Skip to content

Hide Navigation Hide TOC

AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2)

AshTag is a modular .NET backdoor with multiple features that has been used by WIRTE since at least 2025. AshTag is designed for persistence and remote command execution and can masquerade as a legitimate VisualServer utility.(Citation: Palo Alto Ashen Lepus DEC 2025)

Cluster A Galaxy A Cluster B Galaxy B Level
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Delay Execution - T1678 (a1df809c-7d0e-459f-8fe5-25474bab770b) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Malicious File - T1204.002 (232b7f21-adf9-4b42-b936-b9d6f7df856e) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Match Legitimate Resource Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Web Service - T1102 (830c9528-df21-472c-8c14-a036bf17d665) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware System Location Discovery - T1614 (c877e33f-1df6-40d6-b1e7-ce70f16f4979) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Exfiltration Over C2 Channel - T1041 (92d7da27-2d91-488e-a00c-059dc162766d) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Local Storage Discovery - T1680 (f2514ae4-4e9b-4f26-a5ba-c4ae85fe93c3) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18) Attack Pattern 1
AshTag - S9031 (bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2) Malware Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern 1
Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern 2
User Execution - T1204 (8c32eb4d-805f-4fc5-bf60-c4d476c131b5) Attack Pattern Malicious File - T1204.002 (232b7f21-adf9-4b42-b936-b9d6f7df856e) Attack Pattern 2
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) Attack Pattern Match Legitimate Resource Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) Attack Pattern 2
Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144) Attack Pattern Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern 2
Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9) Attack Pattern Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9) Attack Pattern 2
JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) Attack Pattern Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern 2