NightClub
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .003 | Application Layer Protocol: Mail Protocols |
NightClub can use emails for C2 communications.(Citation: MoustachedBouncer ESET August 2023) |
| .004 | Application Layer Protocol: DNS |
NightClub can use a DNS tunneling plugin to exfiltrate data by adding it to the subdomain portion of a DNS request.(Citation: MoustachedBouncer ESET August 2023) |
||
| Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
NightClub has created a Windows service named `WmdmPmSp` to establish persistence.(Citation: MoustachedBouncer ESET August 2023) |
| Enterprise | T1132 | .002 | Data Encoding: Non-Standard Encoding |
NightClub has used a non-standard encoding in DNS tunneling removing any `=` from the result of base64 encoding, and replacing `/` characters with `-s` and `+` characters with `-p`.(Citation: MoustachedBouncer ESET August 2023) |
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
NightClub has copied captured files and keystrokes to the `%TEMP%` directory of compromised hosts.(Citation: MoustachedBouncer ESET August 2023) |
| Enterprise | T1070 | .006 | Indicator Removal: Timestomp |
NightClub can modify the Creation, Access, and Write timestamps for malicious DLLs to match those of the genuine Windows DLL user32.dll.(Citation: MoustachedBouncer ESET August 2023) |
| Enterprise | T1056 | .001 | Input Capture: Keylogging |
NightClub can use a plugin for keylogging.(Citation: MoustachedBouncer ESET August 2023) |
| Enterprise | T1036 | .004 | Masquerading: Masquerade Task or Service |
NightClub has created a service named `WmdmPmSp` to spoof a Windows Media service.(Citation: MoustachedBouncer ESET August 2023) |
| .005 | Masquerading: Match Legitimate Name or Location |
NightClub has chosen file names to appear legitimate including EsetUpdate-0117583943.exe for its dropper.(Citation: MoustachedBouncer ESET August 2023) |
||
Groups That Use This Software |
||
| ID | Name | References |
|---|---|---|
| G1019 | MoustachedBouncer |
(Citation: MoustachedBouncer ESET August 2023) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.