MoonWind
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
MoonWind can execute commands via an interactive command shell.(Citation: Palo Alto MoonWind March 2017) MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.(Citation: Palo Alto MoonWind March 2017) |
| Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.(Citation: Palo Alto MoonWind March 2017) |
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
MoonWind saves information from its keylogging routine as a .zip file in the present working directory.(Citation: Palo Alto MoonWind March 2017) |
| Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
MoonWind encrypts C2 traffic using RC4 with a static key.(Citation: Palo Alto MoonWind March 2017) |
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
MoonWind can delete itself or specified files.(Citation: Palo Alto MoonWind March 2017) |
| Enterprise | T1056 | .001 | Input Capture: Keylogging |
MoonWind has a keylogger.(Citation: Palo Alto MoonWind March 2017) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.