discovery (E1082) | CHOPSTICK collects information from the host including Windows version, CPU architecture, and UAC settings. [1] |
| Defense Evasion::Hidden Files and Directories (F0005) | CHOPSTICK creates a hidden file for temporary storage. [1] |
| Collection::Keylogging (F0002) | CHOPSTICK collects user keystrokes. [1] |
| Collection::Screen Capture (E1113) | CHOPSTICK takes snapshots of deskop and window contents. [1] |
| Command and Control::C2 Communication::Send Data (B0030.001) | CHOPSTICK sends data to the C2 server using HTTP POST requests. [1] |
MBC Behaviors
| Name | Use |
|---|---|
| Cryptography::Encrypt Data::RC4 (C0027.009) | CHOPSTICK encrypts the configuration block using RC4 encryption. [1] |
Indicators of Compromise
SHA256 Hashes
- 8ec464c36951aa028554be9ed7c7d9aa0bfcc9fa65a7874759afa853a18ecea7
References
[1] https://web.archive.org/web/20210307034415/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf