DUSTTRAP
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1087 | .001 | Account Discovery: Local Account |
DUSTTRAP can enumerate local user accounts.(Citation: Google Cloud APT41 2024) |
| .002 | Account Discovery: Domain Account |
DUSTTRAP can enumerate domain accounts.(Citation: Google Cloud APT41 2024) |
||
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
DUSTTRAP can execute commands via `cmd.exe`.(Citation: Google Cloud APT41 2024) |
| Enterprise | T1070 | .001 | Indicator Removal: Clear Windows Event Logs |
DUSTTRAP can delete infected system log information.(Citation: Google Cloud APT41 2024) |
| .005 | Indicator Removal: Network Share Connection Removal |
DUSTTRAP can remove network shares from infected systems.(Citation: Google Cloud APT41 2024) |
||
| Enterprise | T1056 | .001 | Input Capture: Keylogging |
DUSTTRAP can perform keylogging operations.(Citation: Google Cloud APT41 2024) |
| Enterprise | T1027 | .009 | Obfuscated Files or Information: Embedded Payloads |
DUSTTRAP contains additional embedded DLLs and configuration files that are loaded into memory during execution.(Citation: Google Cloud APT41 2024) |
| .013 | Obfuscated Files or Information: Encrypted/Encoded File |
DUSTTRAP begins with an initial launcher that decrypts an AES-128-CFB encrypted file on disk and executes it in memory.(Citation: Google Cloud APT41 2024) |
||
| Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
DUSTTRAP can identify security software.(Citation: Google Cloud APT41 2024) |
| Enterprise | T1497 | .001 | Virtualization/Sandbox Evasion: System Checks |
DUSTTRAP decryption relies on the infected machine's `HKLM\SOFTWARE\Microsoft\Cryptography\MachineGUID` value.(Citation: Google Cloud APT41 2024) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.